Compromised Asset Detection | Grey Noise Intelligence
Summary: GreyNoise describes a compromised asset detection approach that uses two independent signals: an organization's IP appearing as a scanner in GreyNoise's data, which suggests it has been pulled into a botnet, and outbound traffic matching a confirmed callback IP, which indicates a device is calling home to an attacker. The company says both are high-confidence indicators of compromise even where EDR does not exist, and it matches outbound traffic against confirmed malicious and callback infrastructure derived from real exploit activity.
Bottom line: Threat actors target firewalls, VPNs, and routers specifically to build botnets and hold command-and-control, and a compromised device that quietly calls back to attacker infrastructure can go unnoticed by endpoint tooling that isn't on those edge systems at all.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026