Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
This episode covers a terminated Disney World employee who allegedly hacked into the park's menu system to alter critical peanut allergy information, alongside Sophos research on a multi-year nation-state APT campaign targeting edge devices across the...
This GreyNoise podcast episode features John Althouse, creator of JA4+, a suite of network fingerprinting methods using human-readable formats and enhanced detection capabilities. The episode also covers findings of potential vulnerabilities in around 300...
Russian APT28 breached a U.S. organization's network through a technique dubbed the "Nearest Neighbor Attack," exploiting nearby Wi-Fi networks via password spraying and compromised adjacent organizations, in an operation that occurred just before Russia's...
This episode of GreyNoise's Storm Watch podcast covers a federal indictment for computer hacking in Kansas City and VulnCheck's discovery of CVE-2024-11680, a ProjectSend vulnerability being exploited in the wild. It also cites a community poll in which...
In this GreyNoise Storm⚡️Watch episode, a community poll found Mean Time to Respond drove organizational action most at 43% of votes, followed by Mean Time to Detect at 28% and system patching status at 26%. The episode also covered practical OPSEC...
This episode of GreyNoise's Storm⚡️Watch covers a cybersecurity poll in which end-of-year tech fatigue was the top holiday concern at 38%, followed by increased phishing scams at 34%, holiday staffing gaps at 24%, and supply chain threats at 14%. The show...
Two Chinese state-sponsored incidents hit U.S. infrastructure: the BeyondTrust breach, found in early December 2024, used a compromised Remote Support SaaS API key to reset passwords and reach workstations remotely, touching Treasury's Office of Financial...
The Belsen Group released sensitive configuration data from more than 15,000 FortiGate devices, exposing firewall rules, VPN credentials, and digital certificates, with the leak stemming from a 2022 authentication bypass vulnerability (CVE-2022-40684) and...
Security researcher Philippe Caturegli found a typo in Mastercard's DNS nameserver records, where "akam.net" was written as "akam.ne", a misconfiguration that went undetected for over four years and affected one in five DNS requests to Mastercard's...
On a September 17, 2024 Storm Watch episode, GreyNoise founder and chief architect Andrew Morris described a hidden message buried in the payloads of over two million mis-directed ICMP packets. The episode also covered the history of noise storms as seen...
An Arizona woman, Christian Marie Chapman, faces federal prison time for running a "laptop farm" that let North Korean IT workers pose as U.S.-based employees, an operation that generated over $17 million for North Korea and funneled money to its weapons...
This episode of GreyNoise's Storm Watch podcast covers an interview with Mary N. Chaney, CEO of Minorities in Cybersecurity, on underrepresentation of women and minority leaders in the field and the group's MiC Inclusive Community and MiC Leadership Series...
GreyNoise Intelligence announced a new vulnerability intelligence solution on August 1, 2024, that provides active, In-the-Wild exploitation data to help internal security teams with patch prioritization and emergency response. The company says it is the...
GreyNoise Intelligence released its inaugural 2022 Mass Exploitation Report, covering the most significant threat detection events of the past 12 months. The company added over 230 new detection tags in 2022, an increase of approximately 38% from 2021, and...
GreyNoise Intelligence announced on June 8, 2023 that it achieved SOC 2 Type II compliance, also known as SSAE 18, under AICPA standards for Systems and Organizational Controls, with an unqualified opinion. The audit covers the five trust service...
GreyNoise published a webinar series explaining its tags, which it describes as a signature-based detection method used to identify actors, tools, and CVEs in its data. The company says tags provide contextual understanding of activity observed from a...
GreyNoise's report-season roundup cites Dragos's 2025 OT/ICS Cybersecurity Report, which finds an 87% spike in industrial attacks and names new threat groups GRAPHITE and BAUXITE alongside malware such as Fuxnet and FrostyGoop. It also covers Huntress's...
GreyNoise Intelligence released its third annual "GreyNoise 2025 Mass Internet Exploitation Report" on February 27, 2025, drawing on a network of nearly 4,000 sensors in over 200 countries that track hundreds of millions of events per day. In 2024 the...
GreyNoise's 2025 Mass Internet Exploitation Report states that 40% of exploited CVEs in 2024 were at least four years old, with some dating back to the 1990s. It also reports that attackers target zero-days within hours of disclosure while continuing to...
GreyNoise Intelligence announced on April 9, 2024 that it is participating in the Microsoft Copilot for Security Partner Private Preview, selected for its experience with Microsoft Security technologies and its work with Microsoft product teams. GreyNoise...
GreyNoise built an ROI calculator from a survey of its paying customers, asking about company size, security team structure, investigation volume and average investigation time, plus how often the product helps and how much time it saves. The company says...
GreyNoise's integration with ThreatConnect TIP lets analysts look up IP addresses to check whether they were previously involved in mass automated activity. When an offending IP from a SIEM alert is absent from the GreyNoise dataset, the source says that...
GreyNoise Intelligence announced on October 31, 2024 that its internal LLM, Sift, flagged unrecognized traffic patterns that led researchers to two previously undisclosed zero-day vulnerabilities in live streaming cameras. Tracked as CVE-2024-8956 and...
GreyNoise published a webinar in which resident security expert Nick Roy walks through automated threat hunting, investigating DDoS activity, and enhancing threat intel reports using real GreyNoise data. The session skips any general overview of GreyNoise...
GreyNoise added over 230 new detection tags in 2022 and published its inaugural mass exploitation report covering that year's landscape. The report breaks down the CVE-2022-1388 F5 Big-IP iControl REST authentication bypass, the depth and breadth of...
GreyNoise published its 2023 Internet Exploitation Retrospective Report, which examines three notable 2023 vulnerabilities: Progress MOVEit Transfer, Citrix NetScaler ADC/NetScaler Gateway, and PaperCut MF/NG. The report also cites 290 new GreyNoise tags...
Progress issued a security notice on May 31, 2023, for a MOVEit Transfer vulnerability allowing escalated privileges and potential unauthorized access, assigned CVE-2023-34362 on June 2, 2023. GreyNoise observed scanning of the MOVEit Transfer login page...
GreyNoise released an IP Geo Destination feature, available to all customers through the Visualizer and API endpoints, that shows the destination countries of opportunistic scan traffic observed across its sensor network. Using recent DB2 database scanning...
GreyNoise's May 2023 product update added 24 new tags (20 malicious activity, 3 benign actor, 1 unknown), expanded sensor coverage to Ghana, and improved Bulk Analysis so users can export unidentified IPs via CSV and JSON. The company also added Qualys...
GreyNoise published three tags for Microsoft Message Queuing (MSMQ) activity tied to QueueJumper (CVE-2023-21554), a critical unauthenticated remote code execution flaw patched in April 2023 Patch Tuesday, alongside two unauthenticated remote DoS...