2024-12-13 11:49 UTC

Large scale RDP scanning activity

We are seeing large numbers of sources scanning for RDP services - especially port 1098/TCP (!) - in our honeypot sensors last 2 weeks (up to 740 000 (!) distinct source IPs daily, incl up to 405 000 from Brazil).

Links

• RDP scanning from Brazil over time
• Map of source IPs scanning for RDP services on 2024-12-03
• Map of device types scanning for RDP over time
• RDP scanning over time

References

• https://infosec.exchange/@shadowserver/113645234449739068
• https://bsky.app/profile/shadowserver.bsky.social/post/3ld6npzfs7c2l

2024-11-21 18:49 UTC

Large scale compromises of PAN-OS devices (CVE-2024-0012 and CVE-2024-9474 exploitation campaigns)

We are scanning for and reporting compromised PAN-OS devices (based on existence of artefacts related to successful exploitation of (CVE-2024-0012 and CVE-2024-9474).

Links

• PAN-OS devices compromised (identified on 2024-11-20)

References

• https://x.com/Shadowserver/status/1859532378508570931