Surge in Automated Scanning During Holidays Fuelling Initial Access for 2026 Attacks

Du'aine Davis

Observed in the wild

• GreyNoise observed a significant spike in opportunistic scanning activity during the 2025 Christmas period, targeting exposed services such as RDP, SMB, and VPN endpoints. These scans were global, affecting organisations across sectors, and are believed to be reconnaissance efforts laying groundwork for large-scale exploitation campaigns in early 2026.
• The campaign involved mass scanning for vulnerable protocols and misconfigured services, likely by botnets and low-sophistication actors seeking entry points for ransomware or data exfiltration. Indicators suggest automated tools probing for weak credentials, outdated software, and unpatched systems, aligning with tactics commonly used by financially motivated threat groups.
• Organisations are advised to harden external attack surfaces by enforcing strict patching, disabling unused services, and applying network segmentation. For Microsoft Defender users, enable Attack Surface Reduction (ASR) rules, monitor for anomalous outbound traffic, and leverage Defender’s behavioural detections for brute-force attempts and credential abuse.

The Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 Attacks