Malicious Tag Roundup (Aug 16-Sep 1, 2021) | Cybersecurity Blog | Grey Noise

Summary: GreyNoise's malicious tag roundup for August 16 to September 1, 2021 lists activity tagged as malicious against Atlassian Confluence Server (OGNL injection), Oracle WebLogic (RCE, CVE-2021-2109), Seagate BlackArmor (RCE), the ASUS GT-AC2900 (auth bypass), and Apache SkyWalking (GraphQL SQL injection), alongside unknown-intention tags such as an ADB check, HTTP cookie storage, and redirect following. The post was updated on September 2 to reflect edits to the Atlassian Confluence Server OGNL Injection tags, and the team notes it continues to clean up and improve existing tags as new information or better processes are introduced.
Why it matters: Five distinct products - Confluence, WebLogic, Seagate BlackArmor, the ASUS GT-AC2900, and SkyWalking - drew malicious-intention tags in a single two-week window, and CVE-2021-2109 is named outright, so each one is a concrete item to check against your own exposure.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2021-2109