GreyNoise

@greynoise

GreyNoise analyzes Internet background noise. Use GreyNoise to remove pointless security alerts, find compromised devices, or identify emerging threats.

24 Folgt4.111 Follower453 Posts

Bluesky

Ist das dein Profil?Übernimm es — dann gehört dir greynoise.dirty.social.Profil übernehmen

GreyNoise@greynoise· 1d

Four findings this period, one shared exposure pattern: each involves a system that holds credentials or files for a secondary environment, so a successful attempt against one would likely open the next without a second exploit. 🔗https://www.greynoise.io/resources/at-the-edge-clear-081026

GreyNoise@greynoise· 22d

This week in GreyNoise data, rented crawlers probed for credentials and configuration secrets across widely deployed web software. Customers get the full weekly brief. Our public At The Edge Clear one-pager: www.greynoise.io/resources/at...

GreyNoise@greynoise· 23d

New in the GreyNoise Visualizer: the Intelligence Dashboard. Build one saved view of the threats you actually track, then watch it stay current on its own. Read the launch blog: greynoise.io/blog/intelli...

GreyNoise@greynoise· Jul 13

The Threat Brief Library is now live in the GreyNoise Visualizer! Browse, search, filter, and download weekly At The Edge briefs, Executive Situation Reports, and more. All built on primary-source data from our global sensor network. Check it out: www.greynoise.io/blog/threat-...

GreyNoise@greynoise· Jul 8

This week a long-dormant Palo Alto flaw came back to life in GreyNoise data. Separately, two coordinated hosting fleets ran the week's highest-volume web exploitation, roughly 7.5M connection attempts. 🔗https://www.greynoise.io/resources/at-the-edge-clear-070626

GreyNoise@greynoise· Jun 24

Four things that caught our eye at the edge this week: www.greynoise.io/resources/at...

GreyNoise@greynoise· Jun 18

Three things that caught our eye at the edge this week: - One host mapped the enterprise edge. - A pair ran a Hikvision camera RCE (CISA KEV) on shared tooling. - VPN logins stayed under steady pressure. This week's At The Edge Clear 👉 www.greynoise.io/resources/at...

GreyNoise@greynoise· Jun 16

We're in London tomorrow for CrowdStrike #CrowdTour2026. If you're attending our team would love to connect! Schedule some time to meet with us: info.greynoise.io/crowdtour-20... #CyberSecurity #GreyNoise #ThreatIntel

GreyNoise@greynoise· Jun 12

GreyNoise At The Edge Intel Brief (June 1-8, 2026) This week attackers went after the front door of remote access — RDP, SSL VPN, router management — not new CVEs. 🔗 www.greynoise.io/resources/at...

GreyNoise@greynoise· May 29

The week's signal: a long-running MikroTik RouterOS brute-force operation (VPSVAULT, AS215925) reversed a multi-week decline — adding a second node and climbing back to ~1.9M sessions against the management API. Rented infrastructure, inventorying the edge. 🔗 www.greynoise.io/resources/at...

GreyNoise@greynoise· May 27

We're in Toronto for CrowdStrike #CrowdTour2026 tomorrow, May 28th! Attending the event or local to the area? We'd love to connect. Book time with our team: info.greynoise.io/crowdtour-20...

GreyNoise@greynoise· May 19

The mission: make sure no attack works twice. 🚀 We're hiring a Detection Engineer and a Federal Customer Success Manager to help us get there. Remote-friendly, high-impact, great benefits. Sound like you? 👇 www.greynoise.io/careers

GreyNoise@greynoise· Apr 30

Today's the perfect day for a matinee double feature: GreyNoise University LIVE: www.greynoise.io/events/greyn... The Invisible Army: What 4 Billion Sessions Reveal About Residential Proxy Abuse Webinar: info.greynoise.io/webinar/invi...

GreyNoise@greynoise· Apr 29

Introducing Project Swarm: a research initiative to defend the network edge and we're inviting you to join. Deploy a sensor on your infrastructure, capture real attacker traffic + compare what's hitting you to the GreyNoise global baseline. Join today! 🐝

GreyNoise@greynoise· Apr 1

GreyNoise is headed to 🇸🇪 Stockholm for CrowdStrike #CrowdTour2026 on 🗓️ April 15th. Attending the event or local to the area? We’d love to connect. 🔗 Book a dedicated time to meet with our team here: lnkd.in/e4_FA-7h #CyberSecurity #CrowdStrike #GreyNoise #ThreatIntel #Stockholm

GreyNoise@greynoise· Mar 31

NEW: GreyNoise At The Edge Intel Brief (March 23-30) 187,998,900 sessions. 100 top source IPs. Daily volumes surged 4x mid-week as at least 4 new scanning operations activated simultaneously. Here's what we found: 🔗 www.greynoise.io/resources/at...

GreyNoise@greynoise· Mar 26

GreyNoise is proud to be sponsoring the CrowdStrike CrowdTour across 8 cities! 🌏 We’re excited to highlight how our integration with Falcon Next-Gen SIEM helps SOC teams stop chasing ghosts and start catching real threats. 👇Book a meeting with us here: info.greynoise.io/crowdtour-20...

GreyNoise@greynoise· Mar 25

Last week, half of all new scanning IPs observed by GreyNoise geolocated to Hong Kong. A quarter-million never completed a TCP handshake. The ones that did were scanning MySQL, SSH, SMB, and RDP across 20+ countries. One of these is the signal. The other is noise. www.greynoise.io/blog/ghost-f...

