A major spike in activity targeting TCP Port 1025 on Windows systems may be a sign that attackers are gathering intelligence for an upcoming attack against unpatched servers, Symantec warned Monday.