Adobe ColdFusion Servers Targeted in Coordinated Campaign

According to GreyNoise, thousands of requests targeted roughly a dozen vulnerabilities in Adobe ColdFusion during the Christmas 2025 holiday in a single, coordinated intrusion effort. The campaign saw about 6,000 requests aimed at ColdFusion vulnerabilities disclosed in 2023 and 2024, with the peak on December 25 and most traffic coming from a Japan-based infrastructure linked to CTG Server Limited.

The attack used ProjectDiscovery Interactsh for out-of-band callback verification, with JNDI/LDAP injection identified as the primary vector. The requests were focused largely on US servers (4,044), followed by Spain (753), India (128) and Canada, Chile, Germany and Pakistan (100 each).

Used in a massive exploitation operation, the two primary IP addresses operated concurrently about 41% of the time, generating over 2.5 million requests targeting more than 700 security defects across multiple stacks, with hosting infrastructure in Hong Kong under AS152194 and over 200,000 IPv4 addresses. A threat actor has been targeting these vulnerabilities as part of an initial access campaign, GreyNoise notes.