Surge in MOVEit Transfer Scanning Activity Could Signal Emerging Threat Activity
GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal — typically fewer than 10 IPs observed per day. 682 unique IPs have triggered GreyNoise’s MOVEit Transfer Scanner tag over the past 90 days. The surge began on May 27 — prior activity was near-zero. 303 IPs (44%) originate from Tencent Cloud (ASN 132203) — by far the most active infrastructure. Other source providers include Cloudflare (113 IPs), Amazon (94), and Google (34). Top destination countries include the United Kingdom, United States, Germany, France, and Mexico. * The overwhelming majority of scanner IPs geolocate to the United States.