16 casos · pág. 1/1
Between May 9 and May 18, 2026, GreyNoise observed a major spike in scanning of SonicWall SonicOS management interfaces. The May 12 peak of about 597,000 sessions was the largest single-day total on the SonicWall SonicOS API Scanner tag in 90 days, roughly 46x the typical daily volume. Earlier spikes on this tag (January 18, January 30 an…
F5 Labs, using Efflux sensor telemetry, found that HTTP requests hitting its sensors rose from 5,125,557 in 2023 to 8,727,820 in 2024 (about 71%, or nearly 95% once normalized for sensor count). Most of the increase came from the BotPoke scanner, which looks for filenames associated with malware distribution sites. It was active mainly in…
GreyNoise announced Project Swarm, a research initiative that opens its deception platform, the Global Observation Grid (5,000+ sensors in 80 countries, 500M+ sessions per day), to outside contributors. The stated aim is better visibility into attacks on network edge devices (firewalls, VPN gateways, routers, load balancers). These device…
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a …
GreyNoise reports that 21 IP addresses in AS213438 (registered to ColocaTel Inc., Mahe, Seychelles) produced 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026, or 67.4% of the worldwide total. Over April 5-7 the same fleet accounted for 49.7% of global RDP Crawler activity. All 21 IPs are geolocated to the Netherlands, w…
GreyNoise analyzed 4 billion sessions targeting edge infrastructure over 90 days and concluded that IP reputation feeds are structurally ineffective against residential proxy traffic. Attackers route scanning and reconnaissance through compromised home broadband, mobile and small-business connections, so source IPs look like legitimate us…
GreyNoise observed automated scanners impersonating the web crawlers of OpenAI, Anthropic, Google, Perplexity, DeepSeek and Amazon while requesting environment files, cloud access keys, private keys and password stores. A cluster of 13 forged AI crawler names from eight companies was seen; six names (belonging to Anthropic, OpenAI, Google…
A joint advisory (AA26-194a) from NSA, CISA, FBI, DC3 and 15 allied agencies warns that Russian FSB Center 16 cyber actors continue to opportunistically compromise poorly configured and vulnerable networking devices worldwide, primarily routers. The advisory builds on the FBI's August 2025 PSA on the decade-plus campaign and adds TTPs. Go…
F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes…
Recorded Future's Insikt Group (report of October 16) tracks a suspected Chinese-speaking actor, TAG-217, linked to attacks on South Korean financial institutions. The actor used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an open-source Chinese-language AI penetration testing framework. Public reporting cited in the investi…
In late August 2026, Sekoia's TDR team observed an attacker compromise an unauthenticated Flowise honeypot (emulating v2.2.8). The attacker harvested stored credentials, tried to plant a malicious chatflow with a callback to 154.217.251.226, and used prompt injection to turn the LLM agent into an offensive analysis assistant. The activity…
GreyNoise reports that on 14 May 2026 its Global Observation Grid recorded 119,842 malicious, non-spoofable IPs targeting edge infrastructure. Compared against eleven widely used OSINT and commercial feeds, average coverage was 2.0%, and no single feed exceeded 5%. Even the largest list (Avastel, about 500,000 IPs) caught under 2%, and ve…
The NSA, CISA, FBI, DOE and EPA issued a joint advisory (AA26-231A) warning of an active threat to Siemens S7 Series PLCs in U.S. critical infrastructure. Unattributed threat actors are conducting reconnaissance and capability development against U.S.-based installations using AI-generated exploitation scripts disguised as legitimate OT m…
F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (8). Scanning is i…
Unit 42 investigated a months-long intrusion against a European bank, which began with unauthorized VPN-based access through a third-party-managed external gateway appliance that did not enforce strict authentication. Using compromised credentials, the attacker ran noisy, high-volume internal reconnaissance and brute-force campaigns again…
ESET's WeLiveSecurity warns that AI and large language models (LLMs) now automate OSINT reconnaissance at machine speed. Profiling that once took a skilled attacker hours or days can be done by low-skill actors, so ordinary internet users are now economically viable fraud targets. Fraudsters can collect public information at scale, includ…
