Post

That which was originally a private customer threat intel share in our weekly At The Edge reports is now a public blog post! www.greynoise.io/blo... This is a deep dive into a massive reconnaissance campaign that unfolded between December 25–28. 1/4

A single operator systematically scanned the internet, testing 240+ different exploits to build a fresh inventory for 2026 ransomware attacks. Key Takeaways: * Timing is everything: Attackers used the holiday skeleton crew window to scan unimpeded for 4 days. 2/4

* The IAB Model: This wasn't a direct hit; it was a "restocking" of the Initial Access Broker market. * Infrastructure: The activity originated from a suspicious hosting provider (CTG Server Limited) with a history of phishing and abuse. 3/4