Holiday ColdFusion Attacks Reveal Massive 2.5 Million Request Onslaught

What started as a seemingly targeted holiday raid on Adobe ColdFusion servers has developed into an industrial-scale cyberattack operation. According to GreyNoise, a new intelligence update shows the Christmas 2025 activity was only the tip of the iceberg, masking a broad, well-coordinated initial access broker campaign targeting nearly every major technology stack.

While defenders were busy, a single threat actor was responsible for generating over 2.5 million malicious requests in a matter of days, targeting over 10 different CVEs from 2023 and 2024. The two primary IPs, 134.122.136[.]119 and 134.122.136[.]96, generated more than 2.5 million requests across 767 distinct CVEs and 47+ technology stacks.

The operation appears to be highly centralised, with GreyNoise attributing the attack to a single threat actor operating from Japan-based infrastructure and naming CTG Server Limited as the launchpad, a source responsible for approximately 98% of observed attack traffic.