One Operation, Countless Disguises: The Unified CVE-2026-4020 Campaign

What appeared to be hundreds of independent attackers exploiting CVE-2026-4020 was actually a single, highly coordinated operation using advanced evasion techniques. The attackers deployed a sophisticated Google Cloud-based infrastructure with consistent HTTP fingerprints disguised behind thousands of rotating IP addresses and user-agents to evade traditional detection. This revelation underscores how modern threat actors bypass standard defensive filters and the critical importance of behavioral analysis and HTTP-level fingerprinting in threat detection.