Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise examined the ESXiArgs ransomware campaign, which creates files with a .args extension and was flagged by OVH on February 3rd, 2023, and found that while third-party sources attribute it to CVE-2021-21974, a heap-overflow flaw in VMware ESXi's...
GreyNoise published a vendor-neutral white paper aimed at helping security professionals assess whether they need a dedicated threat intelligence feed. The guide notes that some organizations can rely on feeds embedded in firewalls or SIEMs, while others...
GreyNoise reviewed CISA's Known Exploited Vulnerabilities catalog more than six months after its November 2021 launch, counting 38 releases covering 777 CVEs against 11,099 new CVEs assessed by the National Vulnerability Database in calendar year 2022 as...
GreyNoise describes threat hunters spending much of their time searching security logs for indicators of compromise and behavioral patterns, and notes the work carries specific challenges. The post says organizations can pair GreyNoise with a SIEM or SOAR...
GreyNoise describes the operational difficulty of using netflow data, whether collected from your own devices, pulled from cloud provider flow logs, or purchased from netflow providers, citing the sheer volume of data and the limited detail in flow logs...
GreyNoise reviewed IPv6 research to plan where its sensors and data collection go next, noting that IPv6 adoption is rising, the US government has set dates to migrate all government resources to IPv6, and IPv4 exhaustion continues. Because IPv6 holds...
GreyNoise deployed a series of MCP honeypots mimicking plausible MCP deployments with full packet-level visibility, and every instance was discovered within days before activity leveled off into ordinary HTTP probes, SSH touches, and one-shot scans. Across...
GreyNoise Research published a Grimoire post on April 23, 2024 detailing how to decrypt Fortinet's FortiOS 7.0.x firmware, including a hardcoded key used in the ChaCha20 encryption algorithm and the steps to extract the decrypted rootfs.gz file. The post...
GreyNoise Labs reported that among 242 CVEs it covered in 2023, the Cl0p ransomware group exploited the Progress MOVEit Transfer SQL injection flaw (CVE-2023-34362), causing data breaches at over 2.6K organizations and affecting roughly 90 million...
GreyNoise's internal tool "Hunter" clusters millions of daily HTTP/HTTPS events and surfaces a small set of new clusters for researchers to triage, contributing to seven tags published in one week. The tags cover scanning for the SonicWall SonicOS TFA API...
GreyNoise assembled a panel of security professionals for a May 30th webinar, "AI for Cybersecurity: Sifting the Noise," in which panelists argued that LLMs and GPTs are tools that recognize patterns in data rather than intelligent actors. One panelist...
A remote code execution vulnerability in D-Link NAS devices, tracked as CVE-2024-3273, is being actively exploited and was initially believed to affect as many as 92,000 devices, though Censys puts the number closer to 5,500. Exploitation requires valid...
On November 21, 2023, ownCloud disclosed CVE-2023-49103, a critical vulnerability rated 10 out of 10 in the "graphapi" app, present in versions 0.2.0 to 0.3.0, that lets attackers access admin passwords, mail server credentials, and license keys through a...
SnakeYAML versions before 2.0 allow remote code execution when parsing untrusted input, because the library by default permits instantiation of arbitrary Java classes from untrusted YAML sources. GreyNoise Labs researcher Ron Bowes notes this...
GreyNoise describes its platform as collecting and analyzing internet-wide scan and attack data to give security analysts context on attack sources and filter out benign traffic. The post states that often more than 50% of alerts reaching SOC teams are...
GreyNoise added three new tags to its fingerprinting for HTTP-based protocols, extending its existing JA3 and HASSH client identification to show how internet background noise-makers manage internal state. The tags let analysts infer tooling - for example,...
On 28-April-2022, CERT-In issued new directions under sub-section (6) of section 70B of the Information Technology Act, 2000, requiring organizations to report any cyber security incident, including targeted scanning of systems and data breaches, within 6...
Between December 25 and 28, a single operator running from two IP addresses on CTG Server Limited (AS152194) scanned the internet for vulnerable systems, testing 240+ exploits and sending requests every 1-5 seconds, with each target receiving 11 exploit...
GreyNoise deployed 24 new sensors between November 19 and 26, 2024, across five autonomous systems and eight geographies to profile benign internet scanners, narrowing the analysis to the top ten actors by tag count in November, including Shodan, Censys,...
On April 25, 2023, GreyNoise reclassified environment file crawlers from unknown intent to malicious intent, a change that reclassifies over 11,000 IPs as malicious. Environment files are hidden dotfiles that typically hold authentication keys, passwords,...
Censys identified over 40,000 internet-connected ICS devices in the U.S., including more than 400 human-machine interfaces, many of which required no authentication when observed. GreyNoise then set up hyper-realistic HMI emulations camouflaged by...
GreyNoise Labs published a blog post by Remy on Bluetooth Low Energy device identification and vulnerability research, covering the construction of a BTLE GATT UUID database and remote identification of Bluetooth devices. The post describes vulnerabilities...
GreyNoise Labs published the first installment of its "RattaGATTa: Scalable Bluetooth Low-Energy Survey" series, which covers BTLE device identification, connection protocols, custom hardware design, and rate-limiting algorithms. The work grew out of an...
GreyNoise built a new Premium Feed for Anomali ThreatStream that lets Anomali customers pull in all malicious IPs GreyNoise has seen hitting its sensors in the past 24 hours, on a daily basis. GreyNoise positions the feed for opportunistic attack activity...
GreyNoise explains how its tags work: rather than viewing data IP by IP, tags attribute IPs to specific behaviors or actors, with classifications split into Intent (Unknown, Malicious, Benign) and Category (Activity, Tool, Actor, Worm, Search Engine). The...
CVE-2025-48927 affects certain deployments of TeleMessage TM SGNL, an enterprise messaging system modeled after Signal, because the platform kept a legacy Spring Boot Actuator configuration that leaves the /heapdump endpoint publicly accessible without...
GreyNoise deployed new sensors in undisclosed network locations and, in the first week, tagged 8,697 incoming IP addresses, with the first packet of possible ill-intent arriving ten seconds after the nodes were fully operational and the first tagged event,...
GreyNoise marked Wednesday, October 20, 2021, as the first SOC Analyst Appreciation Day, acknowledging the work of analysts defending institutions worldwide. The company described the role as frustrating and stressful and said its product filters out noisy...
GreyNoise Labs researcher Matthew Remacle published an analysis of the newly disclosed Apache Struts2 CVE-2023-50164 file upload vulnerability, which allows an attacker to drop a web shell that can be called remotely through a public interface over defined...
GreyNoise describes five SOAR integrations it walks through in nearly every deployment: a /v3/ip lookup that enriches alerts with classification, tags, and threat level (single or bulk, up to 10K at a time), event feeds that alert when scanning against...