Data Science-Fueled Tagging From Grey Noise Last Week | Grey Noise Blog

Summary: GreyNoise's internal tool "Hunter" clusters millions of daily HTTP/HTTPS events and surfaces a small set of new clusters for researchers to triage, contributing to seven tags published in one week. The tags cover scanning for the SonicWall SonicOS TFA API endpoint (503 unique IPs), CVE-2023-34124, CVE-2023-34133 (one IP, 94[.]228[.]169[.]4), Ivanti MICS, CVE-2023-38035, CVE-2023-32315 (seven IPs), and CVE-2018-9995 (66 IPs over 30 days).
What you should know: GreyNoise notes that without Hunter, some of this activity would likely have been tagged only after organizations or agencies announced exploit campaigns that did real harm to victims - the gap between scanning and public disclosure is where unpatched systems sit exposed.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2023-32315 CVE-2023-34124 CVE-2023-34133 CVE-2023-38035
Related: CVE-2023-32315: Ignite Realtime Openfire Path Traversal Vulnerability Known Exploited Vulnerabilities · Aug 24, 2023
CVE-2023-38035: Ivanti Sentry Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Aug 22, 2023
Threat Brief: Multiple Vulnerabilities Including Zero-Day Remote Unauthenticated API Access – CVE-2023-35078 – in Ivanti Endpoint Manager Mobile (Updated) Cyber Risks ·