New! Attacker Exploited Citrix Zero-Day Three Days Before the CVE Existed
.png){kind=spacer}
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: June 01 – June 08, 2026
This week's highest-intent activity targeted the login surfaces of remote access — RDP, enterprise SSL VPN, and router management — not any new vulnerability. A single host produced more than a quarter of all RDP-crawling traffic GreyNoise observed: 4.18 million sessions in a 48-hour burst, then silence. Enterprise SSL VPN portals from every major vendor drew six-figure credential pressure, and a MikroTik RouterOS brute-force campaign ran for a third straight week. The actionable intelligence is the specific IPs, ASNs, and behavioral tags to hunt — not another hardening checklist.
94.102.49.82 (AS202425, Netherlands, malicious) generated 4,180,759 sessions — RDP Crawler 3.13M plus RDP Bruteforce 280K — more than a quarter of all RDP-crawling traffic GreyNoise recorded this week, across a wide port range, concentrated in a 48-hour burst then silent.
Fortinet (686K) and Cisco (401K) drew six-figure SSL VPN bruteforcing; SonicWall (325K login / 331K API), Cisco ASA (264K), and Palo Alto (255K) drew six-figure login and API scanning of the same portals. Apply GreyNoise dynamic blocklists for the Fortinet, Cisco, SonicWall, and Palo Alto login-scanner tags — the distributed source pattern makes tag-based blocking the primary lever.
Two hosts (45.198.224.18 NL, 45.205.1.5 BR) on TCP/8728 accounted for nearly all of the dataset's RouterOS brute-force sessions this week.
Eight of the ten busiest sources are classified malicious and a ninth suspicious; all sit on rented hosting, mostly in the Netherlands. Apply GreyNoise dynamic blocklists for the relevant tags — the IPs rotate, the tag-based coverage does not.
.png)
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: June 01 – June 08, 2026
This week's highest-intent activity targeted the login surfaces of remote access — RDP, enterprise SSL VPN, and router management — not any new vulnerability. A single host produced more than a quarter of all RDP-crawling traffic GreyNoise observed: 4.18 million sessions in a 48-hour burst, then silence. Enterprise SSL VPN portals from every major vendor drew six-figure credential pressure, and a MikroTik RouterOS brute-force campaign ran for a third straight week. The actionable intelligence is the specific IPs, ASNs, and behavioral tags to hunt — not another hardening checklist.
94.102.49.82 (AS202425, Netherlands, malicious) generated 4,180,759 sessions — RDP Crawler 3.13M plus RDP Bruteforce 280K — more than a quarter of all RDP-crawling traffic GreyNoise recorded this week, across a wide port range, concentrated in a 48-hour burst then silent.
Fortinet (686K) and Cisco (401K) drew six-figure SSL VPN bruteforcing; SonicWall (325K login / 331K API), Cisco ASA (264K), and Palo Alto (255K) drew six-figure login and API scanning of the same portals. Apply GreyNoise dynamic blocklists for the Fortinet, Cisco, SonicWall, and Palo Alto login-scanner tags — the distributed source pattern makes tag-based blocking the primary lever.
Two hosts (45.198.224.18 NL, 45.205.1.5 BR) on TCP/8728 accounted for nearly all of the dataset's RouterOS brute-force sessions this week.
Eight of the ten busiest sources are classified malicious and a ninth suspicious; all sit on rented hosting, mostly in the Netherlands. Apply GreyNoise dynamic blocklists for the relevant tags — the IPs rotate, the tag-based coverage does not.
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
