Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise published six threat-hunting techniques built on its Query Language, including wildcard and boolean searches, ASN and organization lookups, JA3 TLS fingerprints, raw-request searches for encoded commands, and the GreyNoise CLI. The post notes...
GreyNoise explains that Remote Access Trojans communicate with command and control servers through beaconing, which can arrive over IRC, random UDP packets, Discord bots, or the Gopher protocol, while crawling is a server scanning known IP addresses for...
GreyNoise describes the MSSP and MDR markets as struggling with large volumes of security alerts and vulnerabilities across multiple client environments, compounded by a shortage of cybersecurity professionals. GreyNoise says it gathers, analyzes, and...
GreyNoise's review of Black Hat and DEF CON 2023 identifies recurring themes: low-level processor flaws like Downfall that require downtime and carry performance costs, cloud providers that no longer warrant baseline trust, and LLMs trained with no thought...
A proof-of-concept exploit for CVE-2026-1731, a pre-authentication OS command injection flaw (CVSS v4: 9.9) in BeyondTrust Remote Support and Privileged Remote Access, was posted to GitHub on February 10, and by February 11 GreyNoise's sensor network was...
GreyNoise reported elevated crawling activity against its F5 BIG-IP profile beginning 15 October 2025 at 6:41PM EST, amid the security incident involving F5 BIG-IP announced that same day, with most traffic hitting U.S.- and French-based sensors and most...
GreyNoise analyzed 50,000+ unique React2Shell payloads over roughly 1.5 weeks and found most exploitation attempts were 200-500 byte automated scanner probes, with a smaller set of 1,000+ byte payloads carrying crypto mining, denial-of-service, and...
GreyNoise's new hosted sensor fleet is producing PCAPs for participants in the first round of its Early Access Program, letting users dedicate an internet-facing IPv4 address that is wired to a chosen device persona, from a Cisco device to a camera. A PCAP...
GreyNoise's four-part election cybersecurity series closes by describing deepfakes and disinformation as tools that manipulate information rather than physical conflict, citing January 2024 New Hampshire primary robocalls that used an AI-generated voice...
GreyNoise Labs examined CVE-2021-44529, an Ivanti vulnerability that Ivanti's advisory attributes to "code injection" while online sources claimed it is actually a backdoor. The team used archives such as the Wayback Machine to investigate the...
CISA's Cyber Safety Review Board, established in May 2021, published its first report on July 11, 2022, covering the December 2021 Log4j event and citing GreyNoise as a primary source of ground truth. The Board assessed Log4j as an "endemic vulnerability"...
Ahead of the 2024 U.S. elections, GreyNoise describes state actors and cybercriminals increasingly using phishing and social engineering to target election officials, campaign staff, and voters, exploiting the heightened emotions and time pressures of...
GreyNoise published a recap of PancakesCon, a conference where each speaker gives one talk on a cybersecurity topic and one on a non-IT topic. The highlighted talks covered sharing in cyber threat intelligence, a live Metasploit demo, cybersecurity in...
OpenAI's example code for its new ChatGPT plugin feature uses a MinIO Docker image, RELEASE.2022-03-17, that is vulnerable to CVE-2023-28432, which discloses all environment variables including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. GreyNoise says it...
GreyNoise sensors recorded an anomalous uptick in HTTP PUT requests between January 22 and January 24, 2023, with most occurring from January 15 to January 26 and 2,927 payloads carrying randomly generated paths ending in .txt or .jsp. The request bodies...
GreyNoise identified a previously untracked variant of a scraper botnet using a globally unique network fingerprint built on JA4+ signatures, detecting behavior rather than the easily spoofed Hello-World/1.0 user-agent string. The company detected over...
A Censys report cited by GreyNoise found 145,000 industrial control systems exposed to the internet, including thousands of unsecured human-machine interfaces (HMIs). The report cites attacks in Pennsylvania and Texas where attackers used exposed HMIs to...
In a GreyNoise webinar, MSSP leaders Alan Jones and Corey Bussard described how overwhelming alert volume, much of it from inadequate or improperly adjusted threat intelligence feeds, drove them to adopt workflow automation and higher-fidelity threat...
GreyNoise and Black Lotus Labs used graph algorithms on netflow data enriched with GreyNoise's 'Mirai Variant'-tagged IPs to map 23 suspected C2 IPs that communicated with several hundred tagged hosts, and some of those turned out to be Mozi, a...
GreyNoise researcher Ron Bowes built a simple clone of the F5 BIG-IP management port as a honeypot, ran it for a couple of weeks, and analyzed the captured traffic with tshark. The traffic included brute-force logins with credentials like "user123" and...
GreyNoise ran an experiment from January 12-30, 2022 with two identical weakly-credentialed honeypots, blocking scanner IPs from its NOISE data set on one via iptables and leaving the other open. The unblocked host was compromised in an average of 19...
A month after the Log4Shell vulnerability (CVE-2021-44228) was announced in early December 2021, GreyNoise still observed a significant volume of Log4j-related traffic, primarily generic JNDI string exploit attempts with known obfuscations. During the...
On Monday, May 1, 2023, CISA added CVE-2021-45046, CVE-2023-21839, and CVE-2023-1389 to the Known Exploited Vulnerabilities list, covering Apache Log4j, Oracle WebLogic, and TP-Link Archer AX21 flaws. GreyNoise users had visibility into which IPs were...
On November 24, 2021, GreyNoise's passive sensor network observed a single IP address mass transmitting plaintext to port 9100, a common printer port, with messages tied to Reddit's /r/antiwork subreddit, and transmissions increased significantly...
GreyNoise honeypot sensors caught real attackers exploiting a pair of Ivanti Connect Secure vulnerabilities, CVE-2023-46805 and CVE-2024-21887, for which a public exploit exists. The payloads install a persistent cron backdoor and a bitcoin miner, fetch...
GreyNoise observed 4 billion sessions targeting the edge over 90 days and found 39% of unique IPs came from home internet connections, nearly double their 22% share of sessions. Each residential IP averaged fewer than 3 sessions before disappearing, with...
GreyNoise released Sift, an experimental threat-hunting workflow that uses DS/ML/AI techniques to distill roughly 2 million daily HTTP requests down to about 50 events per day for analyst review. Sift produces a daily report that describes new traffic,...
GreyNoise's product team explains that its Viz search bar runs free-text searches across all its data, so a term like "banana" returns IPs that scanned for a "/banana/" directory as well as IPs with "banana" in their user agent. The post recommends GNQL...
GreyNoise researchers have identified and created tags for ICS-related protocols, which the post says attackers and defenders both scan for on the internet. The post notes that many ICS vendors wrapped legacy serial-based protocols inside TCP or UDP to...
GreyNoise researcher h0wdy developed a detection for CVE-2024-21762, an out-of-bounds write vulnerability in Fortinet FortiOS and FortiProxy, after the flaw was added to CISA's Known Exploited Vulnerabilities Catalog. No writeup or proof of concept was...