Noise Letter July 2026

Summary: GreyNoise published "After the Shell," its first report from GreyNoise Tactics, built from more than 110,000 host sessions read command by command. The report found serious activity in fewer than 1 in 1,000 sessions, concentrated on quiet, credential-rich services, and describes one React2Shell session that moved from a landed shell to cloud credentials, a backdoor superuser, and a container escape in about 82 minutes with no human at the keyboard.
What's compelling: Fewer than 1 in 1,000 sessions carried serious activity, so the volume of alerts tells you little about which one is an attacker already inside - and in the documented case, the run from shell to cloud credentials and container escape took roughly 82 minutes with no human at the keyboard.

Read the original at GreyNoise Blog ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026