Holiday scanning campaign: what practitioners need to act on

TL;DR: A four-day holiday reconnaissance operation scanned the internet from two IPs, tested 240+ exploits and logged over 57,000 unique OAST subdomains, according to GreyNoise, creating a fresh vulnerability inventory that can feed targeted ransomware access brokering into 2026. Ransomware defence starts at discovery time, not encryption time.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “The Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 Attacks”.

By the numbers:

• The attacker used 11 different exploit types against each target.

Key questions

Q: What breaks when internet-facing systems are not patched against known exploit chains?

A: When internet-facing systems remain unpatched, the control gap is not just initial compromise.

Q: Why do holiday scanning campaigns create more ransomware risk?

A: Holiday campaigns extend the window between first probe and defender response.

Q: How can security teams tell if an external scan has become a real exposure event?

A: Look for repeat exploitation attempts, outbound OAST callbacks, DNS lookups to unusual callback domains and repeated hits against the same target.

Practitioner guidance

• Harden holiday monitoring coverage Staff detection, alert triage and log review during holiday windows so scan campaigns do not sit unobserved for days.
• Review DNS for OAST callback patterns Search resolver logs for queries to OAST domains and treat successful callbacks as evidence of confirmed exploitability.
• Triage exposed services by exploit confirmation Prioritise systems that showed callback behaviour or repeated exploit hits, then verify whether the vulnerable service is still reachable.

Bottom line: The campaign shows how reconnaissance becomes monetisable evidence long before encryption or data theft starts.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →