Malicious Tag Roundup (May 24-Jun 4, 2021) | Cybersecurity Blog | Grey Noise

Summary: GreyNoise's May 24 to June 4, 2021 tag roundup added tags for VMware vSphere Client RCE attempts and vulnerability checks tied to CVE-2021-21985, and for VMware ESXi OpenSLP RCE attempts exploiting CVE-2021-21974. The post also updated an Elasticsearch RCE tag for CVE-2015-1427, added a benign Cyber Casa actor tag, and removed tags for the Swedish Defense Research Agency (FOI) and an Elasticsearch Worm.
What you should know: Two of the newly tagged exploits target VMware virtualization infrastructure - vSphere Client and ESXi - so the systems most organizations treat as the floor beneath everything else were being actively probed and attacked in a two-week window.

Read the original at GreyNoise Blog ↗

Topics: Detection & Response
Mentions: CVE-2015-1427 CVE-2021-21974 CVE-2021-21985 CVE-2021-28799 CVE-2026-123158
Related: Mining The Undiscovered Country With Grey Noise EAP Sensors: F5 BIG-IP Edition Cyber Risks ·
Malicious Tag Roundup (Jun 21-Jul 16, 2021) | Cybersecurity Blog | Grey Noise Cyber Risks ·
Malicious Tag Roundup (Sep 2-13, 2021) | Cybersecurity Blog | Grey Noise Cyber Risks ·