2.5 Million+ Malicious Request From Hackers Attacking Adobe ColdFusion Servers
A coordinated exploitation campaign resulted in over 2.5 million malicious requests targeting Adobe ColdFusion servers and more than 47 other technology platforms during the Christmas 2025 holiday period.
A coordinated exploitation campaign resulted in over 2.5 million malicious requests targeting Adobe ColdFusion servers and more than 47 other technology platforms during the Christmas 2025 holiday period.
The operation was traced to a threat actor using Japan-based infrastructure. This campaign involved extensive scanning for both legacy and new vulnerabilities spanning 20 years. The ColdFusion phase specifically targeted over 10 critical CVEs from 2023–2024, with peak activity noted on Christmas Day, comprising 68% of the attack traffic.
Approximately 5,940 requests targeted ColdFusion servers in 20 countries, with 68% originating from the United States. Two primary IP addresses (134.122.136.119 and 134.122.136.96), hosted by CTG Server Limited, generated the majority of attack traffic.
The attacker utilized ProjectDiscovery Interactsh, an out-of-band testing platform, deploying nearly 10,000 unique OAST domains across various services for callback verification. The main attack vector was WDDX deserialization, facilitating JNDI/LDAP injection targeting the com.sun.rowset.JdbcRowSetImpl gadget chain.
The operation was traced to a threat actor using Japan-based infrastructure.
The operation encompassed reconnaissance of 767 distinct CVEs affecting Java application servers, web frameworks, CMS platforms, and enterprise applications. The most frequently targeted vulnerabilities included CVE-2022-26134 (Confluence OGNL injection) and CVE-2014-6271 (Shellshock).
Network analysis identified 4,118 unique JA4H HTTP signatures, suggesting the use of template-based scanning with Nuclei or similar frameworks. The attack infrastructure, hosted by CTG Server Limited, has been linked to phishing activities and inadequate network hygiene.
According to GreyNoise Labs , it is advised to block the identified IP addresses and ASNs, implement signatures for the JA4+ fingerprints, and prioritize patching ColdFusion and Java-based infrastructure.
The campaign's sophistication indicates capabilities typical of initial access brokers preparing for subsequent attacks.
Based on reporting by Cyber Security News.