Holiday reconnaissance campaign exposes vulnerable systems for ransomware

At a glance

What this is: NHI Mgmt Group's analysis, drawing on GreyNoise's research: A holiday reconnaissance campaign systematically probed internet-facing systems, confirmed vulnerabilities through OAST callbacks, and built an inventory likely to support later intrusion and ransomware activity.

Why it matters: For IAM and NHI practitioners, the key lesson is that exposure is often established long before compromise, so visibility, detection and asset hygiene must catch exploitation attempts before access is brokered onward.

By the numbers:

• The attacker used 11 different exploit types against each target.

Context

Ransomware usually begins with reconnaissance, not encryption, because attackers need a working map of exposed services before they can monetise access. That makes internet-facing vulnerability discovery, asset inventory and callback detection part of the same governance problem, especially when defenders are least staffed.

Holiday periods create a control gap that adversaries can exploit at scale. A scanning campaign that might be contained quickly on a normal weekday can run long enough to confirm exposures, store proof of exploitation and seed a later access-broker market.

Key questions

Q: What breaks when internet-facing systems are not patched against known exploit chains?

A: When internet-facing systems remain unpatched, the control gap is not just initial compromise. Attackers can pivot through the same weakness to spread across internal networks, turning one exposed system into broader environment compromise. The failure usually sits in patch timeliness, asset visibility, and validation, because a patch that is not deployed everywhere does not reduce real-world risk.

Q: Why do holiday scanning campaigns create more ransomware risk?

A: Holiday campaigns extend the window between first probe and defender response. With fewer staff watching logs and alerts, attackers can validate more targets, store working exploit data and hand that data into criminal marketplaces. The risk increases because the organisation loses time, and time is what turns a noisy scan into actionable access intelligence.

Q: How can security teams tell if an external scan has become a real exposure event?

A: Look for repeat exploitation attempts, outbound OAST callbacks, DNS lookups to unusual callback domains and repeated hits against the same target. Those signals indicate the scanner is no longer guessing. It has likely confirmed a weakness and may already have enough evidence to support later targeting or resale.

Q: Should organisations treat confirmed exploitability differently from ordinary vulnerability findings?

A: Yes. Confirmed exploitability should trigger faster containment, tighter monitoring and higher-priority remediation than routine backlog items. A finding that has been proven by callback or repeated exploit traffic is already operationally different, because an attacker has demonstrated a working path and may return with follow-on tooling or brokered access.

Technical breakdown

How OAST-based exploitation confirmation works

Out-of-band application security testing, or OAST, proves exploitation by forcing a vulnerable target to make an outbound callback to an attacker-controlled domain. That gives the operator confirmation that a specific exploit worked, rather than just a noisy scan result. In this campaign, the large volume of unique callback subdomains suggests automated validation at scale, which is materially different from opportunistic probing. For defenders, OAST activity is useful because it often leaves DNS and egress traces even when the vulnerable service itself does not log a clean exploit event. See the Zero-Day and Exploited Vulnerabilities Guide.

Practical implication: Treat OAST callbacks as evidence of confirmed exposure and pivot immediately into log review, egress tracing and asset scoping.

Why access brokers value fresh vulnerability inventories

Initial access brokers do not need to complete the full intrusion lifecycle. Their business model is to identify exploitable paths, validate them, and package that access for later sale. A fresh, time-stamped inventory of working exploits has value because it reduces the cost and uncertainty of later intrusion attempts. That turns reconnaissance into a commodity layer in the ransomware economy. The governance issue is not just whether a vulnerability exists, but whether the organisation can detect when external actors have already validated it against live systems. See the NHI Lifecycle Management Guide.

Practical implication: Track validated exploit evidence as a precursor to brokered access, not as a benign scan artifact.

Why holiday scanning creates an identity and access blind spot

This campaign matters to identity teams because confirmed exposure often leads to credentialed follow-on access once an attacker finds a reachable service, management plane or admin interface. When operational coverage drops, the window between first probe and usable access expands. That shifts the burden from response after compromise to governance before confirmation. The same logic applies to service accounts, API keys and remote administration paths: once a working foothold exists, identity controls become the next boundary the attacker tests.

Practical implication: Map exposed services to the identities and credentials they can reach, then prioritise those paths for tighter authentication and monitoring.

Threat narrative

Attacker objective: The objective is to build and monetise a validated list of exploitable targets that can be sold to ransomware operators or reused for later intrusion.

