← Feed

Posts

• View post

  A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24. 🔗 Full analysis: https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

• View post

  This week adversaries escalated attempts against flaws whose patches have been available for years. Adversaries escalated attempts against a known exploited Spring Cloud Function code execution flaw and an Elastic Kibana file inclusion flaw from single digits to several hundred daily sources on one day, and neither had come back down when collection closed. A Sophos Firewall authentication bypass this series recorded as subsided in April came back at roughly sixty times the prior period's d...

• View post

  This week in GreyNoise data, rented crawlers probed for credentials and configuration secrets across widely deployed web software. A matched pair of crawlers sharing one client fingerprint probed NGINX UI (CVE-2026-27944) and LiteSpeed Cache (CVE-2024-44000), two CVSS 9.8 flaws that leak credentials, private keys, or session material, from two different hosting providers. Alongside them, an RDP brute force cohort spread across three networks under one transport fingerprint. WordPress core SQL...

• View post

  The June NoiseLetter is live! In this edition, we're diving into GreyNoise use cases, sharing the latest product releases, and getting ready for our biggest event of the year, NoiseFest. 🔗 https://www.greynoise.io/resources/noiseletter-june-2026

• View post

  Introducing Project Swarm: a research initiative to defend the network edge and we're inviting you to join. Deploy a sensor on your infrastructure, capture real attacker traffic + compare what's hitting you to the GreyNoise global baseline. Join today! 🐝

• View post

  We're so back, after taking last month off, we are refreshed + ready for April's GreyNoise University LIVE!! 📺 Tune in TOMORROW at 12 ET! https://www.greynoise.io/events/greynoise-university-live

• View post

  Today's the perfect day for a matinee double feature: GreyNoise University LIVE: https://www.greynoise.io/events/greynoise-university-live The Invisible Army: What 4 Billion Sessions Reveal About Residential Proxy Abuse Webinar: https://info.greynoise.io/webinar/invisible-army?_ga=2.231440415.1063083880.1777487534-981227823.1753375781

• View post

  May the 4th be with you + so be the signal. 🚀 The April Noiseletter is live: Project Swarm is open to the global security community, new research drops, and a packed events calendar. Let's get into it. 👇 https://www.greynoise.io/resources/noiseletter-april-2026

• View post

  The mission: make sure no attack works twice. 🚀 We're hiring a Detection Engineer and a Federal Customer Success Manager to help us get there. Remote-friendly, high-impact, great benefits. Sound like you? 👇 https://www.greynoise.io/careers

• View post

  A scanning pattern similar to the one preceding CVE-2026-0400 in February is active again. May 12 saw the largest single-day session volume on this SonicWall tag in 90 days. 🔗 https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400 #GreyNoise #ThreatIntel #SonicWall

• View post

  Your blocklist is probably missing 98% of what's actively hitting your edge right now. We tested 11 major feeds against 119,842 malicious IPs GreyNoise observed on a single day. The best feed covered less than 5%. Most were under 2%. The feeds aren't broken. Attacker infrastructure just rotates faster than static curation can keep up with. Read the full breakdown: https://www.greynoise.io/blog/why-your-blocklist-missing-malicious-ips

• View post

  Got questions? We've got answers. Tune in tomorrow at 12 ET for GreyNoise University LIVE! 📺 https://www.greynoise.io/events/greynoise-university-live

• View post

  GreyNoise At The Edge (May 19–26, 2026): a week of rented-infrastructure reconnaissance against the internet's edge — routers, VPN gateways, container planes, and embedded devices, probed in parallel. 1. A long-running MikroTik RouterOS brute-force operation (VPSVAULT, AS215925) reversed a multi-week decline, adding a second node and climbing back to ~1.9M sessions against TCP/8728. 2. A fingerprinted Netherlands cluster cataloged Fortinet, Ivanti, Pulse Secure, Sophos, and F5 applianc...

• View post

  The May NoiseLetter is live! Early warning signals, blocklist gaps, and a SonicWall spike that echoes the pattern that preceded a CVE: https://www.greynoise.io/resources/noiseletter-may-2026

• View post

  Less noise. Better signal. Faster response. We break down 4 ways GreyNoise helps SOC teams cut through internet background noise and focus on what actually matters: https://www.greynoise.io/blog/ways-greynoise-improves-soc-outcomes

• View post

  NoiseFest is BACK 🎉 We're throwing our 4th annual party during Black Hat / DEF CON 2026 with a 60s and 70s theme 🏵️🎸✌️. Cold drinks, new connections, and stories from the front lines of cybersecurity at House of Blues B-Side in Las Vegas. 🔗RSVP: https://info.greynoise.io/events/blackhat-noisefest-2026 #BlackHat #DEFCON #NoiseFest #GreyNoise #cybersecurity

• View post

  GreyNoise At The Edge Intel Brief | June 1-8, 2026 This week's story: credential attacks on the front door of remote access, not new vulnerabilities. 🔗 https://www.greynoise.io/resources/at-the-edge-clear-060826 1. A single Netherlands host (94.102.49.82, malicious) produced more than a quarter of all RDP crawling we observed — a 48-hour burst across a wide port range, then silence. 2. Every major SSL VPN vendor — Fortinet, Cisco, SonicWall, and Palo Alto — drew sustained credential b...

