Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
A critical zero-day vulnerability in Atlassian's Confluence Data Center and Server, tracked as CVE-2023-22515 and scored CVSS 10 out of 10, allows external attackers to create administrator accounts and access Confluence instances. Atlassian rates it...
GreyNoise, working with partner Trinity Cyber, published a new tag for scan traffic tied to CVE-2023-1389, a pre-auth command injection weakness in TP-Link Archer routers, and reports no successful injection detected to date. Tenable originally identified...
Citrix ShareFile's Storage Zones Controller, a .NET web application running under IIS, carries CVE-2023-24489, a cryptographic bug in its handling of AES encryption with CBC mode and PKCS7 padding that fails to correctly validate decrypted data, allowing...
GreyNoise's Storm⚡Watch published an async edition for May 7, 2024, while half its crew was out at RSA, and cited the FBI IC3 2023 report showing over 2,825 ransomware complaints, an 18% increase from 2022, with reported losses up 74% from $34.3 million to...
GreyNoise released detection tags for three vulnerabilities: Citrix ADC/NetScaler CVE-2023-3519, an unauthenticated RCE affecting several versions of Citrix ADC and Citrix Gateway; Adobe ColdFusion CVE-2023-29298, an improper access control flaw (CVSS 7.5)...
Atlassian released a security advisory on 2-Jun-22 for CVE-2022-26134, an unauthenticated remote code execution vulnerability affecting all supported versions of Confluence Server and Data Center, which Volexity discovered over the Memorial Day weekend...
GreyNoise is investigating claims of multiple zero-day vulnerabilities in Microsoft Exchange Server, nicknamed ProxyNotShell, tracked as CVE-2022-41040 and CVE-2022-41082 and also by ZDI as ZDI-CAN-18333 and ZDI-CAN-18802. Microsoft said CVE-2022-41040...
Panther Labs and GreyNoise Intelligence have partnered to give all Panther customers out-of-the-box GreyNoise data enrichment inside the Panther security intelligence platform, letting teams suppress alerts on internet background noise and flag known bad...
GreyNoise says its sensor network analyzed almost 3 million IP addresses opportunistically scanning the internet over 90 days, with only 10,000 identified as malicious and the majority benign or unknown. The company reports its Community version grew to...
In a GreyNoise video session, independent security researcher Aaron DeVera described building an edge service that queries GreyNoise for a benign, malicious, or unknown classification on each request, with the API lookup adding latency of under 400...
GreyNoise launched Sift, an application that applies AI/ML to the daily stream of HTTP payload data collected by its global sensor fleet, which sees roughly two million HTTP requests and tens of millions of events from other protocols every day. Sift...
Apache filed a JIRA issue on December 5, 2021 identifying the Log4j flaw later designated CVE-2021-44228, released a patch the next day crediting Chen Zhaojun of Alibaba Cloud Security Team, and weaponized proof-of-concept exploits appeared by December 9....
GreyNoise says more than 2,000 remotely exploitable, no-authentication CVEs were published in the first six months of 2024, increasingly on edge devices with few mitigating controls. The company is launching GreyNoise for Vulnerability Prioritization,...
GreyNoise added detection tag coverage on October 23, 2023 for CVE-2023-4966, an information disclosure flaw in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated attacker hijack an existing authenticated session when the device is...
Apache disclosed CVE-2021-41773 on October 4th, 2021, a path traversal flaw introduced in HTTP Server 2.4.49 and patched in 2.4.50 that lets crafted requests read files outside the document root, including configuration files and CGI scripts, and achieve...
GreyNoise published an integration with IBM Resilient's Incident Response Platform that performs IP analysis to categorize IP addresses and filter out those that are noise. The integration includes a single function, workflow and rule for IP artifact...
GreyNoise Intelligence launched a partner program with three components: a Technical Alliance Program, an OEM Partnership Program, and a Channel Resale Program, aimed at defending customers against mass exploitation attacks. The company says customers use...
GreyNoise Intelligence added Bob Rudis as Vice President of Data Science and Paul Murphy as Vice President of Sales, following its Series A funding. Rudis, a co-author of Data-Driven Security and former senior cybersecurity data science lead at Rapid7,...
GreyNoise Intelligence received a Gold Award in the 19th Annual 2023 Globee Cybersecurity Awards as the best solution for Vulnerability Assessment & Penetration Testing, its seventh cybersecurity accolade in the past twelve months. The company collects,...
GreyNoise announced it earned six industry awards in 2022, attributed largely to its Investigate 4.0 threat intelligence product released in March 2022. Investigate 4.0 provides context on the behavior and intent of IP addresses scanning the internet so...
GreyNoise Intelligence opened registration for its "Stop Chasing Ghosts" Road Show, a half-day workshop to be held in six U.S. cities in October 2022. The company said the series is meant to help security teams identify threats quickly, prioritize alerts,...
GreyNoise Intelligence, founded by Andrew Morris, announced a $600K seed financing led by Inner Loop Capital and StoneMill Ventures, with participation from Paladin Capital Group and angel investors including Oliver Friedrichs, Bryson Bort and Pedram...
GreyNoise founder and CEO Andrew Morris, in an October 2021 SANS CyberSolutions Fest session, described a SOC overwhelmed by alert volume and an internet so noisy that analysts cannot tell which 'bad' to focus on. He cited Apache CVE-2021-41773, where...
GreyNoise describes how its internet-wide sensor network passively collects packets from hundreds of thousands of IPs seen scanning the internet every day, then enriches that data to identify behavior, methods, and intent. The company says this lets threat...
In this sponsored Risky Business podcast segment, GreyNoise founder Andrew Morris described how his company runs passive collector sensors in hundreds of data centers to identify internet-wide scan, crawl and attack traffic so SOC teams can deprioritize...
In this sponsored Risky Biz Soap Box episode, GreyNoise founder and CEO Andrew Morris describes how mass scanning has shifted from incrementing IPv4 addresses and blasting SYN packets to starting with domain lists, because shared CDN hosts mean one IP can...
GreyNoise's Storm Watch episode discusses the Ballista botnet, first detected on January 10, 2025, which exploits CVE-2023-1389 to target TP-Link Archer routers and has infected over 6,000 devices worldwide, with activity observed in mid-February. The...
GreyNoise Intelligence announced on March 20, 2025 that its GreyNoise for Vulnerability Prioritization solution won three 2025 Globee Cybersecurity Awards, taking gold in Deception Technology, Risk & Vulnerability Assessment, and Threat Hunting, Detection,...
GreyNoise says the widely reported 'attack' on OpenAI was actually an SSRF vulnerability in a third-party wrapper calling OpenAI's API, which is being actively exploited, not a flaw in OpenAI's core infrastructure. The episode also covers CVE-2025-23120, a...
This episode of GreyNoise's Storm Watch podcast covers the Zhexi Oray Tunnel backdoor disclosed in the Unitree Go1 consumer-grade robot dog, along with the FamousSparrow threat actor's SparrowDoor malware. It also notes Broadcom's VMware licensing changes...