Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise's Storm Watch episode discusses the rumored takedown of the ALPHV/BlackCat ransomware site, which has been offline for days amid speculation that law enforcement may have caught up with the group. The episode also covers the North Korea-linked...
This episode of GreyNoise's Storm Watch podcast features Erick Galinkin discussing his AI security work at NVIDIA and recent AI-assisted threats affecting LastPass and healthcare facilities. The episode also covers a XZ-style attack attempt on OpenJS, a...
This GreyNoise Storm Watch episode covers the Department of Justice's announcement on AI in crimes, which signals harsher sentences akin to weapon-enhanced offenses, along with the DOJ's Justice AI initiative and federal AI regulation efforts including the...
This GreyNoise Storm Watch episode covers the international police operation that disrupted the Lockbit cybercrime gang and the Justice Department's court-authorized disruption of a botnet controlled by the Russian GRU. It also discusses new...
This episode of GreyNoise's Storm⚡️Watch covers the 2024 Verizon Data Breach Investigations Report, whose findings include vulnerability exploitation as an initial access point nearly tripling in 2023. The episode also discusses a solar storm that knocked...
GreyNoise announced it will host monthly GreyNoise 101 sessions beginning May 26, 2022, for new and existing community members to learn or review the platform at a high level. The first session covers its features including Trends, Analysis Tool, and...
NVD published CVE-2022-27925 on April 20th, 2022, a Zimbra Collaboration Suite 8.8.15 and 9.0 flaw letting an authenticated administrator upload arbitrary files and traverse directories. Volexity found an authentication bypass from an incomplete fix,...
GreyNoise added features to help threat intel teams move from simple indicators like IPs, domains, and hashes toward harder-to-change tactics, techniques, and procedures, citing David Bianco's Pyramid of Pain. The new IP Similarity feature clusters...
Citrix disclosed CVE-2023-3519, a critical unauthenticated remote code execution vulnerability with a CVSS score of 9.8 affecting NetScaler ADC and NetScaler Gateway, but researchers found at least two vulnerabilities patched in the same upgrade. Rapid7...
GreyNoise Labs examined CVE-2024-4577, a remote code execution vulnerability in PHP affecting Windows deployments, discovered by DEVCORE and demonstrated by watchTowr. The flaw exploits a 'best-fit' Unicode processing behavior in Windows that lets...
GreyNoise's February 2024 monthly roundup lists the books, podcasts, and articles its team is reading, including Matthew Mather's CyberStorm series about cyber warfare and satellite destruction, Brendan Ballou's Plunder on private equity, and security...
On August 2, 2022, VMware disclosed two vulnerabilities in VMware Workspace ONE products and published patched versions to remediate them. GreyNoise created tags for tracking and blocking exploit activity on the CVEs, and as of its blog's publication date...
On October 16th, 2023, Cisco disclosed CVE-2023-20198, a Web UI privilege escalation vulnerability with a CVSS base score of 10 that lets an unauthenticated attacker create an account with privilege level 15 access, and Cisco says it has been exploited in...
Trinity Cyber's Threat Analysis team gave GreyNoise evidence of exploitation for CVE-2023-1389, a command injection vulnerability in TP-Link Archer AX21 firmware, and GreyNoise deployed a detection tag in under two hours. Trinity Cyber then supplied...
GreyNoise announced it achieved SOC 2 Type 2 compliance with an unqualified opinion under AICPA standards, using Prescient Assurance as its auditor and SecureFrame as its compliance automation platform. The company estimates a compliance automation...
CVE-2023-29552 is a high-severity flaw in the legacy Service Location Protocol that lets an unauthenticated, remote attacker register arbitrary services and launch a reflection amplification DoS attack. BitSight reported the issue in May and found it...
GreyNoise Labs researcher Matt Lehman introduced a tool called Precursor that labels and finds similarities in text, hex, or base64 encoded data using arbitrary similarity algorithms such as MRSHv2 and SSDEEP. The tool offers a binary input mode for...
GreyNoise Labs detailed CVE-2024-0769, a path traversal vulnerability in D-Link DIR-859 WiFi routers that leads to information disclosure and allows extraction of account details from the device. The product is End-of-Life and will not be patched, and...
VMware released an advisory on June 7, 2023 for CVE-2023-20887, a command injection vulnerability in VMware Aria Operations for Networks (formerly vRealize Cloud Management) with a CVSS score of 9.8. A proof of concept was published June 13, 2023 by...
F5 Networks issued advisory K23605346 on 4-May-22 for CVE-2022-1388, an iControl REST flaw allowing an unauthenticated attacker to take control of an affected BIG-IP system, rated 9.8 CRITICAL by NIST's National Vulnerability Database. As of 14-May-22,...
CISA added CVE-2023-27350, a critical unauthenticated remote code execution vulnerability (CVSS 9.8) in PaperCut MF and PaperCut NG printer management software, to its Known Exploited Vulnerabilities list on April 21, 2023. The flaw affects application and...
GreyNoise held its debut NetNoiseCon event on April 19th, featuring technical talks on active APT groups targeting industrial control systems, Mustang Panda malware analysis, threat signal detection, and internet vulnerabilities more than 20 years old....
GreyNoise announced a company blog to complement its existing Twitter and social media communications, which the company said limited it to brief pulses of information. Founded in 2017, GreyNoise operates a network of passive collector sensors in hundreds...
GreyNoise Labs hosted the NoiseFest 2023 CTF, which drew 280 participants and used industry-standard PCAP files built from roughly 25 CVE-related tags, deliberately without any GreyNoise tooling. Winners were contacted for swag and trophies for the top...
GreyNoise was named the Most Innovative Security Solution of 2021 by the Tech Ascension Awards, selected from a pool of more than 500 applicants on criteria including technology innovation, market research, and unique competitive differentiators. CEO and...
GreyNoise announced a production contract with the U.S. Department of Defense carrying a $30M USD ceiling, following an earlier 2021 prototype with the DoD's Defense Innovation Unit to help diagnose internet-wide scan-and-attack activity. The contract lets...
GreyNoise announced partnerships with the Defense Innovation Unit of the US Department of Defense and with In-Q-Tel, aimed at speeding its product to DoD customers and fast-tracking features that address customer problems. The company said it passively...
For April Fools, the GreyNoise team built GhostieBot, described as an "Artificial Unintelligence" bot that serves "all the answers you didn't need." The team crowdsourced joke responses on a Notion page, built a standard chat interface from Figma mockups...
GreyNoise describes a design process that starts with user needs and feedback, incorporating security logging, monitoring, alerting, and response capabilities into its systems before incidents occur. The company says its interfaces are streamlined, its...
GreyNoise released a new integration for Microsoft Sentinel that feeds its internet-wide scanning and reconnaissance data into Sentinel's threat intelligence platform. The integration lets analysts use GreyNoise indicators in threat-hunting queries and...