Ghosts in the Holiday Machine: ColdFusion Servers Blitzed by Global Attackers

As most of the world unwrapped gifts and savored quiet moments on Christmas Day 2025, a silent digital siege was unfolding. Thousands of hackers’ requests, meticulously timed and globally distributed, battered vulnerable Adobe ColdFusion servers while IT teams were home with their families. The attackers, leveraging a web of infrastructure stretching from Japan to Hong Kong, orchestrated a blitz that reveals the ruthless efficiency-and opportunism-of today’s cybercrime economy.

Inside the Attack: Timing, Tactics, and Scale

The campaign, flagged by threat intelligence firm GreyNoise, was not a random flurry of hacker noise. It was a calculated, coordinated assault designed to exploit the annual holiday lull in cybersecurity vigilance. The attackers leveraged ProjectDiscovery’s Interactsh platform to verify out-of-band callbacks-a tactic that helps them confirm which servers are vulnerable without tipping off defenders. Their primary weapon: JNDI/LDAP injection, a method with a notorious history of enabling remote code execution.

Two IP addresses, both traced to Japanese infrastructure and likely managed by a Hong Kong-based provider, were responsible for the lion’s share of traffic. These addresses cycled through 11 distinct attack types per target, hammering servers every 1-5 seconds. The campaign’s reach was global, but the US bore the brunt with over 4,000 targeted requests, followed by significant activity in Spain, India, Canada, and beyond.

Digging deeper, GreyNoise discovered these IPs are no strangers to criminal enterprise. They’ve generated more than 2.5 million requests, probing over 700 vulnerabilities in dozens of security stacks. The hosting provider-controlling some 200,000 IPv4 addresses-has a documented history of facilitating phishing and spam, with weak enforcement against abuse.

The evidence points to a professional initial access broker: a cybercriminal group specializing in breaching systems and then selling that access to ransomware gangs or other threat actors. Their timing-striking when defenses are down-demonstrates a chilling understanding of both technology and human behavior.

The Bigger Picture: Vulnerabilities and Vigilance

While this campaign focused on ColdFusion, it’s just a sliver of a broader wave of attacks targeting legacy systems and unpatched flaws. The surge in activity during holidays is a stark reminder: cybercriminals don’t take breaks-and neither can defenders. Organizations must prioritize patching, monitor for out-of-band exploit attempts, and scrutinize their exposure across all platforms, especially during periods of reduced staffing.

As digital infrastructures grow ever more complex, the lesson is clear: Every holiday is an opportunity for those who prey on the gaps.

WIKICROOK

• Initial Access Broker: An Initial Access Broker is a cybercriminal who breaks into systems and sells access to other attackers, enabling further cybercrimes like ransomware or data theft.
• JNDI/LDAP Injection: JNDI/LDAP Injection exploits directory lookups in Java apps, allowing attackers to execute remote code or access sensitive data through crafted inputs.
• Out: Out-of-Band Verification confirms identity using a separate channel, like a phone call or text, to enhance security and prevent unauthorized access.
• ColdFusion: ColdFusion is an Adobe web application platform known for its ease of use and history of security vulnerabilities, requiring careful maintenance and updates.
• Exploit: An exploit is a technique or software that takes advantage of a vulnerability in a system to gain unauthorized access, control, or information.