Security researchers at GreyNoise have uncovered a sophisticated cloud-based scanning operation that targeted 75 different “exposure points” on May 8, 2025. The campaign utilized 251 malicious IP addresses, all originating from Japan and hosted on Amazon’s infrastructure.

“These IPs triggered 75 distinct behaviors, including CVE exploits, misconfiguration probes, and recon activity,” reported GreyNoise. “All IPs were silent before and after the surge, indicating temporary infrastructure rental for a single operation.”

## Wide-Ranging Target List

The attackers cast a broad net, targeting vulnerabilities across numerous platforms including:

– Adobe ColdFusion (CVE-2018-15961 – Remote code execution)
– Apache Struts (CVE-2017-5638 – OGNL injection)
– Atlassian Confluence (CVE-2022-26134 – OGNL Injection)
– Bash (CVE-2014-6271 – Shellshock)
– Elasticsearch (CVE-2015-1427 – Groovy sandbox bypass and RCE)

Additional scanning activities included CGI script scanning, environment variable exposure checks, Git config crawling, shell upload attempts, and WordPress author enumeration.

## One-Day Operation

Notably, the scanning activity occurred exclusively on May 8, with no activity detected before or after this date. The campaign showed significant overlap in targeting patterns:
– 295 IP addresses scanned for CVE-2018-15961
– 265 IPs targeted Apache Struts
– 260 IPs probed for CVE-2015-1427
– 251 IPs overlapped across all three vulnerability scans

“This level of overlap points to a single operator or toolset deployed across many temporary IPs — an increasingly common pattern in opportunistic but orchestral scanning,” GreyNoise concluded.

Organizations are advised to block the identified malicious IP addresses immediately, though researchers caution that subsequent exploitation attempts may come from different infrastructure.