1. Entry began with systematic internet-wide reconnaissance from two IP addresses that tested more than 240 exploit possibilities against exposed services.
2. Credential or access validation followed when OAST callbacks confirmed which targets were genuinely vulnerable and therefore usable later.
3. Impact is deferred rather than immediate, because the confirmed vulnerability inventory can be sold or reused for targeted ransomware intrusion throughout 2026.

Breaches seen in the wild

• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Reconnaissance is now a governance event, not a prelude. This campaign shows that the meaningful security failure happens when external validation of exposure succeeds, not when payload delivery begins. Once a target answers an OAST callback, the attacker has already converted a guess into confirmed access potential. Practitioners should treat validated exploitation as an identity and exposure governance problem, not just a perimeter issue.

The real product here is validated access intelligence. Ransomware markets do not need every probe to succeed, only enough confirmed leads to sell. That means defenders should measure how quickly they can detect and contain proof-of-exploitation signals, not just whether a vulnerability scanner was noisy. The governance gap is the lag between first confirmation and operational containment.

Holiday coverage creates a standing weakness in external exposure management. The article highlights a familiar but still under-governed pattern: adversaries time campaigns to periods when teams are lighter and change control is slower. That matters for NHI governance because exposed management endpoints, service credentials and remote access paths become easier to validate when monitoring falls behind. Teams should assume holiday windows are adversary collection windows.

Fresh exploit intelligence has a longer shelf life than the scan itself. The campaign's value is not the internet traffic, but the catalog of systems that now appear exploitable and can be revisited later. That should push organisations toward faster external exposure triage, tighter callback detection and stronger control over privileged remote entry points. The practitioner conclusion is simple: if the outside world can confirm the flaw, your attack surface is already being priced.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Exposure intelligence now has a market lifecycle: once attackers confirm a vulnerable path, the resulting data can be resold, replayed or chained into later intrusion. That means exposure management has to account for how fast an organisation can invalidate a known path, not just how many findings it has on a dashboard.

Holiday windows expose a control design problem as much as an operational one. If a scan can run for days without interruption, then the issue is not only staffing, but also whether the organisation has automation and detection rules that escalate repeated exploit confirmation quickly enough.

A validated exploit inventory should be treated as a precursor to identity compromise, because the next step after a reachable service is often an authentication boundary, an admin console or a credentialed management path. The programme implication is to align external exposure review with privileged access review, not keep them in separate queues.

For practitioners

• Harden holiday monitoring coverage Staff detection, alert triage and log review during holiday windows so scan campaigns do not sit unobserved for days.
• Review DNS for OAST callback patterns Search resolver logs for queries to OAST domains and treat successful callbacks as evidence of confirmed exploitability.
• Triage exposed services by exploit confirmation Prioritise systems that showed callback behaviour or repeated exploit hits, then verify whether the vulnerable service is still reachable. See the Vulnerability Management Guide.
• Map exposed assets to reachable identities Identify which remote admin paths, service accounts and API credentials sit behind internet-facing services so identity controls can be tightened first.
• Raise containment triggers for validated exposure Define a confirmed-exploit threshold that moves an issue from routine remediation into active incident handling and privilege review.

Key takeaways

• The campaign shows how reconnaissance becomes monetisable evidence long before encryption or data theft starts.
• GreyNoise observed a four-day operation that tested 240+ exploit types and generated over 57,000 unique OAST subdomains.
• Teams that can detect confirmed exploitation, not just vulnerability presence, are better positioned to interrupt brokered access before it is reused.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Cloud Incident Response Guide · Zero-Day and Exploited Vulnerabilities Guide · United Nations breach 2021

Key terms

• Initial access broker: An initial access broker is an attacker or criminal intermediary that acquires footholds, such as stolen credentials, and then passes them to other threat actors. This role turns access into a commodity and increases the likelihood that simple credential exposure will become a broader breach.
• Out-of-Band Application Security Testing: Out-of-band application security testing validates whether an application can make external callbacks or reach attacker-controlled infrastructure during a test. Security teams use it to confirm exploitability in live or near-live systems when a vulnerability can be triggered through network interaction rather than obvious local behaviour.
• Exploit Validation: The process of proving that a suspected vulnerability is actually exploitable by producing a working proof of concept. This is a high-value security task because it separates real exposure from noise and can be automated with sufficient model and workflow support.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the broader security workflows that determine exposure and access.