MOVEit Mayhem: Surge in Scanning Sparks Security Scare
GreyNoise warns of a notable surge in scanning activity targeting MOVEit Transfer systems, hinting at potential mass exploitation. The spike in scanning suggests that these systems are once again under the threat actor’s scanner. Users are advised to block offending IPs and ensure their software is updated to avoid exposure.
Hot Take:
Looks like cybercriminals have decided to MOVEit, MOVEit real good! With a sudden spike in IPs nosier than a toddler with a kazoo, it’s clear the digital mischief-makers are out for another round. It’s high time businesses hit the ‘update’ button faster than a caffeine-fueled coder at a hackathon!
Key Points:
- Surge in scanning activity targeting MOVEit Transfer systems since May 27, 2025.
- Over 682 unique IPs flagged, with 449 observed in the last 24 hours.
- 344 IPs labeled as suspicious and 77 deemed malicious.
- Most IPs originate from the US, followed by Germany and other countries.
- Low-volume exploitation attempts detected for two known MOVEit Transfer flaws.
Already a member? Log in here