Noise Letter January 2026
Summary: GreyNoise's January 2026 NoiseLetter reports the company introduced Recall, a time-series intelligence capability for GNQL, tracked threat actors targeting LLMs, and observed a Christmas ransomware campaign. It also states that on February 10th GreyNoise will update all suspicious tag metadata to "recommend_block": true, based on data showing suspicious IPs consistently flip to malicious within a day or more.
What you should know: GreyNoise's own data shows suspicious IPs turn malicious within a day or more, so any automation built around the old tag metadata field will change behavior on February 10th - and organizations that don't block suspicious IPs forfeit that extra day of protection.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026