Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise reported that roughly a thousand malicious IPs ran the Exchange ProxyNotShell check on every odd-numbered day from October 5 to 13, 2026, against no more than 24 on even days, with IPs from the same pool returning pass to pass. Attempts against...
GreyNoise reported that Cisco SD-WAN Manager CVE-2026-76504 auth bypass attempts peaked at 20 malicious IPs in a single day with almost no discovery traffic first, a month after CISA's fix deadline had passed. Four days later, 24 malicious IPs attempted...
GreyNoise reported that its deception sensors observed and shared activity around PHP2Shell in October, and that its Project Swarm initiative is distributing honeypots for anyone to run on the open internet, with Merit Network already seeing results. The...
Merit Network, the nonprofit research and education network founded in 1966 that runs more than 4,000 miles of fiber across Michigan, integrated GreyNoise Block's continuously updated IP lists into its detection and alerting pipeline and cut alert volume...
GreyNoise says it often observes widespread exploitation of a vulnerability either before a CVE is assigned or before vendors communicate anything, and its sensor data going back to 2020 lets it check whether a newly disclosed flaw was seen in the wild...
GreyNoise Labs released a free IP Check tool that reports within seconds whether an IP address has been observed scanning the internet or belongs to known business service infrastructure, with no signup or email collection. The tool returns verdicts of...
Robert, manager of cybersecurity incident response and operations at a large food service and hospitality company, integrated GreyNoise Intelligence data into Cortex XSOAR so that IP enrichment runs automatically on most network detection alerts, including...
On May 14, 2026, GreyNoise's Global Observation Grid recorded 119,842 malicious, non-spoofable IPs targeting edge infrastructure, and comparing that set against eleven widely deployed OSINT and commercial IP feeds found average coverage of 2.0%, with no...
GreyNoise Labs published a blog examining CVE-2023-22527, an Atlassian Confluence vulnerability that drew widespread news coverage in January 2024 and was largely dropped by media a week later. The Labs team reports that attackers continue to exploit it,...
GreyNoise announced the official launch of GreyNoise Labs, a unit it soft-launched during 2023 that develops new ways to process and present the data GreyNoise collects, curates, and computes. Labs work is organized into "blueprints" that may appear as a...
GreyNoise's Storm Watch hosts predict 2024 will bring a continuation of 2023's trends - ongoing kinetic and cyber wars, disruptive ransomware, legal scrutiny of the CISO role, and mainstream AI adoption - with an exponential increase in AI use on both...
GreyNoise describes four ways SOC teams use its internet-wide scan and attack observations, delivered into the SIEM, to classify source IPs by behavior. The four uses are filtering firewall and WAF logs to exclude known mass scanners, correlating allowed...
The 2025 Verizon DBIR reports that exploitation of edge vulnerabilities in breaches has surged eightfold, yet nearly one in three edge KEVs remain fully unpatched despite being on CISA's Known Exploited Vulnerabilities catalog. GreyNoise research adds that...
GreyNoise Labs researcher Jacob Fisher used the company's Early Access Program dynamic sensors to capture a new proof of concept for CVE-2023-47246, a path traversal vulnerability leading to remote code execution in SysAid On-Premise software. The work...
A GreyNoise analysis of CISA's Known Exploited Vulnerabilities catalog, presented at BSidesLV, found the average age of CVEs added to the KEV is decreasing, with most 2023 additions made within the first week of assignment. The analysis also found CISA's...
GreyNoise explains that honeypots and honeytokens serve the shared purpose of early threat detection but differ in deployment, interaction, and scope: honeypots are bogus systems or networks that lure attackers into a monitored environment, while...
GreyNoise found that 59 vulnerabilities silently flipped to "known ransomware use" in CISA's KEV catalog during 2025, with no alert or announcement beyond a field change in a JSON file. Nineteen of the 59 target network security appliances, including...
GreyNoise published a multipart series on the 2024 U.S. election cybersecurity landscape, mapping targets that extend beyond voting machines and voter registries to campaign websites, email systems, databases, party networks, news and social media...
A joint U.S. and UK advisory identifies 25 vulnerabilities tied to an exploitation campaign by Russia's APT 29, the group behind the SolarWinds hack. GreyNoise tracks 12 of the 25 and has detected nine of them being actively probed by attackers, activity...
GreyNoise describes how MSSPs and MDRs use its labeling of internet-wide scan and attack traffic to filter noisy IPs, with integrations into over 50 security tools. The post cites Ideal Integrations enriching alerts through Swimlane via API and Hurricane...
State-sponsored actors backed by nations including Russia, China, and Iran interfere in elections through cyberespionage, disinformation campaigns, and direct attacks on election infrastructure, according to this GreyNoise blog post. The post cites the...
A Sophos report describes an APT campaign that began in 2018 targeting Cyberoam, an India-based Sophos subsidiary, then shifted from mass exploitation aimed at building operational relay boxes to focused attacks on a small set of high-value targets...
GreyNoise sensors observed eight distinct surges of Cisco-targeting activity before Cisco published its advisory for CVE-2026-20127, a CVSS 10.0 zero-day cited in a Five Eyes joint warning, with the earliest arriving 39 days before disclosure. Over 103...
GreyNoise researchers traced an untagged shell-injection exploit in their Sift data that resembled CVE-2021-22986, a well-known SSRF bug, but was a different vulnerability discussed in many of the same write-ups. The investigation found that the...
GreyNoise published a technical blog explaining text embedding, the process of converting text into numerical vectors so models can perform tasks like nearest-neighbor search or classification, and contrasting GPT models, which mask only the last word in a...
GreyNoise describes how its data can be added to Elastic Stack and Tines workflows to filter false positive alerts before they reach SOC teams and to add context to alerts that do arrive. Its sensors passively capture internet scanning traffic worldwide...
GreyNoise discovered on March 18, 2025 an ongoing campaign in which attackers gained persistent access to thousands of internet-exposed ASUS routers, with access surviving reboots and firmware updates. The attackers chained authentication bypasses, a known...
GreyNoise reports that Stark Industries Solutions, sanctioned by the EU on May 20, 2025, had roughly twelve days' warning from leaked EU documents that reached Moldovan media, and used that time to move Autonomous System AS44477 to a new RIPE organization,...
GreyNoise founder and CEO Andrew Morris published a guest blog for IOActive titled "Cybersecurity Alert Fatigue: Why It Happens, Why It Sucks, and What We Can Do About It," arguing that alert overload spans healthcare, manufacturing, transportation, and...
On June 5, 2024, SolarWinds published an advisory for CVE-2024-28995, a path-traversal vulnerability in Serv-U discovered by Hussein Daher. GreyNoise Labs deployed a new honeypot to observe exploitation and tracked one live attacker over four hours,...