#greynoise — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #greynoise, aggregated by home.social.
-
NoiseFest is just a few weeks away!🎉 If you're in Las Vegas for #BlackHat or #DEFCON, come join us for a night of cold drinks, good company, and 60s and 70s vibes. 🏵️
📅Thursday, August 6th | 6–9 PM PT | Las Vegas
🔗RSVP: https://info.greynoise.io/events/blackhat-noisefest-2026 -
NoiseFest is just a few weeks away!🎉 If you're in Las Vegas for #BlackHat or #DEFCON, come join us for a night of cold drinks, good company, and 60s and 70s vibes. 🏵️
📅Thursday, August 6th | 6–9 PM PT | Las Vegas
🔗RSVP: https://info.greynoise.io/events/blackhat-noisefest-2026 -
Three things that caught our eye at the edge this week:
- One host mapped the enterprise edge.
- A pair ran a Hikvision camera RCE (CISA KEV) on shared tooling.
- VPN logins stayed under steady pressure.Defend on behavior, not IPs. This week's At The Edge Clear👉 https://www.greynoise.io/resources/at-the-edge-clear-061526
-
Three things that caught our eye at the edge this week:
- One host mapped the enterprise edge.
- A pair ran a Hikvision camera RCE (CISA KEV) on shared tooling.
- VPN logins stayed under steady pressure.Defend on behavior, not IPs. This week's At The Edge Clear👉 https://www.greynoise.io/resources/at-the-edge-clear-061526
-
We're in London tomorrow for @crowdstrike #CrowdTour2026. If you're attending our team would love to connect! Schedule some time to meet with us: https://info.greynoise.io/crowdtour-2026-meet
-
We're in London tomorrow for @crowdstrike #CrowdTour2026. If you're attending our team would love to connect! Schedule some time to meet with us: https://info.greynoise.io/crowdtour-2026-meet
-
GreyNoise At The Edge Intel Brief | June 1-8, 2026
This week's story: credential attacks on the front door of remote access, not new vulnerabilities.
🔗 https://www.greynoise.io/resources/at-the-edge-clear-0608261. A single Netherlands host (94.102.49.82, malicious) produced more than a quarter of all RDP crawling we observed — a 48-hour burst across a wide port range, then silence.
2. Every major SSL VPN vendor — Fortinet, Cisco, SonicWall, and Palo Alto — drew sustained credential brute-forcing and login scanning.
3. A two-node MikroTik RouterOS brute-force campaign (NL + BR) continued for a third week on TCP/8728.
4. Nine of the top ten source IPs trace to rented hosting — apply GreyNoise dynamic blocklists for the relevant tags — the IPs rotate, the tag-based coverage does not.
The actionable intelligence is the specific IPs, ASNs, and GreyNoise tags — not generic hardening advice.
-
GreyNoise At The Edge Intel Brief | June 1-8, 2026
This week's story: credential attacks on the front door of remote access, not new vulnerabilities.
🔗 https://www.greynoise.io/resources/at-the-edge-clear-0608261. A single Netherlands host (94.102.49.82, malicious) produced more than a quarter of all RDP crawling we observed — a 48-hour burst across a wide port range, then silence.
2. Every major SSL VPN vendor — Fortinet, Cisco, SonicWall, and Palo Alto — drew sustained credential brute-forcing and login scanning.
3. A two-node MikroTik RouterOS brute-force campaign (NL + BR) continued for a third week on TCP/8728.
4. Nine of the top ten source IPs trace to rented hosting — apply GreyNoise dynamic blocklists for the relevant tags — the IPs rotate, the tag-based coverage does not.
The actionable intelligence is the specific IPs, ASNs, and GreyNoise tags — not generic hardening advice.
