26 casos · pág. 1/2
This GreyNoise blog post is a product-oriented piece describing five workflows the vendor wires into customer SOAR platforms. It reports no incident, vulnerability or threat actor activity. The use cases are automated IP enrichment, early warning of exploitation spikes against vendor CVEs, detection of compromised edge devices, validated …
GreyNoise published a vendor blog post describing four ways SOC teams can use its internet-wide scan and attack classification to improve SIEM detection. The use cases separate opportunistic mass-scanning noise from activity that may be targeted at an organization. The post is product-oriented guidance and does not describe a specific inc…
GreyNoise announced Tactics, a new feature in the GreyNoise Visualizer (Observe → Tactics) that maps attacker sessions captured by GreyNoise Deception Sensors to the MITRE ATT&CK framework. It extends the company's visibility beyond Reconnaissance and Initial Access, following the earlier C2 Detection Module, to show what adversaries do a…
GreyNoise announced the availability of the Intelligence Dashboard in its Visualizer platform. It lets users pin CVEs, tags, countries, IPs and GNQL queries into a persistent, always-current view of scan and attacker traffic observed by its global sensor network. This is a product announcement and does not describe a threat, vulnerability…
GreyNoise has released a redesigned GreyNoise Visualizer with a persistent sidebar organized into three areas: Intelligence (IPs and CVEs), Observation (Deception Sensors) and Automation (alerts, feeds, blocklists). The update is product news and describes no threat, vulnerability or incident. It adds global search (Command + K) across IP…
GreyNoise announced the Threat Brief Library in the GreyNoise Visualizer, a searchable and filterable repository of its threat intelligence briefs, downloadable as PDF. The library holds three report types: the weekly At The Edge brief, event-driven Executive Situation Reports on single campaigns or actively exploited vulnerabilities, and…
Between May 9 and May 18, 2026, GreyNoise observed a major spike in scanning of SonicWall SonicOS management interfaces. The May 12 peak of about 597,000 sessions was the largest single-day total on the SonicWall SonicOS API Scanner tag in 90 days, roughly 46x the typical daily volume. Earlier spikes on this tag (January 18, January 30 an…
GreyNoise announced C2 Detection, a new intelligence module that identifies compromised edge and perimeter devices (routers, firewalls, VPN concentrators) from their outbound connections to attacker-controlled infrastructure. The capability extends GreyNoise beyond inbound scanning intelligence into post-exploitation, outbound-facing dete…
GreyNoise announced an updated integration with Google Security Operations that brings its internet-scanner classification data into the SIEM/SOAR platform. The aim is to separate mass-scanning noise from activity targeting the customer's own environment. GreyNoise says it observes over 800,000 unique IPs daily across 5,000+ sensors in 80…
GreyNoise announced an expanded integration with the CrowdStrike Falcon platform, adding content for Falcon Next-Gen SIEM and Charlotte Agentic SOAR. It is delivered through the GreyNoise Foundry App in the CrowdStrike Marketplace. The package brings GreyNoise's internet-wide scanning and exploitation observations into SOC detection and a…
GreyNoise has described a revised detection engineering approach that uses agentic workflows built on frontier large language models to keep pace with rising CVE volumes. The post says CVE entries grew from 16,510 in 2018 to 48,162 in 2025, and that generative AI has contributed to 130% growth from 2022 through 2025. It also claims the me…
On 24 September 2026, GreyNoise observed a malicious actor using 149.104.78.141 to attempt pre-disclosure zero-day exploitation of a Citrix NetScaler Gateway on a Project Swarm participant sensor. No CVE-specific detections existed at the time, but behavioral detections labeled the activity malicious within seconds. The attempt failed to …
GreyNoise announced that a former Head of Global Signals Operations at Google Threat Intelligence Group (GTIG), who joined Google through its 2022 acquisition of Mandiant, is its new Senior Vice President of Adversary Operations. This is a personnel and business announcement with no incident, vulnerability or active campaign. The post say…
GreyNoise observed an increase in scanning and exploitation attempts against Digital Video Recorders (DVRs) in Ukraine between 21 September and 1 October 2026, coinciding with an escalation in Russian strikes. Most of the activity targeted CVE-2021-36260, an unauthenticated command injection flaw in unpatched Hikvision products. GreyNoise…
GreyNoise announced Project Swarm, a research initiative that opens its deception platform, the Global Observation Grid (5,000+ sensors in 80 countries, 500M+ sessions per day), to outside contributors. The stated aim is better visibility into attacks on network edge devices (firewalls, VPN gateways, routers, load balancers). These device…
GreyNoise reports that 21 IP addresses in AS213438 (registered to ColocaTel Inc., Mahe, Seychelles) produced 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026, or 67.4% of the worldwide total. Over April 5-7 the same fleet accounted for 49.7% of global RDP Crawler activity. All 21 IPs are geolocated to the Netherlands, w…
GreyNoise analyzed 4 billion sessions targeting edge infrastructure over 90 days and concluded that IP reputation feeds are structurally ineffective against residential proxy traffic. Attackers route scanning and reconnaissance through compromised home broadband, mobile and small-business connections, so source IPs look like legitimate us…
Between March 12 and 18, 2026, the GreyNoise Observation Grid (GOG) recorded 242,666 new scanning IPs geolocating to Hong Kong, 48.9% of all new scanning IPs seen that week. 99.7% never completed a TCP handshake, so GreyNoise classes them as "spoofable" (unverified source addresses). They carried no payloads and triggered no signatures. G…
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
GreyNoise reports that on 31 August 2026 a likely Russian-speaking malicious cyber actor used 45.142.193.132 and AI to develop, test and deploy exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). Using hundreds of AI agents built on OpenAI's Codex harness, a DeepSeek model and public offensive security tools, the actor compro…
