Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
A critical CrushFTP auth bypass flaw that emerged in March 2025 received two separate CVE identifiers, CVE-2025-2825 and CVE-2025-31161, assigned by competing firms VulnCheck and Outpost24, while Shadowserver initially tracked over 1,800 vulnerable...
GreyNoise reports a threefold surge in exploitation attempts targeting TVT DVRs, likely tied to Mirai botnet activity, and cites Censys research on the Salt Typhoon attacks exploiting edge devices and cloud infrastructure. The episode also covers reports...
GreyNoise published a community testimonials page collecting quotes from customers and social media users praising its ability to filter out noisy, low-priority and false-positive alerts from mass internet scanners. The page includes anonymous quotes from...
GreyNoise Intelligence introduced its Global Observation Grid on April 21, 2025, a sensor network of 5,000 sensors in 80 countries that processes half a billion sessions per day. The company says unsolicited internet scanning rose exponentially from 2022...
This GreyNoise podcast episode describes a fragmenting vulnerability tracking landscape: the MITRE-run CVE program faces funding uncertainty and a possible move to nonprofit status, ENISA is rolling out an EU Vulnerability Database, China runs its own...
GreyNoise Intelligence released a report on April 23, 2025 titled "A Blindspot in Cyber Defense: How Resurgent Vulnerabilities Jeopardize Organizational Security," describing older flaws that are exploited again after extended periods of inactivity. The...
GreyNoise's Storm Watch episode breaks down 2025 threat reports, including the FBI's 2024 IC3 figures of a record $16.6 billion in reported losses, with phishing, extortion, and business email compromise topping the list. VulnCheck's quarterly report found...
GreyNoise Intelligence announced on April 29, 2025 that Cyber Defense Magazine's Global Infosec Awards 2025 selected its GreyNoise for Vulnerability Prioritization solution in two categories: Deception-based Security and Vulnerability Intelligence. The...
A China-aligned APT group called TheWizards is using a tool called Spellbinder to abuse IPv6 stateless address autoconfiguration for adversary-in-the-middle attacks, hijacking software update mechanisms for Chinese applications such as Sogou Pinyin and...
GreyNoise researchers used their AI-powered traffic analyzer SIFT to sift through more than 23 billion network entries and flag just 30 suspicious payloads in a botnet campaign targeting ASUS routers. The attackers disabled TrendMicro security features on...
Attackers are distributing malware through TikTok using AI-generated videos disguised as software activation tutorials that instruct users to run malicious PowerShell commands, a technique called ClickFix that has drawn nearly half a million views. The...
This episode of GreyNoise's Storm Watch covers allegations that the Trump administration ordered U.S. Cyber Command and CISA to stand down on Russian cyber threats, and financial groups pushing back against CISA's proposed incident reporting rule. It also...
On this GreyNoise Storm Watch episode, the hosts discuss CrowdStrike cutting 5% of its jobs citing AI-driven restructuring, and Duolingo pushing AI into every product and workflow while urging engineers to "start with AI for every task." They also cover...
GreyNoise describes a class of flaws it calls resurgent vulnerabilities: older issues that were deprioritized or never seen as serious, now being opportunistically exploited at scale rather than as zero-days. The activity concentrates on edge technologies...
GreyNoise observed attacker activity against two Mitel MiCollab vulnerabilities, CVE-2024-41713 (authentication bypass) and CVE-2024-35286 (SQL injection), beginning on December 5, the same day proof-of-concept code went public. The authentication bypass...
This episode of GreyNoise Storm Watch reports that the Department of Government Efficiency, led by Elon Musk, accessed sensitive federal systems including Treasury databases and Education Department records through AI-driven analysis, with vendor...
On April 12, 2024, Palo Alto Networks announced CVE-2024-3400, a CVSS 10 arbitrary file-write vulnerability in PAN-OS versions 10.2, 11.0, and 11.1 that lets unauthenticated attackers run arbitrary Linux commands with root privileges on firewalls...
Over 15,000 Fortinet FortiGate firewalls were exposed in a breach tied to CVE-2022-40684, an authentication bypass disclosed in late 2022, and GreyNoise reports hundreds of these devices actively weaponized by attackers. Censys data cited in the post shows...
GreyNoise researchers took up CVE-2022-41140, a buffer overflow and remote code execution flaw in D-Link routers that D-Link was notified of on February 17th, 2022, and by November 15th, 2022 no additional information was available. They decrypted the...
GreyNoise research describes a recurring pattern in which spikes in malicious activity often precede the disclosure of new CVEs, particularly in enterprise edge technologies such as VPNs and firewalls. In 80 percent of the cases studied, attackers hit...
GreyNoise Intelligence released a research report on July 31, 2025, titled "Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities," examining whether spikes in opportunistic attacker activity against edge technologies precede the...
GreyNoise Intelligence announced three new capabilities on July 31, 2025 - Real-time Dynamic Blocklists, new GreyNoise feeds, and SOAR integrations - aimed at helping security teams detect, block and respond faster to automated attacks. The company cites...
On August 3, GreyNoise observed a spike in brute-force traffic against Fortinet SSL VPNs, with over 780 unique IPs triggering its Fortinet SSL VPN Bruteforcer tag in a single day, the highest single-day volume on that tag in recent months. GreyNoise...
This episode of Storm⚡️Watch covers security researcher David Schuetz's investigation into the mysterious 'Noise Storms' of ping packets flooding the internet, detailed at darthnull.org/noisestorms/, involving packet analysis, timestamp decoding, and...
A GreyNoise panel discussion featuring Bob Rudis, Dave Ahn, Jess Parnell, and Brad LaPorte addresses why threat intelligence has failed to deliver on its promise of finding and stopping more threats. The panelists cite too many intelligence feeds to...
GreyNoise announced its Community Open Forum VI, a one-hour virtual townhall scheduled for February 15, 2024 at 1:30pm CT, where the team planned to introduce new community head Sam Houston. The agenda included GreyNoise Labs' boB Rudis reviewing results...
GreyNoise identified exploit activity targeting WatchGuard Firebox and XTM appliances as of February 27, 2022, which WatchGuard confirmed was related to CVE-2022-26318, an unauthenticated remote code execution flaw affecting Fireware OS before 12.7.2_U2,...
Tenable announced a new Research Alliance Program to share vulnerability information before public disclosure, and GreyNoise is an inaugural member. The program aims to reduce the window of opportunity for threat actors seeking to exploit newly discovered...
GreyNoise released version 2.2.0 of its Splunk app, which keeps the last 24 hours of GreyNoise data local to a Splunk instance through feeds so analysts can filter opportunistic and benign IPs without API lookups. The app also supports custom commands that...
GreyNoise detected a sudden increase in malicious Atlassian exploitation attempts late last week after changing how its back-end calculates hourly trending and anomalous events, with Atlassian-related topics occupying seven of the top ten trending tag...