Grey Noise Round Up: Product Updates - May 2023

Summary: GreyNoise's May 2023 product update added 24 new tags (20 malicious activity, 3 benign actor, 1 unknown), expanded sensor coverage to Ghana, and improved Bulk Analysis so users can export unidentified IPs via CSV and JSON. The company also added Qualys scanner IPs to its RIOT dataset, updated its Splunk app with a feed component and IP Similarity and IP Timeline dashboards, and noted that CISA added CVE-2021-45046, CVE-2023-21839, and CVE-2023-1389 to the KEV list on May 1, 2023.
Bottom line: GreyNoise users had visibility into IPs attempting mass exploitation of all three CVEs before CISA added them to the KEV list, which is the gap between seeing exploitation and having a mandate to act on it.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2021-45046 CVE-2023-1389 CVE-2023-21839 CVE-2023-34362
Related: KEV'd: CVE-2021-45046, CVE-2023-21839, and CVE-2023-1389 | Grey Noise Blog Cyber Risks ·
CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability Known Exploited Vulnerabilities · Jun 02, 2023
CVE-2023-21839: Oracle Web Logic Server Unspecified Vulnerability Known Exploited Vulnerabilities · May 01, 2023