Threat analysis organization GreyNoise has cautioned about “orchestrated brute-force endeavors” aimed at Apache Tomcat Manager interfaces.
The firm noted a spike in brute-force and login attempts on June 5, 2025, suggesting that these could be intentional actions to “locate and gain entry to exposed Tomcat services in large numbers.”
In this regard, 295 distinct IP addresses have been identified as participating.