A regional bank’s network team opened Monday with a Dutch NCSC advisory stating that critical Check Point VPN flaws faced imminent exploitation. By noon, two public abuse feeds listed fresh addresses tied to mass scanning of remote access gateways. The SOC already had a patch ticket open. What they lacked was a hunt that treated those listed addresses as session selectors, not as another deny rule.
Threat hunting with IP blocklists starts when an advisory, a sector report, or a campaign write-up lands and your feeds begin showing related probe sources. The match is the invitation to ask which of your VPN concentrators, SSL portals, and jump hosts already saw those sources, and what identities or device certificates those sessions touched.
Why this hunt belongs next to the patch ticket
In Q2 2026, industrial automation threat summaries and vulnerability roundups kept showing the same pattern: edge services take scanning pressure days before patches reach every appliance. Microsoft’s wave of nearly 400 fixes, Spring Ring voice phishing in Teams, and 0ktapus-style session theft campaigns all remind operators that credential and session abuse often rides the same remote access paths that exploit kits probe.
Mirage Kitten’s focus on aviation and FinTech across the Middle East and Africa shows how sector and geography shape which feeds matter for your estate. A Latin America campaign write-up that exposed ongoing AI-assisted targeting likewise pushed defenders to treat infrastructure lists as living hunt inputs. When NCSC-class language says exploitation is imminent, the practical move is to bind those addresses to your VPN and identity telemetry while change windows still run.
Build a short, named address set from the advisory window
Pull addresses that appear on shared abuse feeds within 24–72 hours of the advisory, plus any IPs named in accompanying scanner or exploit kit notes. Keep a dated snapshot. Label each address with feed name, first-seen time, and the advisory ID or CVE string you associate with it.
Scope the set to remote access relevant ports and paths: IKE, SSL VPN portals, Clientless portals, and management listeners that share the same public IPs as user VPN. Drop pure web scraper noise unless those sources also hit your VPN URLs in the same window.
Concrete enrichment that keeps the set usable
- Resolve ASN and hosting type so cloud-hosted scanners stay distinct from residential NAT when you later score confidence.
- Note whether the address also appears on industrial scanner feeds if you operate OT-adjacent remote access; Q2 industrial automation reporting makes that cross-check worth the minutes.
- Record reverse DNS and certificate SANs only when they reinforce a VPN or exploit tool fingerprint.
Store the set in a SIEM lookup or a small CSV your analysts can join without waiting for a full TIP sync. Hunters need the list in the same place as VPN auth logs.
Detection steps that turn a match into evidence
Replay VPN authentication and session logs for at least seven days before the advisory publish time, then continue forward through patch completion. Join on source IP against your dated address set. Flag every hit that produced a login success, a partial handshake, a certificate presentation, or a burst of failures from one source against many usernames.
Queries and correlations that pay off
- Successful VPN sessions whose client IP sits on the advisory-linked set, including MFA-passed sessions. Success after a probe wave is the highest priority.
- Username spray patterns from listed addresses: same source, many accounts, short intervals, often below per-account lockout thresholds.
- Device posture or endpoint certificate IDs that appear on both a listed-IP session and a later session from a clean address. That handoff marks possible session continuation after the probe host rotates.
- Admin or break-glass accounts touched by any listed source, even on failure. Those deserve identity owner outreach the same day.
- Outbound connections from internal jump hosts or VPN-connected workstations to other addresses that entered the same feeds in the same week. Treat that as a second-stage hunt branch.
On Check Point and similar platforms, pull gateway logs for portal resource access, SNX or client download attempts, and policy installs that coincide with probe timestamps. Pair those with IdP sign-in logs so a portal hit without an IdP event still surfaces as an incomplete or anomalous path.
A worked example
Feed A lists 203.0.113.44 on Tuesday for SSL VPN scanning. Your gateway shows 47 failures against service accounts from that IP between 02:10 and 02:40 UTC, then a success for an unused contractor account at 02:41 with MFA push approved on a phone that had no prior travel or travel notice. Identity logs show that same account opening SharePoint and a finance SaaS app within twelve minutes. The blocklist match selected the session; the identity trail decided the severity.
Response actions while patches still roll
Disable or reset credentials for any account with a successful session from an advisory-linked address. Revoke refresh tokens and VPN session cookies for that identity across the IdP and the gateway. Force re-enrollment of MFA where push fatigue or deepfake-assisted social pressure is plausible; user-facing deepfake incidents keep raising the cost of voice or video approval trust.
Quarantine endpoints that held those sessions. Review local persistence, browser SSO cookies, and any new VPN profiles. On OT or industrial remote access jump boxes, extend the same review to engineering workstations that dial into automation networks, matching the Q2 industrial threat focus on remote pathways into control environments.
Tighten gateway controls in parallel with hunting: restrict portal exposure to known corporate egress where business allows, raise logging verbosity on authentication until patches complete, and add temporary alerts for any new address that joins the same feed cluster. Keep the temporary alerts tied to the advisory ID so they expire when the hunt closes.
Close the loop with operators
- Give VPN and firewall owners a daily digest of listed-IP hits until every appliance reports the fixed build.
- File hunt findings next to the patch change record so auditors see detection work alongside remediation.
- Share confirmed malicious addresses, session times, and targeted usernames back to your ISACs; aviation, FinTech, and manufacturing peers benefit when Mirage Kitten-class actors and opportunistic exploit kits reuse infrastructure.
Operational takeaways you can run this week
Maintain a one-page playbook: advisory drops, snapshot related IPs within hours, join seven-plus days of VPN and IdP logs, escalate successes and admin touches first, revoke sessions before you argue about false positives. Keep the address set small and dated. Pair every network match with an identity outcome. Treat patch completion as the hunt end condition, with a final replay the day after the last gateway upgrades.
When the next NCSC-style warning lands, or when a sector report like the Q2 industrial automation landscape names the services you expose, your blocklists stop being a silent deny layer. They become the index that tells you which remote sessions deserve a full review before attackers finish converting probes into lasting access.
