Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise recorded 29.9 million password-guessing attempts against Remote Desktop in the February 2–9, 2026 analysis period, up 113% from 14 million the prior week, with one IP generating 6.75 million sessions alone. Three independent campaigns targeted...
GreyNoise launched Block, a blocklist product it describes as highly configurable, built on primary-sourced intelligence, and updated in real time as attacker behavior changes. Each blocklist is tied to a GNQL query, which users can start from a pre-built...
GreyNoise is promoting a webinar in which leaders from Layer3 and Ideal Integrations describe how their MSSPs combined automation with threat intelligence to streamline operations and reduce analyst workload. The panel covers their automation journeys,...
GreyNoise's February 9-16, 2026 analysis period recorded three attack surfaces accelerating at once: IoT botnet recruitment up 53-91% week-over-week, Fortinet SSL VPN brute-forcing nearly doubled, and credential harvesting more than doubled to 8.28 million...
GreyNoise analyzed 2,969,010,478 malicious sessions from 3,804,232 unique source IPs collected across 80+ countries between July 23 and December 31, 2025, targeting VPN appliances, routers, and remote access services. The report found that 52% of remote...
A global telecommunications carrier spanning 40+ countries and serving over 200 million wireless subscribers integrated GreyNoise data into its proprietary threat hunting workflows, filtering observations by port, protocol, CVE, and ASN to monitor scanning...
GreyNoise's February 2026 newsletter highlights its 2026 State of the Edge Report, built on 162 days of internet-scale data, which surfaces RCE patterns, legacy CVE abuse, and residential botnet growth in edge infrastructure attacks. The company also...
GreyNoise measured 212 exploitation attempts per second across H2 2025, drawn from 2.97 billion malicious sessions originating from 3.8 million unique source IPs. The report cites Verizon's 2025 DBIR finding an 8x increase in edge device exploitation, with...
GreyNoise's March 2–9, 2026 analysis period recorded 51,801 Ollama model server scanning sessions (+37.9%), with the /api/tags model enumeration endpoint up 374%, and the first observed scanning for AI coding assistant configuration files from Cline,...
For the March 9-16, 2026 analysis period, GreyNoise reports a single Hong Kong cloud provider surged nearly sevenfold to become the dominant source of internet scanning, deploying a new tunneled fingerprint at 29.3M sessions while Western providers...
GreyNoise's March 16-23, 2026 analysis period recorded the MEVSPACE RDP operator returning from a 99.8% collapse, with a single IP generating 7,975,241 sessions across 10,000+ ports before going dark. Two IPs linked to the RondoDox threat operator...
GreyNoise's Ollama honeypot recorded 91,403 attack sessions between October 2025 and January 2026, split into two campaigns: an SSRF operation that spiked to 1,688 sessions in 48 hours over Christmas and showed a single JA4H signature in 99% of attacks...
GreyNoise launched Recall, a time-series capability that lets customers query its data over specific historical ranges through two API endpoints, Stats and Data, rather than relying on the standard GNQL 90-day aggregated view of current IP behavior. Recall...
Two months after CVE-2025-55182, a CVSS 10.0 pre-authentication remote code execution flaw in React Server Components disclosed December 3, 2025, GreyNoise telemetry shows two IP addresses now account for 56% of all exploitation attempts, down from 1,083...
GreyNoise observed 417 exploitation sessions against two critical Ivanti Endpoint Manager Mobile vulnerabilities between February 1 and February 9, and 346 of them (83%) came from a single IP, 193[.]24[.]123[.]42, on a Censys-labeled bulletproof autonomous...
GreyNoise observed a sharp increase in Server-Side Request Forgery exploitation on March 9 across multiple SSRF vulnerabilities, preceded by Grafana path traversal attempts that may have served as a foothold for deeper exploitation. GreyNoise said the...
GreyNoise's Global Observation Grid honeypot network detected 1,089 unique IPs attempting to exploit CVE-2024-4577, a critical PHP-CGI remote code execution flaw with 79 exploits available, during January 2025. Cisco Talos reported the flaw was used...
GreyNoise announced NetNoiseCon, a new online conference series livestreamed on its YouTube channel on April 19th starting at 12pm ET / 9am PT. The event features technical and career-advice talks from speakers across the InfoSec industry and the GreyNoise...
GreyNoise reported that four source IPs from AS215925 collectively exploited 22+ vulnerabilities against Hikvision cameras, MikroTik routers, TP-Link devices, D-Link NAS, and consumer DVRs across 3,347,443 combined sessions in a botnet recruitment...
GreyNoise announced new real-time threat defense capabilities at Black Hat 2025, including push-based delivery of verified malicious IP data via webhooks and native integrations with SOAR platforms such as Splunk SOAR, Palo Alto Networks XSOAR, and IBM...
GreyNoise Intelligence published a report, "The Invisible Army: Residential Proxy Abuse in Internet-Scale Attack Traffic," based on 4 billion malicious sessions from 5,720,000 unique source IPs observed over 90 days, from November 29, 2025 to February 27,...
GreyNoise analyzed 4 billion sessions over 90 days and found that 39% of unique IPs targeting the edge come from home internet connections, with 78% vanishing before any reputation system can flag them. The company says traditional reputation feeds fail to...
GreyNoise launched C2 Detection, an intelligence module that extracts callback destinations from exploit payloads sent to its global sensor network and collects the malware hosted there to map staging servers and command-and-control infrastructure. The...
GreyNoise describes a compromised asset detection approach that uses two independent signals: an organization's IP appearing as a scanner in GreyNoise's data, which suggests it has been pulled into a botnet, and outbound traffic matching a confirmed...
GreyNoise Intelligence announced C2 Detection on April 7, 2026, an intelligence module that matches outbound network traffic logs against a continuously updated dataset of confirmed malware-hosting IPs and Command and Control infrastructure to flag active...
GreyNoise describes a threat-hunting approach that correlates an organization's internal traffic against its real-time map of internet-wide mass scanning, filtering out opportunistic probes, benign scanners, and botnet noise to surface statistically...
GreyNoise added an IP Timeline feature that shows up to 90 days of history for IPs it observes scanning and exploiting the internet, displayed as a timechart alongside existing IP page fields like DNS information and destination sites. The timeline tracks...
GreyNoise observed 21 IP addresses in AS213438, registered in RIPE WHOIS to ColocaTel Inc. of Mahe, Seychelles, generating 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026 - 67.4% of the worldwide total - and 49.7% across the 48-hour...
GreyNoise reports that six AWS-hosted nodes sharing a single JA3 fingerprint systematically probed Fortinet, Palo Alto, Sophos, Ivanti, Citrix, ConnectWise, and F5 appliances in one coordinated operation active since January. For the April 06-13, 2026...
GreyNoise recorded its broadest single-week botnet recruitment expansion since January 2026 for the March 30 to April 06, 2026 analysis period, alongside twenty new exploitation tags targeting end-of-life routers, DVRs, and ICS platforms including FUXA...