Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise Labs analysed 30 days of malicious traffic between late September and late October 2023, observing 475,616 malicious exploitation attempts against Spanish IP address space and 7,571 attacks originating from Spain against other country-assigned...
GreyNoise Labs analysed 30 days of malicious traffic between mid-September and mid-October 2023 and observed 178,360 malicious exploitation attempts against German IP address space, alongside 12,720 attacks originating from Germany at other...
GreyNoise Labs analysed 30 days of sensor data between mid-August and mid-September 2023 and observed 596,817 malicious exploitation attempts against U.K. IP address space, alongside 8,293 attacks originating from U.K.-attributed networks directed at other...
GreyNoise Labs analyzed 30 days of sensor data between mid-September and mid-October 2023 and observed 92,708 malicious exploitation attempts against Korean IP address space and 15,120 attacks originating from Korea against other countries' networks. Of...
GreyNoise Labs analysed 30 days of sensor data between mid-September and mid-October 2023 and observed 206,971 malicious exploitation attempts against Singapore IP address space, alongside 7,849 attacks originating from Singapore networks directed at other...
GreyNoise Labs analysed 30 days of malicious traffic between mid-September and mid-October 2023 and observed 138,379 malicious exploitation attempts against Japan's IP address space and 11,230 attacks originating from Japan-attributed networks. Of the...
GreyNoise Labs analyzed 30 days of malicious traffic between late September and late October 2023, observing 44,700 malicious exploitation attempts against Italian IP address space and 7,937 attacks originating from Italy against other countries' networks....
GreyNoise Labs analysed 30 days of sensor data between mid-September and mid-October 2023 and observed 111,073 malicious exploitation attempts against French IP address space and 3,292 attacks originating from France against other countries' networks. Of...
GreyNoise Labs analyzed 30 days of sensor data between mid-August and mid-September 2023 and observed 164,329 malicious exploitation attempts against Canada IP address space and 3,603 attacks originating from Canada against other countries' networks. Of...
GreyNoise Labs analyzed 30 days of sensor data between mid-August and mid-September 2023 and observed 111,073 malicious exploitation attempts against Australia IP address space, plus 3,292 attacks originating from Australia against other countries'...
Since October 8, 2025, GreyNoise has tracked a coordinated botnet operation of over 100,000 unique IP addresses from more than 100 countries targeting Remote Desktop Protocol services in the United States, and the botnet has since grown to roughly 300,000...
GreyNoise reports steady deployments of previously unseen IPs attacking Microsoft RDP through timing-based vulnerabilities, targeting RD Web Access timing attacks and RDP web client login enumeration while rotating significant volumes of new IPs daily to...
GreyNoise observed a roughly 500% increase in unique IPs scanning Palo Alto Networks PAN-OS GlobalProtect login portals on 3 October 2025, the highest level in 90 days, rising from about 1,300 IPs that afternoon to over 2,200 by 7 October. GreyNoise links...
GreyNoise runs a global sensor network of thousands of honeypots across more than seventy countries, and on an average day more than 600,000 different IPs complete hundreds of millions of sessions, about half of them attacks. Occasionally an attacker...
GreyNoise's October NoiseLetter announces Block, a blocklist approach the company describes as highly configurable, grounded in primary-sourced intelligence, and updated in real-time as attacker behavior changes. The newsletter also says GreyNoise is...
GreyNoise observed a steady ramp-up in exploitation attempts against PHP and PHP-based frameworks from August through October 2025, with seven distinct attack patterns spiking into October and November. The loudest campaigns target ThinkPHP Framework LFI...
GreyNoise announced on November 4, 2025 an integration with CrowdStrike Falcon Next-Gen SIEM at Fal.Con Europe 2025, giving joint customers direct access to GreyNoise network intelligence to enrich perimeter-related alerts. GreyNoise's sensor network of...
GreyNoise Intelligence announced on October 23, 2025 that it added Nishawn Smagh, a retired U.S. Air Force intelligence officer, as Director of Intelligence to serve as principal liaison to government and enterprise partners. Smagh spent 25 years in...
GreyNoise now lets customers turn any GreyNoise Query Language query into a live, continuously updated blocklist for firewalls, SOAR, and other enforcement points, with new matching IPs added instantly as GreyNoise observes them. The company says static...
GreyNoise observed active exploitation of CVE-2025-64446, a critical path-traversal flaw allowing unauthenticated administrative command execution on Fortinet FortiWeb appliances, with the first exploit traffic hitting its sensors on November 17, 2025,...
GreyNoise observed a 40x surge in scanning activity targeting Palo Alto Networks GlobalProtect portals within 24 hours beginning 14 November 2025, reaching a new 90-day high. Since that date, GreyNoise has recorded 2.3 million sessions hitting the...
GreyNoise's November 2025 NoiseLetter announces Query-Based Blocklists, which convert any GNQL query into a real-time, continuously updating blocklist for firewalls, SOAR, or other enforcement points, configurable to an organization's risk tolerance and...
On 2 December 2025, GreyNoise observed a concentrated spike of more than 7,000 IPs attempting to log into Palo Alto Networks GlobalProtect portals, all originating from infrastructure operated by 3xK GmbH and targeting two Palo Alto profiles in its Global...
GreyNoise research shows that spikes in traffic targeting older CVEs often precede new CVE disclosures for that same vendor within weeks. The company says detecting these shifts in attacker reconnaissance before disclosure gives organizations a window to...
GreyNoise tracked a coordinated, automated credential-based campaign against Cisco SSL VPN and Palo Alto Networks GlobalProtect services over a two-day period in mid-December, with roughly 1.7 million sessions hitting emulated GlobalProtect portals in 16...
GreyNoise's Observation Grid has recorded over 8.1 million attack sessions exploiting CVE-2025-55182, the React Server Components 'Flight' protocol unauthenticated RCE known as React2Shell, with daily volumes stabilizing at 300,000-400,000 after peaking...
GreyNoise reports the React2Shell campaign remains highly active, with more than 8.1 million attack sessions observed since disclosure and daily activity holding steady at 300,000 to 400,000. It tracks 8,163 source IPs across 1,071 ASNs in 101 countries,...
GreyNoise's January 19–23, 2026 analysis tied React exploitation, VPN brute forcing, and router scanning to a single JA4T network signature, indicating coordinated rather than opportunistic activity. The brief cites CVE-2025-55182 at CVSS 10.0 with 179,000...
GreyNoise added two new Event Feed types, Vendor CVE Spike and Tag Spike, which alert when attacker activity against a vendor's technology stack or a named tag rises significantly. The company cites its own sensor data from the week of January 19, 2026,...
GreyNoise's January 2026 NoiseLetter reports the company introduced Recall, a time-series intelligence capability for GNQL, tracked threat actors targeting LLMs, and observed a Christmas ransomware campaign. It also states that on February 10th GreyNoise...