Malicious Tag Roundup (Aug 2-16, 2021) | Cybersecurity Blog | Grey Noise

Summary: GreyNoise's August 2-16, 2021 tag roundup lists new and revised tags for observed activity, including malicious-intent tags for Exchange ProxyShell vulnerability attempts, Aerospike RCE attempts, Docker API container creation attempts, Buffalo router RCE attempts, Ruijie EG command injection attempts, X Server connection attempts, and an ADB worm. The same list marks several tags as unknown intent, including Exchange ProxyShell vulnerability checks, JavaScript enabled, Buffalo router RCE checks, and a FirebirdSQL crawler, and notes the research team continues to clean up and improve existing tags as new information or better processes are introduced.
What you should know: The list pairs active exploitation attempts against Exchange ProxyShell, Docker APIs, and edge routers with an ADB worm, while several related probes remain tagged unknown intent - a reminder that intent labels lag behind the traffic hitting your exposed services.

Read the original at GreyNoise Blog ↗