Early Warning Signals: When Attacker Activity Precedes New Vulnerabilities

Summary: GreyNoise analyzed 216 spikes in malicious activity targeting edge technologies across its Global Observation Grid since September 2024, including scanning, brute forcing, and exploit attempts. It found that in the vast majority of cases, these spikes were followed within six weeks by disclosure of a new CVE affecting the same technology.
Why it matters: GreyNoise frames these spikes as possible reconnaissance or exploit-based inventorying, meaning the attackers probing a technology today may be the ones who target it when the CVE drops - and blocking that infrastructure beforehand may reduce the chance of being inventoried at all.

Read the original at GreyNoise Blog ↗