New! Attacker Exploited Citrix Zero-Day Three Days Before the CVE Existed
.png){kind=spacer}
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: January 19–23, 2026
React exploitation, VPN brute forcing, and router scanning all traced back to the same network signature. What looked like separate campaigns was coordinated infrastructure.
CVE-2025-55182 with CVSS 10.0. 179,000 sessions included actual command injection. Metasploit module available. One hosting provider generated 57% of traffic.
Fortinet SSL VPN and Palo Alto GlobalProtect both targeted. 506,000 combined sessions. Fortinet attacks up 25% from baseline. VPN credentials remain ransomware's front door.
MikroTik RouterOS brute force campaign with a 64,000:1session-to-IP ratio. Compromised routers become pivot points for lateral movement and botnet recruitment.
JA4T signature linked React RCE, VPN brute force, and ENV crawling to shared infrastructure. Organized operations, not opportunistic scanning.
.png)
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: January 19–23, 2026
React exploitation, VPN brute forcing, and router scanning all traced back to the same network signature. What looked like separate campaigns was coordinated infrastructure.
CVE-2025-55182 with CVSS 10.0. 179,000 sessions included actual command injection. Metasploit module available. One hosting provider generated 57% of traffic.
Fortinet SSL VPN and Palo Alto GlobalProtect both targeted. 506,000 combined sessions. Fortinet attacks up 25% from baseline. VPN credentials remain ransomware's front door.
MikroTik RouterOS brute force campaign with a 64,000:1session-to-IP ratio. Compromised routers become pivot points for lateral movement and botnet recruitment.
JA4T signature linked React RCE, VPN brute force, and ENV crawling to shared infrastructure. Organized operations, not opportunistic scanning.
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