-
NoiseFest is BACK 🎉
We're throwing our 4th annual party during Black Hat / DEF CON 2026 with a 60s and 70s theme 🏵️🎸✌️. Cold drinks, new connections, and stories from the front lines of cybersecurity at House of Blues B-Side in Las Vegas.🔗RSVP: https://info.greynoise.io/events/blackhat-noisefest-2026
-
NoiseFest is BACK 🎉
We're throwing our 4th annual party during Black Hat / DEF CON 2026 with a 60s and 70s theme 🏵️🎸✌️. Cold drinks, new connections, and stories from the front lines of cybersecurity at House of Blues B-Side in Las Vegas.🔗RSVP: https://info.greynoise.io/events/blackhat-noisefest-2026
-
GreyNoise At The Edge (May 19–26, 2026): a week of rented-infrastructure reconnaissance against the internet's edge — routers, VPN gateways, container planes, and embedded devices, probed in parallel.
1. A long-running MikroTik RouterOS brute-force operation (VPSVAULT, AS215925) reversed a multi-week decline, adding a second node and climbing back to ~1.9M sessions against TCP/8728.
2. A fingerprinted Netherlands cluster cataloged Fortinet, Ivanti, Pulse Secure, Sophos, and F5 appliances, running auth-bypass checks including Palo Alto PAN-OS GlobalProtect (CVE-2020-2034).
3. Telnet dominated volume; low-level probing continued for the tracked GNU telnetd out-of-bounds write watch item CVE-2026-32746 (CVSS 9.8).
4. Kubernetes and Docker control-plane recon now runs from a compromised consumer broadband host.
The infrastructure rotates constantly — detect on behavior, not addresses.
-
GreyNoise At The Edge (May 19–26, 2026): a week of rented-infrastructure reconnaissance against the internet's edge — routers, VPN gateways, container planes, and embedded devices, probed in parallel.
1. A long-running MikroTik RouterOS brute-force operation (VPSVAULT, AS215925) reversed a multi-week decline, adding a second node and climbing back to ~1.9M sessions against TCP/8728.
2. A fingerprinted Netherlands cluster cataloged Fortinet, Ivanti, Pulse Secure, Sophos, and F5 appliances, running auth-bypass checks including Palo Alto PAN-OS GlobalProtect (CVE-2020-2034).
3. Telnet dominated volume; low-level probing continued for the tracked GNU telnetd out-of-bounds write watch item CVE-2026-32746 (CVSS 9.8).
4. Kubernetes and Docker control-plane recon now runs from a compromised consumer broadband host.
The infrastructure rotates constantly — detect on behavior, not addresses.
-
A scanning pattern similar to the one preceding CVE-2026-0400 in February is active again. May 12 saw the largest single-day session volume on this SonicWall tag in 90 days.
🔗 https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400
-
A scanning pattern similar to the one preceding CVE-2026-0400 in February is active again. May 12 saw the largest single-day session volume on this SonicWall tag in 90 days.
🔗 https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400
-
GreyNoise At The Edge — April 13–20, 2026. Four themes dominated activity on the GreyNoise sensor network this week — spanning reconnaissance, exploitation attempts, credential brute-forcing, and botnet recruitment.
1. A broad credential and configuration discovery campaign ran at ~6.2M sessions across hundreds of IPs — ENV files, .git/config, AWS metadata, path traversal, sensitive file access. The biggest real story, distributed rather than concentrated.
2. VNC scanning surged to the third-most-targeted port on the internet — port 5900 at 17.4M sessions. Not in prior briefs.
3. A new multi-cloud Masscan framework activated this week. Shared JA3 across a new Poland IP and an existing DigitalOcean Singapore cluster.
4. VPSVAULT IoT worm weaponized CVE-2025-54322 (Xspeeder SXZOS, CVSS 10.0). CVE-2026-24061 (GNU telnetd, CVSS 9.8, CISA KEV) also in payload.
Full Report: https://www.greynoise.io/resources/at-the-edge-clear-042026
-
GreyNoise At The Edge — April 13–20, 2026. Four themes dominated activity on the GreyNoise sensor network this week — spanning reconnaissance, exploitation attempts, credential brute-forcing, and botnet recruitment.
