The Shadowserver Foundation (@Shadowserver) / X

The Shadowserver Foundation

2,353 posts

The Shadowserver Foundation

@Shadowserver

Our mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats. Join our Alliance!

Global

shadowserver.org/partner

Joined March 2009

Following

21.7K

Followers

Pinned
The Shadowserver Foundation
@Shadowserver
Dec 13, 2025
Using ELK & interested in automating ingestion of our threat intel for your network/constituency via our API? We have introduced an ECS logging script for our intelligence reports. This script uses Redis to queue events for Logstash. Check it out at github.com/The-Shadowserv…
12K
The Shadowserver Foundation
@Shadowserver
Dec 26, 2022
We are reporting out Microsoft Exchange servers still likely vulnerable to CVE-2022-41082 #ProxyNotShell. Nearly 70K IPs found without MS patches applied (based on version info). Previously recommended mitigation techniques can be bypassed by attackers shadowserver.org/what-we-do/net…
120K
The Shadowserver Foundation
@Shadowserver
May 14, 2023
We see over 7100 Cisco routers vulnerable to compromise through CVE-2017-6742. While old, this vulnerability is actively exploited by APT28 to deploy malware as detailed in the UK NCSC’s Jaguar Tooth malware analysis report: ncsc.gov.uk/static-assets/… Most in France, Nigeria & USA.
51K
The Shadowserver Foundation
@Shadowserver
Jun 13, 2023
At least 20.3K Fortinet devices likely vulnerable to CVE-2023-27997 (heap buffer overflow in sslvpn pre-authentication) seen in our scans (on 2023-06-12) Fortinet advisory: fortiguard.com/psirt/FG-IR-23… Dashboard: dashboard.shadowserver.org/statistics/com… Make sure to update your FortiOS/FortiProxy!
55K
The Shadowserver Foundation
@Shadowserver
Oct 18, 2023
Cisco CVE-2023-20198 exploitation activity: We see over 32.8K Cisco IOS XE IPs compromised with implants based on the check published by Cisco in blog.talosintelligence.com/active-exploit… IP data on implants shared out daily in: shadowserver.org/what-we-do/net… tagged 'device-implant'.
92K
The Shadowserver Foundation
@Shadowserver
Mar 5, 2025
We are scanning & reporting out VMware ESXi CVE-2025-22224 vulnerable instances ("a malicious actor with local admin privileges on a virtual machine may exploit this to execute code as virtual machine's VMX process running on host"). Nearly 41.5K found vulnerable on 2025-03-04.
19K
The Shadowserver Foundation
@Shadowserver
Nov 16, 2023
We are reporting Microsoft Exchange Server CVE-2023-36439 vulnerable IPs (post-auth RCE). Over 63K vulnerable worldwide. Patch released Nov 14th - msrc.microsoft.com/update-guide/v… IP data for your constituency in shadowserver.org/what-we-do/net… Dashboard tracker - dashboard.shadowserver.org/statistics/com…
96K
The Shadowserver Foundation
@Shadowserver
Nov 26, 2023
We are sharing out Microsoft Exchange Servers that have reached end-of-life (ie, end of extended support, with no security updates issued). Still nearly 20K IPs found (!). Top countries: US & Germany. Country breakdown: dashboard.shadowserver.org/statistics/com…
41K
The Shadowserver Foundation
@Shadowserver
Jun 12, 2024
Critical Microsoft Message Queuing (MSMQ) Remote Code Execution (RCE) vulnerability CVE-2024-30080 ~256,000 publicly exposed devices: dashboard.shadowserver.org/statistics/com… dashboard.shadowserver.org/statistics/com… Check our free Accessible MSMQ Service Report & patch immediately: shadowserver.org/what-we-do/net…
59K
The Shadowserver Foundation
@Shadowserver
Jul 20, 2025
Alert: SharePoint CVE-2025-53770 incidents! In collaboration with @eyesecurity & @watchtowrcyber we are notifying compromised parties. Read: research.eye.security/sharepoint-und… ~9300 Sharepoint IPs seen exposed daily (just population, no vulnerability assessment): dashboard.shadowserver.org/statistics/iot…
30K
The Shadowserver Foundation
@Shadowserver
Feb 7, 2025
Large increase in web login brute forcing attacks against edge devices seen last few weeks in our honeypots, with up to 2.8M IPs per day seen with attempts (especially Palo Alto Networks, Ivanti, SonicWall etc). Over 1M from Brazil. Source IPs shared in shadowserver.org/what-we-do/net…
17K
The Shadowserver Foundation
@Shadowserver
Oct 4, 2022
We are thrilled to announce the official launch of our new Shadowserver Alliance enabling us to sustain & scale up delivery of no cost cybersecurity & threat intelligence services to Internet defenders & LE worldwide! Join here: shadowserver.org/sponsor shadowserver.org/news/shadowser…
The Shadowserver Foundation
@Shadowserver
Mar 16, 2020
@Shadowserver urgently needs your financial support to move data center before May 26th, to be able to continue providing public benefit services. Please help #saveshadowserver and help secure the Internet! shadowserver.org/news/saving-sh… #shadowserver #infosec #CyberSecurity #appeal
The Shadowserver Foundation
@Shadowserver
Oct 29, 2023
As a PoC exploit was recently published for Microsoft Exchange CVE-2023-36745, we are now reporting servers seen with that vulnerability (version check only). At least 23.5K instances (by unique IP) vulnerable. Data shared in Vulnerable Exchange report: shadowserver.org/what-we-do/net…
35K