• View post

  We're in London tomorrow for @crowdstrike #CrowdTour2026. If you're attending our team would love to connect! Schedule some time to meet with us: https://info.greynoise.io/crowdtour-2026-meet #CyberSecurity #GreyNoise #ThreatIntel

• View post

  Three things that caught our eye at the edge this week: - One host mapped the enterprise edge. - A pair ran a Hikvision camera RCE (CISA KEV) on shared tooling. - VPN logins stayed under steady pressure. Defend on behavior, not IPs. This week's At The Edge Clear👉 https://www.greynoise.io/resources/at-the-edge-clear-061526 #ThreatIntelligence #CyberSecurity #GreyNoise #InfoSec

• View post

  Four things that caught our eye at the edge this week: Following the FortiBleed reporting, GreyNoise is providing telemetry on the same Fortinet surfaces, without attributing the activity; the SSL VPN brute-force we track stood down in early June. Cisco SSL VPN brute-force sources surged to 3,645 in a day. A German source kept harvesting Laravel and TeleMessage secrets. Hikvision targeting broadened. MFA on every VPN edge. Defend on behavior, not IPs. This week's At The Edge 👉 https:/...

• View post

  NoiseFest is just a few weeks away!🎉 If you're in Las Vegas for #BlackHat or #DEFCON, come join us for a night of cold drinks, good company, and 60s and 70s vibes. 🏵️ 📅Thursday, August 6th | 6–9 PM PT | Las Vegas 🔗RSVP: https://info.greynoise.io/events/blackhat-noisefest-2026 #NoiseFest #GreyNoise #cybersecurity

• View post

  The Threat Brief Library is now live in the GreyNoise Visualizer! Browse, search, filter, and download weekly At The Edge briefs, Executive Situation Reports, and more. All built on primary-source data from our global sensor network. Check it out: https://www.greynoise.io/blog/threat-brief-library

• View post

  Press Release: https://www.prweb.com/releases/greynoise-intelligence-introduces-c2-detection-to-close-the-visibility-gap-at-the-edge-of-the-network-302734388.html

• View post

  This week a long-dormant Palo Alto flaw came back to life in GreyNoise data. GlobalProtect CVE-2019-1579 (unauth RCE, CISA KEV) drew only isolated activity through late June, then more than 120 malicious hosts probed it on 06 July, almost all from a single hosting network. Separately, two coordinated hosting fleets ran the week's highest-volume web exploitation, roughly 7.5M connection attempts. Access our public preview At The Edge Clear: https://www.greynoise.io/resources/at-the-edge-cle...

• View post

  GreyNoise is proud to be sponsoring the CrowdStrike CrowdTour across 8 cities! We’re excited to highlight how our integration with Falcon Next-Gen SIEM helps SOC teams stop chasing ghosts and start catching real threats. If you’re attending a tour stop or local to the area, let’s connect to chat about: - Validating your perimeter in real time. - Protecting the identity layer from brute-force scanners. - Filtering out background noise to focus on high-fidelity alerts. 👇Book a meeting with us he...

• View post

  NEW: GreyNoise At The Edge Intel Brief (March 23-30) 187,998,900 sessions from 100 top source IPs observed by GreyNoise sensors between March 23-30, 2026. Daily volumes surged 4x mid-week — from 8.5M to 36.6M in 72 hours. 1. VPSVAULT IoT botnet recruitment across 22 CVEs — 3,347,443 sessions from 4 Brazilian IPs targeting Hikvision, MikroTik, TP-Link, D-Link devices. Includes CVE-2026-24061, now on CISA KEV. 2. VisionHeight fleet of 6 AWS IPs generated 5,892,055 sessions mapping enterprise pe...

• View post

  New GreyNoise Report: 39% of unique IPs targeting the edge come from home internet connections. They are everywhere, briefly — 78% appear at most twice before rotating. The rotation rate makes feed-based IP reputation structurally ineffective against this traffic. 🔗 https://www.greynoise.io/resources/invisible-army-residential-proxy-abuse-report

• View post

  GreyNoise is on the move 🌍 Next up: CrowdTours (8 cities), Glasgow + Tampa It’s all in the March Noiseletter 🗞️ + fresh research (more coming soon 👀) https://www.greynoise.io/resources/noiseletter-march-2026

• View post

  21 IPs generated nearly half of all RDP scanning on the internet in 48 hours. Then vanished — for the second time in 30 days. 🔗 https://www.greynoise.io/blog/ip-addresses-behind-nearly-half-rdp-internet-scanning #ThreatIntel #RDP #CyberSecurity #InfoSec #ThreatHunting

• View post

  200,886,675 sessions. 101 unique source IPs. March 16–23, 2026. GreyNoise At The Edge intelligence brief highlights: 1. The MEVSPACE RDP brute-force operator returned after a 99.8% infrastructure collapse — single IP generated 7,975,241 sessions before deliberately withdrawing after 4 days. GreyNoise has tracked a surge-withdraw-reconstitute cycle since January 2026, reinforcing that well-resourced operators can reconstitute capacity within days. 2. Two coordinated campaigns emerged: VPSVAULT...