GreyNoise launches Project Swarm to crowdsource edge-device deception sensors against state-sponsored actors
GreyNoise announced Project Swarm, a research initiative that opens its deception platform, the Global Observation Grid (5,000+ sensors in 80 countries, 500M+ sessions per day), to outside contributors. The stated aim is better visibility into attacks on network edge devices (firewalls, VPN gateways, routers, load balancers). These devices cannot run EDR agents and often lack logging. GreyNoise says state-sponsored actors such as the Typhoon groups and APT41 favour the edge for initial access, and that well-funded ransomware crews are following. Researchers, universities, non-profits, ISPs and OEMs are invited to contribute IP coverage, device profiles and detection rules. This is a product and community announcement, not a specific incident.
Technical Details
- Adversaries exploit vulnerabilities in firewalls and VPN gateways, abuse built-in tools on perimeter devices for persistence, and send quiet, targeted probes.
- The article says Typhoon actors build large residential botnet proxies from poorly monitored edge devices.
- The article says APT41 has exploited zero-days in Fortinet VPNs, Cisco routers and Citrix appliances.
- GreyNoise cites an average edge-device patch time of about 32 days, against exploit time often near zero.
- Sensors emulate edge assets and record full-fidelity sessions: raw PCAPs, payloads, HTTP headers, TLS metadata and behavioral artifacts. Contributors keep the data their sensors capture.
Remediation
The article gives no specific remediation. It argues that deception sensors give visibility where agents and logs are unavailable, and implies that shortening edge-device patch windows would reduce exposure.
Linha do tempo
-
GreyNoise launches Project Swarm to crowdsource edge-device deception sensors against state-sponsored actors
ler a análise desta fonte ocultar
GreyNoise announced Project Swarm, a research initiative that opens its deception platform, the Global Observation Grid (5,000+ sensors in 80 countries, 500M+ sessions per day), to outside contributors. The stated aim is better visibility into attacks on network edge devices (firewalls, VPN gateways, routers, load balancers). These devices cannot run EDR agents and often lack logging. GreyNoise says state-sponsored actors such as the Typhoon groups and APT41 favour the edge for initial access, and that well-funded ransomware crews are following. Researchers, universities, non-profits, ISPs and OEMs are invited to contribute IP coverage, device profiles and detection rules. This is a product and community announcement, not a specific incident.
Technical Details
- Adversaries exploit vulnerabilities in firewalls and VPN gateways, abuse built-in tools on perimeter devices for persistence, and send quiet, targeted probes.
- The article says Typhoon actors build large residential botnet proxies from poorly monitored edge devices.
- The article says APT41 has exploited zero-days in Fortinet VPNs, Cisco routers and Citrix appliances.
- GreyNoise cites an average edge-device patch time of about 32 days, against exploit time often near zero.
- Sensors emulate edge assets and record full-fidelity sessions: raw PCAPs, payloads, HTTP headers, TLS metadata and behavioral artifacts. Contributors keep the data their sensors capture.
Remediation
The article gives no specific remediation. It argues that deception sensors give visibility where agents and logs are unavailable, and implies that shortening edge-device patch windows would reduce exposure.