Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
On September 21, 2021, VMware published an advisory for several vulnerabilities, most notably CVE-2021-22005, an arbitrary file upload flaw in vCenter Server that can lead to remote code execution regardless of the product's configuration settings. As of...
Security researcher Orange Tsai demonstrated a proof-of-concept exploit at BlackHat 2021 for Microsoft Exchange vulnerabilities including a Pre-auth Path Confusion leading to ACL bypass tracked as CVE-2021-34473, also called ProxyShell. GreyNoise observed...
GreyNoise and Panther Labs announced a collaboration in which GreyNoise filters out false or irrelevant threat data and Panther prioritizes the remaining alerts into low, medium, high, and critical levels. The article cites 50 new CVEs per day on average...
Panther and GreyNoise have partnered to provide all Panther customers with a free, out-of-the-box integration that enriches every alert with GreyNoise IP data classifying each address as benign, malicious, or unknown. GreyNoise reports that customers using...
Kasada and GreyNoise announced a partnership in which GreyNoise enriches its IP scan and attack data with Kasada's intelligence on persistent bot traffic, available to security organizations and the public for free. Kasada, which says it sees billions of...
GreyNoise Intelligence published its second annual retrospective, "Decoding 2023: A GreyNoise Retrospective on Internet Exploitation," on January 17, 2024, drawing on a network of more than 3,100 sensors across over 200 countries. The company reported 17.3...
GreyNoise published the second session of a three-part webinar series on its detection engineering, dated January 17, 2024, covering how a tag is built. The session walks through building a benign actor tag, detection engineering a malicious CVE into a...
GreyNoise published the first session of a three-part webinar series, dated January 10, 2024, covering what its "tags" are, how they compare to traditional detections, and a survey of its tag ecosystem split into Benign, Malicious, and Unknown. The series...
GreyNoise published the third session of its three-part webinar series, "Tags 301: GreyNoise Detection Engineering AI: Leave No Interaction Untagged," on January 24, 2024. The session covers using language models and AI to tag every interaction, the...
GreyNoise announced a webinar on integrating its tool into SOAR playbooks, aimed at helping teams make informed decisions, streamline automation, and reduce time spent on incident investigations. The session skips any general overview of GreyNoise and goes...
GreyNoise released an MCP Server that lets Model Context Protocol-compatible AI agents query its threat intelligence in real time when they encounter an IP address or CVE in a workflow. The company says this grounding reduces hallucination risk and stops...
GreyNoise Intelligence announced on September 18, 2025 the GreyNoise Model Context Protocol (MCP) Server, which lets MCP-compatible LLMs and agents query GreyNoise APIs directly for real-time threat intelligence. Through MCP, agents can query GreyNoise to...
GreyNoise's Trends feature shows how many hits its sensor network has recorded for any of its Tags at hourly and daily granularity, with each Tag page carrying a timeline, associated CVE information, and related resources. The company classifies a tag as...
GreyNoise observed nearly 24,000 unique IP addresses attempting login scans against Palo Alto Networks PAN-OS GlobalProtect portals over 30 days, with 20,010 of them tied to 3xK Tech GmbH under ASN200373. GreyNoise's Bob Rudis said the pattern of targeting...
GreyNoise observed scanning of MOVEit Transfer systems jump from fewer than 10 IPs per day to over 100 on May 27, 2025, then 319 on May 28, with daily volume staying intermittently between 200 and 300 IPs afterward. Low-volume exploitation attempts on June...
On August 21, GreyNoise observed nearly 2,000 IPs, most previously tagged as malicious, simultaneously probing Microsoft RD Web Access and Microsoft RDP Web Client authentication portals to test for timing flaws that reveal valid usernames. GreyNoise later...
On April 18, 2025, GreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure and Pulse Secure VPN systems, with 234 unique IPs probing endpoints against a usual daily baseline of fewer than 30. GreyNoise reports 1,004...
GreyNoise observed exploitation attempts against TVT NVMS9000 DVRs at three times typical activity, beginning March 31, 2025 and peaking on April 3 at over 2,500 unique IPs, with more than 6,600 IPs attempting exploitation in the past 30 days. GreyNoise...
GreyNoise observed a significant increase in crawling activity targeting Git configuration files on April 20-21, 2025, with nearly 4,800 unique IP addresses daily, marking the largest of four spikes since September 2024. The traffic was globally...
GreyNoise observed more than 25,000 unique IPs scanning Cisco ASA devices in a single late-August burst, against a baseline of under 500 IPs per day, with a smaller related surge days later. Cisco then disclosed two zero-day vulnerabilities, CVE-2025-20333...
GreyNoise reports a rapid increase in exploit attempts over the past 10 days against two vulnerabilities: CVE-2022-47945, a local file inclusion flaw in ThinkPHP, and CVE-2023-49103, a flaw in ownCloud's GraphAPI. Only one of the two is included in the KEV...
Nokia Deepfield's Emergency Response Team identified a botnet tracked as Eleven11bot that it estimated has compromised over 30,000 devices, primarily security cameras and NVRs, and has been used in DDoS attacks against telecom providers and gaming...
Two critical Ivanti zero-days, CVE-2025-4427 and CVE-2025-4428, are now being actively exploited, chained together to enable unauthenticated remote code execution on Ivanti Endpoint Manager Mobile systems. The flaws target the /api/v2/featureusage and...
GreyNoise launched Feeds, an event-driven webhook push system that delivers notifications the moment GreyNoise sees a change, replacing the polling workflows where analysts or automated systems query APIs and dashboards on fixed schedules of minutes to...
GreyNoise reports a resurgence of in-the-wild activity against three ServiceNow vulnerabilities, with attacker interest in all three in the past 24 hours and the highest number of unique IPs targeting them in the past month. Over 70% of sessions in the...
GreyNoise reported in-the-wild activity against several known vulnerabilities in DrayTek routers, following reports of widespread reboots affecting those devices globally. GreyNoise said it cannot confirm a direct connection between the observed activity...
GreyNoise observed a significant spike in activity targeting multiple edge technologies on March 28, including SonicWall, Zoho, Zyxel, F5, Linksys, and Ivanti systems, with some of these being edge systems and others primarily internal management tools. On...
On March 3, 2025, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. GreyNoise reports it had visibility into these vulnerabilities, including Hitachi Vantara Pentaho BA Server and Progress...
GreyNoise reports it has confirmed active exploitation attempts against CVE-2025-0108, a high-severity authentication bypass in Palo Alto Networks PAN-OS that lets unauthenticated attackers execute specific PHP scripts and potentially gain unauthorized...
GreyNoise's global observation grid detected malicious exploitation attempts against two Cisco vulnerabilities that were referenced in recent reports on Salt Typhoon, the Chinese state-sponsored espionage group targeting Cisco devices. Between December...