Thousands of ColdFusion exploit attempts spotted during Christmas holiday

GreyNoise observed a coordinated campaign targeting about a dozen Adobe ColdFusion vulnerabilities, with thousands of exploit attempts recorded during the Christmas 2025 holiday. According to GreyNoise, a single threat actor operating from Japan-based infrastructure (CTG Server Limited) was responsible for around 98% of the attack traffic, systematically exploiting more than 10 ColdFusion CVEs from 2023–2024.

The campaign used ProjectDiscovery Interactsh for out-of-band verification, with JNDI/LDAP injection identified as the main vector, and most activity occurring on Christmas Day. Researchers logged 5,940 malicious requests exploiting ColdFusion vulnerabilities from 2023–2024, with the majority targeting the US (4,044), Spain (753) and India (128). The two IPs associated with CTG Server Limited—134.122.136[.]119 and 134.122.136[.]96—were responsible for over 98% of the exploitation traffic.

Overall, GreyNoise noted the operation generated more than 2.5 million requests across 767 CVEs spanning 2001–2025, indicating a broad, template-based reconnaissance effort across many technology stacks.