1. A broad credential and configuration discovery campaign ran at ~6.2M sessions across hundreds of IPs — ENV files, .git/config, AWS metadata, path traversal, sensitive file access. The biggest real story, distributed rather than concentrated.
2. VNC scanning surged to the third-most-targeted port on the internet — port 5900 at 17.4M sessions. Not in prior briefs.
3. A new multi-cloud Masscan framework activated this week. Shared JA3 across a new Poland IP and an existing DigitalOcean Singapore cluster.
4. VPSVAULT IoT worm weaponized CVE-2025-54322 (Xspeeder SXZOS, CVSS 10.0). CVE-2026-24061 (GNU telnetd, CVSS 9.8, CISA KEV) also in payload.
Full Report: https://www.greynoise.io/resources/at-the-edge-clear-042026
-
See you in Glasgow for #CyberUK! 🇬🇧
Find GreyNoise at Booth D2 + catch our talks:
🗓 Apr 22, 12:20 – Nishawn Smagh
🗓 Apr 23, 14:30 – Glenn Thorpe IIIHappy Hour @ Golf Fang on Apr 22 ⛳️
Book 1:1 time: https://info.greynoise.io/cyberuk-meet-with-us
-
See you in Glasgow for #CyberUK! 🇬🇧
Find GreyNoise at Booth D2 + catch our talks:
🗓 Apr 22, 12:20 – Nishawn Smagh
🗓 Apr 23, 14:30 – Glenn Thorpe IIIHappy Hour @ Golf Fang on Apr 22 ⛳️
Book 1:1 time: https://info.greynoise.io/cyberuk-meet-with-us
-
NEW: GreyNoise At The Edge Intel Brief (March 23-30)
187,998,900 sessions from 100 top source IPs observed by GreyNoise sensors between March 23-30, 2026. Daily volumes surged 4x mid-week — from 8.5M to 36.6M in 72 hours.
1. VPSVAULT IoT botnet recruitment across 22 CVEs — 3,347,443 sessions from 4 Brazilian IPs targeting Hikvision, MikroTik, TP-Link, D-Link devices. Includes CVE-2026-24061, now on CISA KEV.
2. VisionHeight fleet of 6 AWS IPs generated 5,892,055 sessions mapping enterprise perimeters across Palo Alto, Sophos, Ivanti, Citrix, F5, and ConnectWise — probing CVE-2024-1709 (CVSS 10.0).
3. React/Next.js exploit chaining (CVE-2025-55182 + CVE-2025-29927) produced 1,338,336 sessions, with attackers spoofing GoogleBot user-agents to bypass detection.
4. At least 4 new scanning operations activated simultaneously mid-week, driving the sharp volume surge across the observation period.
Here's what we found: 🔗 https://www.greynoise.io/resources/at-the-edge-clear-033026
-
NEW: GreyNoise At The Edge Intel Brief (March 23-30)
187,998,900 sessions from 100 top source IPs observed by GreyNoise sensors between March 23-30, 2026. Daily volumes surged 4x mid-week — from 8.5M to 36.6M in 72 hours.
1. VPSVAULT IoT botnet recruitment across 22 CVEs — 3,347,443 sessions from 4 Brazilian IPs targeting Hikvision, MikroTik, TP-Link, D-Link devices. Includes CVE-2026-24061, now on CISA KEV.
2. VisionHeight fleet of 6 AWS IPs generated 5,892,055 sessions mapping enterprise perimeters across Palo Alto, Sophos, Ivanti, Citrix, F5, and ConnectWise — probing CVE-2024-1709 (CVSS 10.0).
3. React/Next.js exploit chaining (CVE-2025-55182 + CVE-2025-29927) produced 1,338,336 sessions, with attackers spoofing GoogleBot user-agents to bypass detection.
4. At least 4 new scanning operations activated simultaneously mid-week, driving the sharp volume surge across the observation period.
