251 Malicious IPs Target Cloud-Based Device Exploiting 75 Exposure Points

On May 8, 2025, cybersecurity researchers at GreyNoise detected a highly orchestrated scanning operation targeting 75 known exposure points across the internet in just 24 hours.

The campaign, executed by 251 malicious IP addresses—all geolocated to Japan and hosted on Amazon Web Services (AWS)—triggered a diverse array of 75 distinct behaviors, including exploitation attempts for known Common Vulnerabilities and Exposures (CVEs), misconfiguration probes, and reconnaissance activity.

What sets this incident apart is its precision and brevity.

All 251 IPs were silent before and after the surge, indicating the likely use of temporarily rented cloud infrastructure for a single, coordinated operation.

This pattern suggests centralized planning and a high degree of automation, rather than random opportunistic scanning.

Technical Breakdown:

The operation cast a wide net, probing for weaknesses in a variety of technologies, many of which are foundational to enterprise and internet-facing systems.

Key targets included:

• Adobe ColdFusion (CVE-2018-15961, Remote Code Execution)
• Apache Struts (CVE-2017-5638, OGNL Injection)
• Elasticsearch (CVE-2015-1427, Groovy Sandbox Bypass RCE)
• Atlassian Confluence (CVE-2022-26134, OGNL Injection)
• Bash (CVE-2014-6271, Shellshock)

The attackers also scanned for misconfigurations and weak points, such as:

• CGI script vulnerabilities
• Environment variable exposures
• Git configuration leaks
• Shell upload possibilities
• WordPress author enumeration

Each observed behavior was cataloged using GreyNoise tags, which help defenders identify and dynamically block malicious activity.

For example, a tag like ColdFusion RCE Attempt, this would be triggered if the following exploit code were detected in HTTP traffic:

textPOST /cfide/adminapi/base.cfc?method=login HTTP/1.1
Host: vulnerable-server
Content-Type: application/x-www-form-urlencoded
Content-Length: 45

cfcPath=../../../../../../../../etc/passwd

This code attempts a path traversal exploit against ColdFusion, a pattern seen in the May 8 campaign.

Centralized Infrastructure and Defensive Measures

GreyNoise’s overlap analysis revealed that the vast majority of IPs (251 out of 295 for ColdFusion, 265 for Struts, and 260 for Elasticsearch) participated in all three major exploit types, reinforcing the conclusion of a single operator or orchestrated toolset.

Such overlap is increasingly common in cloud-based attacks, where adversaries can rapidly spin up and discard IP addresses to evade detection.

Immediate Recommendations for Defenders

• Block all 251 identified malicious IPs to prevent follow-up exploitation.
• Implement dynamic IP blocking for any addresses triggering the 75 GreyNoise tags associated with this campaign.
• Review logs from May 8 for signs of reconnaissance or exploitation attempts.
• Patch and monitor systems running ColdFusion, Apache Struts, Elasticsearch, and other targeted technologies, especially those with internet-facing endpoints.

Risk Factors Table

Risk Factor	Description	Severity	Mitigation Strategy
Legacy CVEs	Exploits target old, unpatched vulnerabilities	High	Patch management, vulnerability scanning
Edge Infrastructure	A single toolset can scale attacks rapidly	High	Regular audits, network segmentation
Cloud-Based IP Rotation	Temporary, disposable IPs evade static blocklists	Medium	Dynamic IP blocking, threat intelligence
Misconfiguration Probes	Scans for weak/default settings and leaked configs	Medium	Harden configurations, continuous monitoring
Broad Reconnaissance	Attackers seek any susceptible system, not just one	High	Comprehensive security posture assessment
Orchestration & Automation	Single toolset can scale attacks rapidly	High	Automated detection and response

This event underscores the increasing sophistication and speed of modern cyber threats, especially those leveraging cloud infrastructure for large-scale, short-lived campaigns.

The May 8 scanning surge is a clear warning for organizations to prioritize patching, dynamic threat intelligence, and vigilant monitoring of their edge and legacy systems.

Similar coordinated scans have preceded major zero-day discoveries in the past, making rapid defensive action critical for reducing risk.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!