Malicious Tag Roundup (January 2022) | Cybersecurity Blog | Grey Noise
Summary: GreyNoise's January 2022 tag roundup catalogs internet-wide scanning and exploitation attempts it has labeled, including Apache Log4j RCE attempts against CVE-2021-44228 and CVE-2021-45046, Microsoft HTTP.sys RCE attempts against CVE-2021-31166, and VMware vCenter SSRF attempts against CVE-2021-22049. The list also covers a backdoor connection attempt using a known activation secret for a WinDivert-based backdoor, flagged from Avast research, alongside unknown-intent crawlers hunting for InfluxDB instances, iSCSI login responders, Jira instances, and iKettle devices.
What's compelling: The same scanning traffic is hitting edge and management software - vCenter, Jira, Log4j-dependent Java services - that sits inside most enterprise networks, and the WinDivert tag shows a backdoor with a fixed activation secret already in the wild.