Here's what we found: 🔗 https://www.greynoise.io/resources/at-the-edge-clear-033026
-
200,886,675 sessions. 101 unique source IPs. March 16–23, 2026.
GreyNoise At The Edge intelligence brief highlights:
1. The MEVSPACE RDP brute-force operator returned after a 99.8% infrastructure collapse — single IP generated 7,975,241 sessions before deliberately withdrawing after 4 days. GreyNoise has tracked a surge-withdraw-reconstitute cycle since January 2026, reinforcing that well-resourced operators can reconstitute capacity within days.
2. Two coordinated campaigns emerged: VPSVAULT.HOST (IoT worm weaponizing 21+ CVEs against 12+ manufacturers) and Omegatech (TLS fingerprint randomization with 5,854 unique JA3s per node).
3. Sophos CVE-2022-1040 exploitation stabilized at 638,654 sessions in its fifth consecutive week. Enterprise VPN credential pressure reached week 9 across five vendors with 2.9M+ combined sessions.
4. n8n CVE-2026-21858 (CVSS 10.0) reached 118,086 sessions with links to MuddyWater and ZeroBot. ICS/SCADA reconnaissance expanded with new HMI and PLC vulnerabilities trending.
🔗 https://www.greynoise.io/resources/at-the-edge-clear-032326
-
200,886,675 sessions. 101 unique source IPs. March 16–23, 2026.
GreyNoise At The Edge intelligence brief highlights:
1. The MEVSPACE RDP brute-force operator returned after a 99.8% infrastructure collapse — single IP generated 7,975,241 sessions before deliberately withdrawing after 4 days. GreyNoise has tracked a surge-withdraw-reconstitute cycle since January 2026, reinforcing that well-resourced operators can reconstitute capacity within days.
2. Two coordinated campaigns emerged: VPSVAULT.HOST (IoT worm weaponizing 21+ CVEs against 12+ manufacturers) and Omegatech (TLS fingerprint randomization with 5,854 unique JA3s per node).
3. Sophos CVE-2022-1040 exploitation stabilized at 638,654 sessions in its fifth consecutive week. Enterprise VPN credential pressure reached week 9 across five vendors with 2.9M+ combined sessions.
4. n8n CVE-2026-21858 (CVSS 10.0) reached 118,086 sessions with links to MuddyWater and ZeroBot. ICS/SCADA reconnaissance expanded with new HMI and PLC vulnerabilities trending.
🔗 https://www.greynoise.io/resources/at-the-edge-clear-032326
-
52% of RCE attempts came from IPs with no prior GreyNoise history. New research on where edge defenses fall short + what to do about it: https://www.greynoise.io/resources/2026-state-of-the-edge-report
-
52% of RCE attempts came from IPs with no prior GreyNoise history. New research on where edge defenses fall short + what to do about it: https://www.greynoise.io/resources/2026-state-of-the-edge-report
-
This week's At the Edge: CLEAR is out — a preview of the intel brief GreyNoise customers get every week.
🔗 https://www.greynoise.io/resources/at-the-edge-clear-021626
That's just the preview. greynoise.io/contact
-
This week's At the Edge: CLEAR is out — a preview of the intel brief GreyNoise customers get every week.
🔗 https://www.greynoise.io/resources/at-the-edge-clear-021626
That's just the preview. greynoise.io/contact
-
Three campaigns. One has Cobalt Strike ready.
RDP nearly quadrupled. A botnet picked up a new CVE. And someone built a Kubernetes cluster just to exploit n8n.
A preview of what GreyNoise customers get every week. Full brief has the IOCs, attribution, and analysis.
-
Three campaigns. One has Cobalt Strike ready.
RDP nearly quadrupled. A botnet picked up a new CVE. And someone built a Kubernetes cluster just to exploit n8n.
A preview of what GreyNoise customers get every week. Full brief has the IOCs, attribution, and analysis.
