Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
A leak of internal chat logs from the Black Basta ransomware group revealed 62 CVEs the group discussed, a list first compiled by VulnCheck. GreyNoise analyzed internet-wide exploitation activity for those vulnerabilities and found 23 of the 62 were...
GreyNoise observed exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler, beginning June 23 - nearly two weeks before a public proof-of-concept was released on July 4. Early attempts came from...
On June 16, GreyNoise observed a concentrated burst of exploit attempts against CVE-2023-28771, a remote code execution vulnerability in Zyxel IKE packet decoders over UDP port 500, with 244 unique IPs attempting exploitation. All 244 IPs are registered to...
On 28 September 2025, GreyNoise recorded a one-day surge of exploitation attempts against CVE-2021-43798, a Grafana path traversal flaw that allows arbitrary file reads, with 110 unique IPs hitting its Global Observation Grid. All 110 IPs were classified...
On May 8, GreyNoise observed 251 malicious IP addresses geolocated to Japan and hosted on Amazon AWS trigger 75 distinct scanning behaviors in a single day, ranging from exploitation attempts for known CVEs to probes for misconfigurations and weak points...
GreyNoise observed a coordinated spike in malicious activity against Apache Tomcat Manager interfaces on June 5, 2025, with its Tomcat Manager Brute Force Attempt and Tomcat Manager Login Attempt tags registering well above baseline volumes. Roughly 400...
GreyNoise analyzed CVEs linked to Silk Typhoon and found three of them actively exploited in the past 24 hours, confirmed by its Global Observation Grid. The source states that a heatmap shows activity over the past 45 days and that the accompanying data...
GreyNoise is observing active exploitation attempts against a zero-day critical command injection vulnerability in Zyxel CPE Series devices tracked as CVE-2024-40891, which is unpatched and not publicly disclosed. The telnet-based flaw lets unauthenticated...
GreyNoise reports active exploitation of CVE-2025-24813, a newly disclosed Apache Tomcat vulnerability that could enable remote code execution, with four unique IPs attempting exploits since March 17, 2025, using a partial PUT method to inject malicious...
GreyNoise launched an MCP Server that lets AI agents query its threat intelligence in real time to distinguish benign scanners from actual threats. The company says the tool supports alert triage, vulnerability prioritization, and incident response, and...
A GreyNoise white paper argues that embedded threat intelligence in firewalls, SIEMs, and endpoint tools gives only generic coverage and often misses emerging threats and industry-specific campaigns. It cites CISA data that a majority of the top exploited...
GreyNoise published a case study on detecting exploitation of Cisco IOS XE, describing enhancements to its sensor technology intended to deliver threat intelligence faster. The provided text contains no further specifics on the exploitation activity, the...
GreyNoise's September 2024 NoiseLetter recaps the company's LabsCon and BSides appearances and points to blog posts on election security, state-sponsored actors, and what it calls a mysterious internet noise storm. It also announces recent launches,...
GreyNoise's October 2024 NoiseLetter highlights a blog on a multi-year APT campaign that exploited network perimeter devices to infiltrate high-value targets. It also announces GreyNoise's discovery of previously undisclosed zero-day vulnerabilities in...
GreyNoise published its November 2024 NoiseLetter, announcing a significant upgrade to its platform's sensor and data pipeline technology that it says adds advanced capabilities for visibility and threat intelligence. The newsletter also notes that VP of...
GreyNoise reports a stealthy backdoor campaign affecting thousands of ASUS routers, in which attackers gained persistent access that survived reboots and firmware updates by abusing legitimate configuration features, first observed March 18, 2025. The same...
GreyNoise published its March 2024 NoiseLetter, a roundup of the month's events, webinars, and updates from its labs team. The newsletter states that GreyNoise Labs released 43 new tags during March and includes commentary from founder Andrew...
GreyNoise's June 2025 NoiseLetter announces Early Access for Feeds, a real-time capability that turns packets hitting its sensors into actionable data in under 30 seconds, flagging when a CVE moves from observed to actively exploited in the wild or an IP...
GreyNoise published a report titled Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities, which states that in 80% of cases studied, attackers struck before a vulnerability was made public, with spikes in malicious activity often...
GreyNoise's July 2024 NoiseLetter announces a new Vulnerability Intelligence Solution that uses real-time in-the-wild exploitation data to help teams judge which vulnerabilities are truly urgent. The newsletter also notes a new website, upcoming...
GreyNoise confirmed on 2025-01-29 that some Mirai variants now exploit CVE-2024-40891, a critical zero-day command injection flaw in Zyxel CPE devices that allows attackers to execute arbitrary commands and fully compromise the system. The vulnerability is...
GreyNoise's February 2025 NoiseLetter reports active exploitation of PAN-OS CVE-2025-0108, a surge in ThinkPHP and ownCloud attacks, and new findings on Cisco vulnerabilities tied to Salt Typhoon. The newsletter's Mass Exploitation Report covers which CVEs...
GreyNoise Intelligence announced the appointment of Ash Devata as its new CEO, with founder Andrew Morris moving to the role of Chief Architect. The company's labs team also released 33 new tags during February. What's compelling: A change at the top of a...
GreyNoise's August 2025 NoiseLetter recaps the company's presence at BlackHat and DEF CON in Las Vegas and promotes a September 9 webinar at 12 PM ET with VP of Data Science Bob Rudis and Head of Content Noah Stone on its report, Early Warning Signals:...
GreyNoise's August 2024 NoiseLetter recaps the company's activity following BlackHat, DefCon, and its own NoiseFest event. The newsletter lists recent releases including a Vulnerability Prioritization solution, Project Plasma for honeypot deployment and...
GreyNoise's April 2025 NoiseLetter describes attackers exploiting "resurgent vulnerabilities" - older flaws that were deprioritized years ago or never seen as serious, now being opportunistically exploited at scale rather than as zero-days. The newsletter...
GreyNoise's labs team released a record-breaking 83 new tags in April, a month the company describes as spanning activity from Palo Alto PAN OS to D-Link NAS RCE. The company also said it will activate a preview of its Edge Intelligence sensors for all...
GreyNoise's April 2023 NoiseLetter announces that Glenn Thorpe has joined the company as Sr. Director heading up Security Research and Detection Engineering, bringing 20+ years of experience as a defender, a leader in managed security services, and...
GreyNoise Labs analysed 30 days of sensor data ending February 28, 2024, and observed 36,383 malicious exploitation attempts against IP address space allocated to the United Arab Emirates, alongside 2,666 attacks from UAE networks directed at other...
GreyNoise Labs analysed 30 days of October 2023 traffic from its global sensor network and observed 125,362 malicious exploitation attempts against The Netherlands' IP address space, plus 5,207 attacks originating from The Netherlands against other...