Hackers Target Cisco ASA Devices in Massive Scan Across 25,000 IPs

Security researchers have spotted massive scanning campaigns aimed at Cisco Adaptive Security Appliance (ASA) devices, probing over 25,000 unique IP addresses in coordinated waves that may precede a vulnerability disclosure, according to GreyNoise. The first wave involved more than 25,000 IPs in a single burst, with a second, smaller campaign following days later, both targeting the ASA web login path at /+CSCOE+/logon.html.

Analysis shows a coordinated botnet operation led by a Brazil-based cluster, with roughly 14,000 of 17,000 active IP addresses on that day tied to the campaign, and attackers using shared client fingerprints and Chrome-like user-agents. Subsets of the same IPs also probed Cisco Telnet/SSH services, indicating a focused campaign rather than opportunistic scanning.

Geographic patterns reveal Brazil as a dominant source of malicious traffic (64%), followed by Argentina and the United States (8% each), while the United States bore 97% of the target attacks, with the United Kingdom and Germany at 5% and 3% respectively.