Malicious Tag Roundup (May 10-21, 2021) | Cybersecurity Blog | Grey Noise

Summary: GreyNoise's May 10-21, 2021 roundup lists malicious-intent tags for exploitation attempts against NetMotion Mobility Server (CVE-2021-26912 through CVE-2021-26915), Jellyfin file disclosure (CVE-2021-21402), a QNAP walter SSH backdoor attempt (CVE-2021-28799), and unauthenticated RCE against VoIPmonitor (CVE-2021-30461). The post also notes the research team's ongoing cleanup of existing tags, including an RDP Bruteforcer tag, and lists Rapid7 InsightConnect and Cortex XSOAR as supporting Enterprise and Community API access.
Why it matters: Four of the tagged attempts target internet-facing services - a mobility server, a media server, a QNAP device, and a VoIP monitor - so the exposure sits in the same edge infrastructure most organizations assume is covered.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2021-21402 CVE-2021-26912 CVE-2021-26913 CVE-2021-26914 CVE-2021-26915 CVE-2021-28799 CVE-2021-30461
Related: CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022
New eCh0raix Ransomware Variant Targets QNAP and Synology Network-Attached Storage Devices Cyber Risks ·
Malicious Tag Roundup (May 24-Jun 4, 2021) | Cybersecurity Blog | Grey Noise Cyber Risks ·