Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise's early-warning detection flagged validated late-week spikes against FortiOS SSL VPN (CVE-2018-13379, a CISA KEV), Cisco SSL VPN, Ivanti EPMM, and NETGEAR devices during the July 06 to July 13, 2026 analysis period. Beneath those spikes, one DIGI...
GreyNoise released an Intelligence Dashboard that lets signed-in users pin combinations of CVEs, tags, countries, IPs, and GNQL queries into one persistent, always-current view, built from five panel types and five focus options. Each user gets a Daily...
GreyNoise reported that two crawlers, 159.89.117.80 on DigitalOcean and 161.97.74.198 on Contabo, ran an identical toolkit against NGINX UI (CVE-2026-27944) and LiteSpeed Cache (CVE-2024-44000), both CVSS 9.8 flaws that disclose credentials, keys, or...
GreyNoise Block turns its Global Observation Grid data into firewall blocklists that provision in minutes and refresh every hour, with templates covering CVE exploit attempts, attacks on vendors including Cisco, Citrix, F5, Fortinet, Ivanti, Palo Alto and...
GreyNoise tracked a credential-harvesting fleet since early July in which one TLS client fingerprint and an identical toolkit link tied 64 rented hosts across several providers, including Bucklog SARL and the 3xK Tech range, into a single operation that...
GreyNoise Tactics read more than 110,000 host sessions command by command and found that volume did not predict risk, with serious activity in fewer than 1 in 1,000 sessions and concentrated on quiet, credential-rich services. In one React2Shell session...
GreyNoise operates a global fleet of thousands of sensors that mimic commonly used and exploited software, capturing all traffic that interacts with them and sending it to an analytics engine in real time that classifies the intent of the activity and tags...
GreyNoise recorded exploitation attempts against six managed file transfer products - CrushFTP, MOVEit Transfer, GoAnywhere MFT, SolarWinds Serv-U, Wing FTP Server and Cleo - plus Apache Superset and Next.js between August 01 and August 10, 2026, each tied...
Andrew Morris, who founded GreyNoise in 2018 in an Arlington, Virginia apartment, is handing the CEO role to Ash Devata and moving to Chief Architect. Devata joins from Cisco, where he was Vice President and General Manager for the Duo and Zero Trust...
GreyNoise announced Nishawn Smagh as its new Director of Intelligence; Smagh describes 25 years of military service and a focus on protecting others. He says GreyNoise's approach of collecting and analyzing background internet noise lets security teams cut...
GreyNoise's new Head of Adversary Engagement writes that CVE entries rose from 16,510 in 2018 to 48,162 in 2025, with 130% growth from 2022 through 2025, and that the mean time to exploit has dropped to slightly negative, meaning the average vulnerability...
GreyNoise published "After the Shell," its first report from GreyNoise Tactics, built from more than 110,000 host sessions read command by command. The report found serious activity in fewer than 1 in 1,000 sessions, concentrated on quiet, credential-rich...
GreyNoise redesigned its Visualizer with a persistent sidebar organized around Dashboards, Observation, and Automation, replacing the top dropdown menus, and made search available throughout the tool via the sidebar, Command + K, or the home page. The...
GreyNoise's classification data is now available across the CrowdStrike Falcon platform, including Next-Gen SIEM, Falcon Fusion SOAR, and Charlotte AI agentic workflows. The integration runs through the GreyNoise Foundry App on the CrowdStrike Marketplace,...
GreyNoise's August 10-17, 2026 analysis period recorded attempted exploitation of CISA KEV-listed flaws across Ivanti, Palo Alto Networks, Citrix, F5 and Fortinet, plus Adobe ColdFusion across seventeen distinct tags spanning 2009 to 2026. Ten rented hosts...
GreyNoise reports that 61% of traffic tagged as Log4Shell exploitation (CVE-2021-44228) during August 17-23, 2026 came from a single address range resolving to a commercial vulnerability management service, not an adversary. The same range supplied 35% of...
GreyNoise observed automated scanners forging the crawler names of OpenAI, Anthropic, DeepSeek and Fortune 500 companies while requesting .env files, cloud access keys, private keys and password stores. A cluster impersonating 13 AI crawlers from eight...
GreyNoise announced an expanded integration with the CrowdStrike Falcon platform, adding a Falcon Next-Gen SIEM dashboard, correlation rules that flag allowed inbound traffic from malicious infrastructure, and Charlotte Agentic SOAR playbooks. The content...
GreyNoise marked its ninth anniversary with a NoiseLetter announcing an expanded CrowdStrike Falcon integration, including a Falcon Next-Gen SIEM dashboard, correlation rules that detect allowed inbound traffic from malicious infrastructure, and SOAR...
GreyNoise's August 23-30, 2026 analysis period recorded daily unique sources against the Next.js authorization bypass CVE-2025-29927 rising from no more than three to 28, then 426, then 495 across a partial final day, with the population still climbing...
GreyNoise recorded adversaries attempting two CISA Known Exploited Vulnerabilities remote code execution flaws in the AI application platform Langflow, CVE-2025-3248 and CVE-2026-0770, at 3,968 and 4,770 connection attempts during September 8-14, 2026....
GreyNoise reported that credential collection was the highest-volume malicious activity between August 30 and September 8, 2026, with environment files, cloud configuration and repository configuration requested directly from web servers and almost none of...
GreyNoise Intelligence announced four senior hires on Sept. 23, 2026, to expand its work with U.S. and allied government agencies. The company says more than 400 government agencies across the Five Eyes, NATO, and allied nations use its threat data on...
In the September 14-21, 2026 analysis period, GreyNoise saw attempts against CVE-2022-22963 in Spring Cloud Function (CVSS 9.8, in CISA's Known Exploited Vulnerabilities catalog) and CVE-2018-17246 in the Elastic Kibana console jump from single-digit daily...
On 24 September 2026, an actor using 149.104.78.141 attempted zero-day exploitation against a Citrix NetScaler Gateway, detected by a Project Swarm participant sensor before any CVE-specific detections existed. The attempt failed to gain a foothold, but...
On 31 August 2026, a likely Russian-speaking actor used the IP 45.142.193.132 and AI to develop and test exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078), building a lab with the vulnerable software and an Active Directory server and using...
GreyNoise observed exploitation attempts against Citrix NetScaler CVE-2026-88771 on 24 September, more than three days before public disclosure, with behavioral detections labeling it malicious within seconds. CISA added CVE-2026-94127, an unauthenticated...
GreyNoise observed a rise in scanning and exploitation attempts against Digital Video Recorders in Ukraine between 21 September and 1 October 2026, coinciding with an escalation in Russian strikes. Most of the activity targeted CVE-2021-36260, an...
GreyNoise released an MCP Server that connects Anthropic's Claude directly to its real-time threat context on malicious infrastructure, internet scanning, and vulnerability exploitation. The integration supports four threat investigation use cases in...
GreyNoise identified a malicious actor running a proxyjacking campaign that compromised at least 143 network edge devices across 34 countries, installing Pawns.app proxyware on behalf of the attacker using exploits against DVR/NVR brands including...