-
We observed a 65% drop in global telnet traffic in a single hour on Jan 14, settling into a sustained 59% reduction. 18 ASNs went silent, 5 countries disappeared, but cloud providers were unaffected.
Our analysis of 51.2M sessions points to backbone-level port 23 filtering by a North American Tier 1 transit provider.
🔗 https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/
-
We observed a 65% drop in global telnet traffic in a single hour on Jan 14, settling into a sustained 59% reduction. 18 ASNs went silent, 5 countries disappeared, but cloud providers were unaffected.
Our analysis of 51.2M sessions points to backbone-level port 23 filtering by a North American Tier 1 transit provider.
🔗 https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/
-
⚠️ Unlike typical exploits, no buffer overflow or memory corruption needed - just one manipulated environment variable grants root access
🛡️ Not all Telnet implementations affected - only #GNU inet utils; proprietary versions like #Cisco and #BusyBox are safe
📊 #GreyNoise threat intelligence reports multiple exploit attempts per hour already detected in the wild
🔄 Telnet's unencrypted nature makes attacks visible to defenders monitoring plaintext traffic for "-f root" patterns
-
⚠️ Unlike typical exploits, no buffer overflow or memory corruption needed - just one manipulated environment variable grants root access
🛡️ Not all Telnet implementations affected - only #GNU inet utils; proprietary versions like #Cisco and #BusyBox are safe
📊 #GreyNoise threat intelligence reports multiple exploit attempts per hour already detected in the wild
🔄 Telnet's unencrypted nature makes attacks visible to defenders monitoring plaintext traffic for "-f root" patterns
-
🎙️ Python Bytes 467: Toads in my AI
with @mkennedy and @brianokken
https://pythonbytes.fm/467
#Python #GreyNoise #tprof #TOAD #FastAPI #Digg -
🎙️ Python Bytes 467: Toads in my AI
with @mkennedy and @brianokken
https://pythonbytes.fm/467
#Python #GreyNoise #tprof #TOAD #FastAPI #Digg -
New on the GreyNoise blog: We borrow from some unexpected fields, enzyme kinetics, species biodiversity models, astrophotography, to understand internet-wide scanning activity and measure what we might be missing.
-
New on the GreyNoise blog: We borrow from some unexpected fields, enzyme kinetics, species biodiversity models, astrophotography, to understand internet-wide scanning activity and measure what we might be missing.
-
GreyNoise analyzed activity targeting exposed Ollama and LLM infrastructure, identifying SSRF abuse attempts and large-scale probing of LLM model endpoints.
Analysis: https://www.greynoise.io/blog/threat-actors-actively-targeting-llms
#GreyNoise #ThreatIntelligence #LLMSecurity -
GreyNoise analyzed activity targeting exposed Ollama and LLM infrastructure, identifying SSRF abuse attempts and large-scale probing of LLM model endpoints.
Analysis: https://www.greynoise.io/blog/threat-actors-actively-targeting-llms
#GreyNoise #ThreatIntelligence #LLMSecurity -
Ransomware starts with reconnaissance: we observed a recent large-scale scanning campaign validating exploitable systems, data that feeds the initial access market and shows up later in real attacks. 🕵️♀️
https://www.greynoise.io/blog/christmas-scanning-campaign-fuel-2026-attacks
-
Ransomware starts with reconnaissance: we observed a recent large-scale scanning campaign validating exploitable systems, data that feeds the initial access market and shows up later in real attacks. 🕵️♀️
https://www.greynoise.io/blog/christmas-scanning-campaign-fuel-2026-attacks
-
React2Shell Update – 7 January 2026
Full update & analysis: https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far -
React2Shell Update – 7 January 2026
Full update & analysis: https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far -
@briankrebs Hi Sir sorry for the disturb. A swift question is it possible to detect such activity via https://check.labs.greynoise.io/ #greynoise #botnet
Or does one have to use dedicated scans via wireshark and #shodan and the likes?
