Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity

GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal—typically fewer than 10 IPs observed per day. But on May 27, that number spiked to over 100 unique IPs, followed by 319 IPs on May 28.

Since that initial jump, daily scanner IP volume has remained intermittently elevated between 200 to 300 IPs per day—a significant deviation from baseline and an indicator that MOVEit Transfer is once again in the crosshairs.

For the full article, visit: https://www.greynoise.io/blog/surge-moveit-transfer-scanning-activity.