Global Carrier Hunts Emerging Exploitation Campaigns Across Global Infrastructure with Grey Noise
Summary: A global telecommunications carrier spanning 40+ countries and serving over 200 million wireless subscribers integrated GreyNoise data into its proprietary threat hunting workflows, filtering observations by port, protocol, CVE, and ASN to monitor scanning against SIP services on ports 5060/5061, edge router management interfaces, and session border controller protocols. In Q3 2025, its custom hunting process flagged a 400% spike in GreyNoise-observed scanning against a specific edge router management interface 48 hours before the vendor issued a security advisory, and IP timeline data confirmed coordinated exploitation from a cluster of IPs not previously seen in background scanning.
Why it matters: The carrier patched across all 40+ country networks before any exploitation attempt reached production, and packaging GreyNoise evidence into change advisory board briefs cut patch approval from weeks of internal debate to same-day authorization - a 48-hour head start is only worth what your approval process lets you do with it.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026