src_0060ae82ad11b5dc16
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Jun 25, 2025 00:00 UTC
- Retrieved
- Oct 08, 2026 03:52 UTC
Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity
GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal — typically fewer than 10 IPs observed per day. But on May 27, that number spiked to over 100 unique IPs, followed by 319 IPs on May 29.
Reference details
- Source category
- Research & news
- Report title
Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity- First reported
- Jun 25, 2025 00:00 UTC
- Last reported
- Jun 25, 2025 00:00 UTC
- Catalog updated
- Oct 08, 2026 03:52 UTC
- Record ID
f8f53edae5641ccb4e29d2a23c199b75ce9a7a4312136039bc6483b71c07ff05
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Review source update dates and status
- src_0060ae82ad11b5dc16Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.