Three exploitation campaigns targeting Cisco, Palo Alto Networks and Fortinet devices originate from IPs on the same subnets.