Malicious Tag Roundup (Jul 19-Aug 2, 2021) | Cybersecurity Blog | Grey Noise

Summary: GreyNoise's July 19 to August 2, 2021 tag roundup added malicious-intent tags for exploitation attempts against Zeroshell, Cisco Smart Install, ForgeRock OpenAM (CVE-2021-35464), UDP Technology IP cameras, JBoss Application Server (CVE-2017-12149), Ivanti Avalanche (CVE-2021-30497), Apache OFBiz deserialization, and the Linksys E-Series TheMoon worm. The roundup also deprecated multiple RDP tags in favor of RDP Crawler, noting the RDP Bruteforcer tag had aggressively assigned malicious intent to basic RDP connection attempts and that this was incorrect.
Bottom line: The RDP Bruteforcer correction means alerts your team may have triaged as malicious were, by GreyNoise's own reassessment, basic connection attempts - a reminder that intent labels on scanning traffic can be wrong in either direction.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2009-0545 CVE-2017-12149 CVE-2019-12725 CVE-2020-29390 CVE-2021-30497 CVE-2021-33544 CVE-2021-33548 CVE-2021-33550 CVE-2021-33554 CVE-2021-35464
Related: CVE-2017-12149: Red Hat JBoss Application Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021
CVE-2021-35464: Forge Rock Access Management (AM) Core Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Pre-auth RCE in Forge Rock OpenAM (CVE-2021-35464) Cyber Risks ·