Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
A GreyNoise webinar, Proactive Defense Made Easy: Leveraging GreyNoise in Your SOAR Playbooks, covered using GreyNoise with SOAR platforms to identify opportunistic attacks, gain insight into how infrastructure is used, and enrich alerts with RIOT data on...
GreyNoise collects unsolicited scanning traffic from IPs worldwide, rotating its listening IPs frequently so that all observed traffic is unsolicited, and uses that dataset to give SOC teams context for prioritizing alerts. The company notes that targeted...
A GreyNoise blog post drawn from a talk with Centripetal traces ML in security from late-1990s naive Bayes spam filtering to malware detection, outlier detection, and rule generation, and notes that almost all anti-malware processors in VirusTotal have...
GreyNoise describes internet noise as unsolicited traffic from tens of thousands of unique IP addresses per day, including mass scans of all 4.2 billion routable IPv4 addresses by benign researchers, malicious actors, and unknown groups. It also counts...
Hurricane Labs, a managed services provider focused on Splunk and Phantom, used GreyNoise Intelligence data to filter noisy alerts, reducing alert volume by 25% and saving the equivalent of one to one and a half analysts per day out of 22 total analysts...
GreyNoise found roughly 90 malicious IPs in a rural New Mexico region of just over 3,000 people, all tied to a single provider, Pueblo of Laguna Utility Authority, with 100% of the traffic Telnet-based. Widening the search using GreyNoise tags, behavioral...
GreyNoise's research team builds tags, described in its documentation as a signature-based detection method for capturing patterns and creating data subsets, using two approaches: data-driven, which works backward from sensor data through discovery,...
GreyNoise researchers observed a substantial change in internet scanning behavior in the second quarter of 2023, with malicious inventory scans dropping sharply in frequency and scale and the vast majority of such scans now coming from benign sources. The...
GreyNoise collects and analyzes internet-wide scan and attack data to help organizations separate targeted attacks from background noise, reducing false positives. The company describes integrations across SIEM, XDR, SOAR, TIP, and OSINT tools, including...
GreyNoise research describes a class of "resurgent vulnerabilities" - older flaws that were deprioritized or never seen as serious and are now being opportunistically exploited at scale, often in edge technologies like firewalls, routers, and VPNs. These...
GreyNoise analyzed 216 spikes in malicious activity targeting edge technologies across its Global Observation Grid since September 2024, including scanning, brute forcing, and exploit attempts. It found that in the vast majority of cases, these spikes were...
GreyNoise published its 1,337th tag, a number it ties to the hacker shorthand for "leet," or elite. The company says its AI system Sift helps detection engineers triage millions of daily sensor events, and that 60% of 2024 tags are based on CVEs, with...
GreyNoise's tag roundup for June 21 to July 16, 2021 added tags for observed attempts to exploit CVE-2020-36289 in Jira for user enumeration, CVE-2021-1497 and CVE-2021-1498 remote code execution flaws in Cisco HyperFlex HX Data Platform, and NoSQL command...
GreyNoise's July 19 to August 2, 2021 tag roundup added malicious-intent tags for exploitation attempts against Zeroshell, Cisco Smart Install, ForgeRock OpenAM (CVE-2021-35464), UDP Technology IP cameras, JBoss Application Server (CVE-2017-12149), Ivanti...
GreyNoise's August 2-16, 2021 tag roundup lists new and revised tags for observed activity, including malicious-intent tags for Exchange ProxyShell vulnerability attempts, Aerospike RCE attempts, Docker API container creation attempts, Buffalo router RCE...
GreyNoise's malicious tag roundup for August 16 to September 1, 2021 lists activity tagged as malicious against Atlassian Confluence Server (OGNL injection), Oracle WebLogic (RCE, CVE-2021-2109), Seagate BlackArmor (RCE), the ASUS GT-AC2900 (auth bypass),...
GreyNoise's tag roundup for September 2-13, 2021 added new tags for internet-wide scanning activity, including crawlers hunting MongoDB instances and legacy Apple iOS devices with remotely accessible lockdownd service. It also tagged malicious behavior...
GreyNoise's tag roundup for September 14-30, 2021 lists new detection tags including malicious-intent attempts against Azure Open Management Infrastructure (CVE-2021-38647, CVE-2021-38648, CVE-2021-38645, CVE-2021-38649), a remote file upload flaw in...
GreyNoise's October 1-29, 2021 tag roundup lists observed exploitation attempts against GitLab Community Edition (CVE-2021-22205), Apache Storm supervisor (CVE-2021-40865), Hikvision IP cameras and NVR firmware (CVE-2021-36260), SonicWall SMA100...
GreyNoise's May 24 to June 4, 2021 tag roundup added tags for VMware vSphere Client RCE attempts and vulnerability checks tied to CVE-2021-21985, and for VMware ESXi OpenSLP RCE attempts exploiting CVE-2021-21974. The post also updated an Elasticsearch RCE...
GreyNoise's May 10-21, 2021 roundup lists malicious-intent tags for exploitation attempts against NetMotion Mobility Server (CVE-2021-26912 through CVE-2021-26915), Jellyfin file disclosure (CVE-2021-21402), a QNAP walter SSH backdoor attempt...
GreyNoise's June 7-18, 2021 roundup tagged malicious activity against SCO OpenServer (CVE-2020-25494), Rocket.Chat (CVE-2021-22911), and the Vesta Control Panel, plus a FiberHome Telnet backdoor spanning multiple CVE-2021-271xx identifiers. The same period...
GreyNoise's honeypot caught an automated zero-day exploit being run across the internet, and its internal AI tool Sift flagged the unrecognized traffic, leading researchers to two previously undisclosed vulnerabilities in NDI-enabled pan-tilt-zoom cameras....
GreyNoise describes how customers apply its data through the MITRE ATT&CK framework, using close to four thousand internet sensors to identify activity in the Reconnaissance (TA0043) and Initial Access (TA0001) tactics. The company says it observed almost...
Microsoft's February Patch Tuesday disclosed four remote code execution vulnerabilities in Exchange - CVE-2023-21529, CVE-2023-21706, CVE-2023-21707 and CVE-2023-21710 - all of which require attackers to have valid authentication before exploitation, after...
GreyNoise researchers argue that Canada's federal auto-theft policy, which aims to ban devices that copy wireless signals for remote keyless entry, could sweep in open-source SDR hardware such as the Flipper Zero and Lime SDR. They note the same components...
CISA has added a field to its Known Exploited Vulnerabilities catalog marking whether a KEV CVE has been used in ransomware attacks, and more than two hundred KEV CVEs now carry that designation. About 75 of those, roughly 35%, have corresponding GreyNoise...
A Storm⚡️Watch podcast poll of over 220 cybersecurity professionals found that respondents consider effective communication the most undervalued skill in the industry. The discussion drew on practitioners' experiences, including incident response staff...
GreyNoise describes its global network of thousands of sensors, deployed across many countries and networks, that captures untargeted mass-scanning traffic across the entire IPv4 space so it can be subtracted from defenders' views. The company says it...
GreyNoise released a Python CLI package for its experimental Labs API, giving users direct access to raw sensor data, contextual metadata, and prototyping utilities, with jq recommended for parsing JSON output. The company states the Labs API contains the...