-
@briankrebs Hi Sir sorry for the disturb. A swift question is it possible to detect such activity via https://check.labs.greynoise.io/ #greynoise #botnet
Or does one have to use dedicated scans via wireshark and #shodan and the likes?
-
GreyNoise IP Check – narzędzie pozwalające sprawdzić adres IP
Firma GreyNoise, zajmująca się zbieraniem informacji o trwających skanach sieci i próbach wykorzystania podatności, stworzyła narzędzie, które może przydać się każdemu. TLDR: GreyNoise IP Check, bo o nim mowa, pozwala sprawdzić, czy adres IP, którym aktualnie wychodzimy do Internetu, jest widziany jako bezpieczny, czy może zauważono jakieś jego powiązania ze skanowaniem...
#WBiegu #Awareness #Greynoise #Internet #Ip
https://sekurak.pl/greynoise-ip-check-narzedzie-pozwalajace-sprawdzic-adres-ip/
-
GreyNoise IP Check – narzędzie pozwalające sprawdzić adres IP
Firma GreyNoise, zajmująca się zbieraniem informacji o trwających skanach sieci i próbach wykorzystania podatności, stworzyła narzędzie, które może przydać się każdemu. TLDR: GreyNoise IP Check, bo o nim mowa, pozwala sprawdzić, czy adres IP, którym aktualnie wychodzimy do Internetu, jest widziany jako bezpieczny, czy może zauważono jakieś jego powiązania ze skanowaniem...
#WBiegu #Awareness #Greynoise #Internet #Ip
https://sekurak.pl/greynoise-ip-check-narzedzie-pozwalajace-sprawdzic-adres-ip/
-
GreyNoise is tracking a coordinated credential-based campaign targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect.
🔗 https://www.greynoise.io/blog/credential-based-campaign-cisco-palo-alto-networks-vpn-gateways
#Cisco #PaloAltoNetworks #GreyNoise #VPN #CiscoSSLVPN #GlobalProtect #ThreatIntel
-
GreyNoise is tracking a coordinated credential-based campaign targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect.
🔗 https://www.greynoise.io/blog/credential-based-campaign-cisco-palo-alto-networks-vpn-gateways
#Cisco #PaloAltoNetworks #GreyNoise #VPN #CiscoSSLVPN #GlobalProtect #ThreatIntel
-
Just in: Watch #React2Shell exploitation unfold over time in the map below (geo of source IPs attempting to exploit CVE-2025-55182).
#GreyNoise #ThreatIntel #CVE202555182 #Nextjs #Cybersecurity
-
Just in: Watch #React2Shell exploitation unfold over time in the map below (geo of source IPs attempting to exploit CVE-2025-55182).
#GreyNoise #ThreatIntel #CVE202555182 #Nextjs #Cybersecurity
-
👀 React2Shell attacker profiles fresh from GreyNoise telemetry: https://info.greynoise.io/hubfs/PDFs-Sales-Marketing/GreyNoise-React2Shell-Attacker-Profiles.pngAlso, don't miss the latest contribution from GreyNoise Labs on React2Shell: https://www.labs.greynoise.io/grimoire/2025-12-09-react2shell-meshcentral/
-
👀 React2Shell attacker profiles fresh from GreyNoise telemetry: https://info.greynoise.io/hubfs/PDFs-Sales-Marketing/GreyNoise-React2Shell-Attacker-Profiles.pngAlso, don't miss the latest contribution from GreyNoise Labs on React2Shell: https://www.labs.greynoise.io/grimoire/2025-12-09-react2shell-meshcentral/
-
React2Shell blog update 🚨 compromised Next.js nodes are rapidly being enlisted into botnets; threat actor activity reaches ~80 source countries; and more. https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far
#React2Shell #Nextjs #GreyNoise #ThreatIntel -
React2Shell blog update 🚨 compromised Next.js nodes are rapidly being enlisted into botnets; threat actor activity reaches ~80 source countries; and more. https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far
#React2Shell #Nextjs #GreyNoise #ThreatIntel