295 Malicious IPs Launch Coordinated Brute-Force Attacks on Apache Tomcat Manager
A "coordinated brute-force activity" targeting Apache Tomcat Manager interfaces has been alerted to by threat intelligence firm GreyNoise.
According to the business, on June 5, 2025, it noticed a spike in brute-force and login attempts, which may be intentional attempts to find and get mass access to vulnerable Tomcat services.
In light of this, it was discovered that 295 distinct IP addresses were using brute-force attacks against Tomcat Manager on that particular date; all of these efforts were deemed malicious. 188 distinct IP addresses have been identified in the last 24 hours, with the bulk of them based in the US, UK, Germany, the Netherlands, and Singapore.
Similarly, 298 distinct IP addresses were seen attempting to log in to Tomcat Manager instances. All 246 of the IP ad...