Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
On this Storm Watch episode, the hosts describe a Cisco IOS vulnerability that can be triggered to place an implant on a Cisco device, granting the attacker full access. They also cover a WordPad vulnerability that Microsoft says it has updated even as it...
The latest GreyNoise Labs Storm Watch episode covers the World Economic Forum's Cybersecurity Outlook for 2024 and the Allianz Global Risk Barometer Redux 2024, alongside a VMware vCenter vulnerability reported by Censys and GreyNoise's own research into...
This GreyNoise Storm Watch episode covers recent critical vulnerabilities in VMware's ESXi as reported by SecurityWeek, along with the history of VMware vulnerabilities including log4j. It also discusses Russia's breach of Microsoft's systems and the SEC's...
This episode of GreyNoise's Storm Watch podcast covers anonymous proxies and how they mask user identity and complicate detection, drawing on material from Okta, Orange Cyber Defense, Talos Intelligence, and DataDome. Other segments discuss vulnerability...
Rapid7 disclosed two critical TeamCity CI/CD vulnerabilities to JetBrains on February 20, 2024, including CVE-2024-27198, which allows a complete authentication bypass enabling administrative actions on the server and its host environment. JetBrains called...
This episode of GreyNoise's Storm Watch podcast features a discussion with Nate Warfield of Eclypsium on supply chain and firmware safety, including Eclypsium's analysis of CISA's KEV data. The episode also covers recent sanctions on APT31 hackers, China's...
GreyNoise's Storm Watch reports a newly discovered attack that steals SSH cryptographic keys during signature generation when a client and server establish a connection, affecting keys that use the RSA algorithm. The roundup also covers Sumo Logic...
Snowflake suffered unauthorized access to customer accounts through stolen credentials, hitting accounts without multi-factor authentication enabled at companies including Ticketmaster, Santander, Advance Auto Parts, and LendingTree subsidiary QuoteWizard....
GreyNoise's Storm Watch episode covers a US- and UK-backed agreement to make AI 'secure by design', the seizure of nearly $9M in cryptocurrency from a cyber scam organization, and a critical ownCloud vulnerability that reveals admin passwords and was...
This StormWatch episode covered recent breaches involving Okta, Beyond Trust, and 1Password, praising 1Password's transparent response, and discussed SolarWinds vulnerabilities along with SEC charges against SolarWinds and its Chief Information Security...
This episode of GreyNoise's Storm Watch covers the NSA's tracking of Chinese groups targeting Ivanti products in the defense sector, as reported by TechCrunch, and JFrog's investigation into malicious AI/ML models on Hugging Face that carry silent...
The Storm Watch roundtable noted the effective date of new SEC rules requiring companies to report material cybersecurity incidents to investors, with VF Corporation among the first to report after a December 13, 2023 cyberattack disrupted its ability to...
New Relic identified unauthorized access to its staging environment after an employee account was compromised through stolen credentials and social engineering, and the actor used those credentials to view certain customer data in that environment. The...
This episode of GreyNoise's Storm Watch podcast covers the challenges of analyzing scan data and the debate between the terms "threat hunting" and "thrunting," followed by a deep dive into the WS_FTP exposure situation. The hosts also discuss the libwebp...
This Storm Watch episode covers the takedowns of the Trigona ransomware group by the Ukrainian Cyber Alliance and of RagnarLocker, while noting that ransomware attacks often continue in new forms and that rising Bitcoin value tends to correlate with more...
This GreyNoise podcast episode covers a mass crypto-miner takedown reported by the Ukrainian Cyber Police and Bleeping Computer, the Ivanti debacle as detailed in a Volexity blog post, and two X account hacking events involving the SEC and Mandiant. It...
This GreyNoise Storm Watch episode examines the widely circulated story of three million malware-infected smart toothbrushes allegedly used to launch a Swiss DDoS attack, a narrative that spread across InfoSec Exchange and Tom's Hardware. The episode also...
This GreyNoise Storm Watch episode covers the resurgence of the LockBit ransomware group after significant arrests in Ukraine, along with trolling claims by LockBitSupp, a summary by Brian Krebs, and Fulton County's response. It also discusses a malicious...
Ivanti CEO Jeff Abbott publicly committed to a comprehensive security overhaul after a series of breaches linked to vulnerabilities in the company's products, including CVE-2024-21894, a heap overflow in Ivanti Connect Secure and Policy Secure, with a...
The Russian and Moldovan national behind the IPStorm botnet proxy service has pleaded guilty, and the episode covers AlphV's SEC complaint against MeridianLink for not disclosing a breach tied to Confluence. It also notes Rackspace's $11M ransomware...
GreyNoise's Storm Watch podcast opened its new year episode with a roundtable featuring CEO and founder Andrew Morris, covering the loanDepot breaches that occurred in 2023 and early 2024. The episode also covered 23andMe's stance blaming negligent breach...
This episode covers a Microsoft report stating that basic security hygiene could protect against 99% of attacks, with 80% of ransomware compromises occurring via unmanaged devices. It also discusses a Confluence zero-day that lets remote attackers create...
This episode of GreyNoise's Storm Watch opens with a tribute to Ross J. Anderson, whose textbook "Security Engineering" and work in machine learning, cryptographic protocols, and digital rights advocacy shaped the field. The episode also features...
This GreyNoise Storm Watch episode covers Cloudflare's response to a recent security breach, the AnyDesk breach, and a CISA directive for Ivanti that mandates shutting down systems to mitigate vulnerabilities. It also discusses a deepfake scam that...
This GreyNoise Storm Watch episode covers a C root-server outage whose cause remains unclear despite the fix, and the rise of rogue virtual machines in cyber intrusions, including MITRE's recent experience with threat actors abusing VMware environments....
In this Storm⚡️Watch episode, GreyNoise covers Microsoft's decision to delay its Windows Recall feature indefinitely after privacy backlash over its planned launch with Copilot+ PCs. The episode also examines Apple's Private Cloud Compute system and custom...
This episode of GreyNoise's Storm Watch covers a decline in ransomware payments as victims increasingly choose not to pay, alongside the frequency of cyberattacks that go unnoticed by the public. It cites the Dragos Industrial Ransomware Report for Q4...
A mysterious attack last year, dubbed "Pumpkin Eclipse," disabled over 600,000 internet routers in the U.S. through malicious firmware updates, primarily affecting rural and underserved communities. The episode also covers Microsoft Recall, which takes...
A GreyNoise podcast episode covered activity around Atlassian Confluence, ApacheMQ, VMware, and F5, along with an Okta breach update, QNAP vulnerabilities, the release of CVSS4, and a KEV roundup. The hosts also discussed a Cisco blog post by Ben arguing...
GreyNoise's Storm Watch podcast, with guest Mark from Censys, reported a surge in activity around a new Cisco IOS vulnerability and related system implants, with approximately 41,983 hosts carrying the implant, up about 5,000 to 6,000 from the previous...