Malicious Tag Roundup (Jun 7-18, 2021) | Cybersecurity Blog | Grey Noise
Summary: GreyNoise's June 7-18, 2021 roundup tagged malicious activity against SCO OpenServer (CVE-2020-25494), Rocket.Chat (CVE-2021-22911), and the Vesta Control Panel, plus a FiberHome Telnet backdoor spanning multiple CVE-2021-271xx identifiers. The same period logged LokiBot C2 and Aerospike crawlers and a Tomcat Manager scanner as unknown-intent, and the team noted it continues cleaning up existing tags as new information arrives.
What's compelling: The FiberHome Telnet backdoor alone spans more than a dozen CVE identifiers, so an exposure list built on single-CVE tracking will miss most of the attack surface an adversary is already scanning.