Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise reports that activity surges in its sensor data precede vulnerability disclosures by a median of 11 days, a pattern it says held across 33 CVEs and 16 vendor families and was confirmed by statistical testing. The study tracked 147.8 million...
GreyNoise Intelligence released a report titled "Ten Days Before Zero" analyzing traffic on its Global Observation Grid over 103 days and 147.8 million sessions, measuring daily activity on 276 tags tied to 18 common edge device and network infrastructure...
GreyNoise recorded roughly 6.2 million sessions across hundreds of source IPs probing for exposed ENV files, .git/config, AWS metadata, and path traversal between April 13 and 20, 2026. Port 5900 (VNC) drew 17,375,937 sessions, third-most-targeted behind...
GreyNoise launched Project Swarm, a community-driven initiative that opens its deception platform to the global security community so defenders can deploy sensors on their own infrastructure and capture real attacker traffic targeting their edge....
GreyNoise describes an incident investigation capability that adds context on IPs and CVEs observed in mass scanning and exploitation campaigns, speeding triage and reducing manual work for SOC teams. The product shows whether an IP is scanning broadly or...
GreyNoise describes a vulnerability prioritization service that reports which CVEs are actively scanned or exploited in the wild, based on primary-sourced attack data it observes rather than static severity and probability scores. The service filters out...
GreyNoise reports that SonicWall VPN targeting reversed a documented 92.9% decline during May 11-18, 2026, with credential attacks and management API scanning hitting at a near 1:1 ratio and making SonicWall 72.2% of all enterprise VPN-targeted activity....
GreyNoise recorded a spike in scanning of SonicWall SonicOS management interfaces between May 9 and May 18, 2026, peaking on May 12 at approximately 597,000 sessions - the largest single-day total on its SonicWall SonicOS API Scanner tag in 90 days and...
GreyNoise describes a product that classifies IP addresses as benign, malicious, or suspicious to filter mass internet scanner traffic out of security alert queues. The company says advanced threat actors deliberately generate noise to obscure targeted...
GreyNoise launched Project Swarm, a research initiative that opens its deception sensor platform to security researchers, universities, non-profits, ISPs, and OEM manufacturers to contribute IP diversity, device profiles, and detection rules. The company...
GreyNoise announced an updated integration with Google Security Operations that adds a standardized ingestion script, two dashboards, three YARA-L detection rules, four UDM queries, response actions at version 7.0, and webhook support. GreyNoise says it...
GreyNoise's May 19-26, 2026 brief reports that rented, disposable infrastructure spent the week inventorying edge devices - routers, VPN gateways, and container control planes - to build target lists ahead of intrusion. The VPSVAULT operation (AS215925)...
GreyNoise's May 27 to June 1, 2026 analysis period recorded a 243M-session week in which two IPs in 85.11.167.0/24 (Netherlands, AS209630) generated 7,190,652 combined sessions, about 3.0% of the corpus and 4.1x the next-largest single emitter. Fortinet...
This episode of GreyNoise's Storm Watch podcast reports that a breach at the US Treasury's Committee on Foreign Investment (CFIUS) has been attributed to Chinese state-sponsored actors, potentially exposing sensitive data on national security reviews of...
GreyNoise outlined seven reasons to move from its free plan to a paid one, led by higher Search limits, increased alert and dynamic blocklist limits, and access to a 16-endpoint Enterprise API versus the Community API's single endpoint. Paid plans also add...
GreyNoise's Storm⚡️Watch episode discusses a critical remote code execution vulnerability in CrushFTP, identified as CVE-2023-43177, which allows unauthenticated attackers to execute arbitrary code and access sensitive data and has been actively exploited...
GreyNoise's April 2023 update added 20 new tags (10 malicious activity, 6 benign actor, 4 unknown activity) and extended its IP Timeline feature from 60 to 90 days of stored IP history. The company also reclassified environment file crawlers from unknown...
In October 2023, as part of its Ransomware Vulnerability Warning Pilot, CISA began tagging entries in its Known Exploited Vulnerabilities catalog to designate whether exploits for a vulnerability are known to be used in ransomware attacks. GreyNoise...
GreyNoise announced Project Swarm on April 29, 2026, a collective research initiative that invites partners to contribute IP space, device profiles, and detection capabilities, turning its proprietary sensor network into a shared ecosystem. The company...
GreyNoise analyzed 4 billion sessions over 90 days and found that 39% of unique IPs targeting the edge come from home internet connections, with 78% vanishing before any reputation system can flag them. Attackers route malicious traffic through ordinary...
GreyNoise's June 01-08, 2026 analysis period found the highest-intent activity aimed at remote-access login surfaces - RDP, enterprise SSL VPN, and router management - rather than any new vulnerability. A single host, 94.102.49.82 (AS202425, Netherlands),...
GreyNoise's brief for February 23 to March 2, 2026 reports global scanning volume fell 37% in a single day as major operations went dark, while Sophos exploitation rose 435%, RDP scanning reached 9.1 million sessions, and VPN credential campaigns ran a...
GreyNoise reports that a single JA4T signature linked React, Fortinet, Palo Alto, and ENV campaigns across 3.3 million sessions during January 26-30, 2026, alongside a 20 million-session VNC reconnaissance surge and two-week RouterOS persistence....
GreyNoise's Supplemental Terms, last modified April 9, 2025, govern customer-deployed Self-Hosted Sensors and grant GreyNoise a perpetual, irrevocable, transferable, sublicensable, worldwide, royalty-free license to use, process, store, and exploit the...
In its June 08–15, 2026 analysis period, GreyNoise reported that a single host probed VPN gateways, application delivery controllers, file-transfer appliances, and webmail in a one-week sweep, with low per-product volume but broad coverage it read as a...
GreyNoise reported that distinct sources brute-forcing Cisco SSL VPN portals jumped to 3,645 on June 23, 2026, from double digits a week earlier, with a subset also hitting other vendors' VPN logins. It also tracked a German-hosted source harvesting...
GreyNoise recorded a sharp resurgence in exploitation attempts against Palo Alto GlobalProtect CVE-2019-1579, an unauthenticated RCE on the CISA KEV list, going from isolated activity in late June to more than 120 malicious hosts on the evening of 06 July,...
GreyNoise has added a Threat Brief Library to its Visualizer, letting users browse, search, filter, and download as PDF every brief available to their account, with the newest appearing first. The briefs, published weekly as At The Edge, are built on data...
The 2026 Verizon DBIR reports that exploitation of vulnerabilities is now the top initial access vector, accounting for 31% of breaches (up 55% year over year), with a median time to full remediation of 43 days, almost two weeks slower than last year....
GreyNoise's June 2026 NoiseLetter announces product updates including Session Volumes, which adds session count data to Tag Detail pages alongside the existing IP count view, and per-IP tag session counts. The letter also introduces Threat Briefs, a...