Noise Letter December 2025
Summary: GreyNoise reports the React2Shell campaign remains highly active, with more than 8.1 million attack sessions observed since disclosure and daily activity holding steady at 300,000 to 400,000. It tracks 8,163 source IPs across 1,071 ASNs in 101 countries, with cloud providers, especially AWS, dominating exploitation traffic, and 70,000-plus unique payloads plus hundreds of distinct JA4H/JA4T fingerprints showing ongoing attacker iteration.
What's compelling: With 8,163 source IPs spread across 101 countries and 70,000-plus unique payloads, static IP blocklists cannot keep pace with this campaign, and the volume is not tapering off.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026