GreyNoise@greynoise· Mar 24

NEW: GreyNoise At The Edge Intel Brief (Mar 16–23) 200,886,675 sessions. 101 unique source IPs. Here's what we found: www.greynoise.io/resources/at...

GreyNoise@greynoise· Mar 19

New GreyNoise At The Edge brief: The internet's scanning infrastructure is reorganizing. UCLOUD (HK) surged +578% to become the #1 scanning ASN, now 15.6% of all observed traffic. Western providers declining simultaneously. 301.8M sessions. 439K IPs. Here's what we found.

Dark-themed GreyNoise Intelligence summary slide titled ‘The Scanning Landscape Is Reorganizing’ for March 9–16, 2026, showing total scanning stats and brief blurbs on uCloud’s 578% surge, escalating edge device exploits, fast‑rotating RDP operators, and a renewed React2Shell campaign, with a call to action to get the full report.

GreyNoise@greynoise· Mar 11

Hey London! We are closing down day 1 at #ecrimecongress today + cant wait to see you tomorrow! If you're around, say hi to the team, watch a demo, and grab some great swag! 🔥

GreyNoise@greynoise· Mar 4

Here's a taste of what GreyNoise customers got in this week's At The Edge intelligence brief. 268M sessions. 540K unique IPs. Four findings that matter. Full brief: IOCs, attribution, recommendations. 🔗 www.greynoise.io/resources/at... greynoise.io/contact

GreyNoise@greynoise· Feb 18

This week's At the Edge: CLEAR is out — a preview of the intel brief GreyNoise customers get every week. 🔗 www.greynoise.io/resources/at... That's just the preview. greynoise.io/contact #ThreatIntel #CyberSecurity #GreyNoise

GreyNoise@greynoise· Feb 11

Three campaigns. One has Cobalt Strike ready. RDP nearly quadrupled. A botnet picked up a new CVE. And someone built a Kubernetes cluster just to exploit n8n. A preview of what GreyNoise customers get every week. Full brief has the IOCs, attribution, and analysis.

A dark-themed “Weekly Intelligence Brief” report from GreyNoise covering February 2–9, 2026, summarizing global malicious scanning activity. Large headline text highlights a 113% week‑over‑week surge in Remote Desktop Protocol (RDP) attacks, with 29.9 million RDP attempts, 83,000 N8N exploits, and 352 callback domains associated with OAST. Below, the layout is divided into four sections: one explaining that RDP attacks more than doubled in a week driven by a single noisy IP; one titled “Ivanti ‘Three‑Headed Hydra’” describing three independent campaigns abusing CVE‑2022‑1281 with Cobalt Strike; one on N8N exploitation describing 83,334 attempts against CVE‑2022‑21858 from a specific IP range and warning about exposed API keys; and one on the Rondodx botnet summarizing high session counts and links to previous activity. A footer invites readers to contact GreyNoise for the full brief and includes a link to the company website.

GreyNoise@greynoise· Feb 4

Check out this month's NoiseLetter for the latest on Ghostie + all things GreyNoise! 🗞️ www.greynoise.io/resources/no...

GreyNoise@greynoise· Jan 27

Three campaigns. One fingerprint. React RCE, VPN brute forcing, and router scanning—all linked to the same infrastructure.→ 1.7M React attacks → 506K VPN targets → 3 IPs behind 1.8M router attempts This week's At The Edge preview: greynoise.io/contact

A digital intelligence brief from GreyNoise titled “AT THE EDGE,” dated January 19–23, 2026, summarizing three coordinated cyber campaigns under the headline “Three Campaigns. One Fingerprint.” The top of the graphic highlights key statistics in large text: 1.7M React attacks, 506K VPN targets, 1.8M router attempts, and a note that 3 IPs are responsible for 99% of observed activity. Below, four text blocks describe: (1) React exploitation attempts related to CVE-2025-55182, including real command injection, a Metasploit module, and one hosting provider generating 57% of traffic; (2) sustained attacks on enterprise VPNs (Fortinet SSL VPN and Palo Alto GlobalProtect) with 506K sessions, a 25% increase over baseline for Fortinet, and emphasis that VPN credentials are valuable for ransomware; (3) router attacks where three IPs drive 1.8M attempts, focusing on a MikroTik RouterOS brute-force campaign with a 64,000:1 session-to-IP ratio and noting compromised routers as pivot points and botnet nodes; and (4) an explanation that a shared JA1T network fingerprint links the React RCE, VPN brute force, and environment crawling to common infrastructure, suggesting organized operations rather than random scanning. The bottom banner invites GreyNoise customers to access the full brief, mentioning complete IOCs, attribution, detection guidance, and weekly role-based recommendations, with a contact URL “greynoise.io/contact” and a small 2026 GreyNoise, Inc. copyright notice.

GreyNoise@greynoise· Jan 13

Check out @hrbrmstr.dev today on @huntress.com's Tradecraft Tuesday at 1pm ET to chat about all things #React2Shell. 🤘 🔗 www.huntress.com/upcoming-web...

GreyNoise@greynoise· Jan 12

🚨 We are hiring across sales, alliances, and customer experience for our US + EMEA teams 🌍 See a role you'd crush? We would love to hear from you! 👉 Apply now: greynoise.io/careers #hiring #cybersecuritycareers

GreyNoise@greynoise· Dec 31

New year, new opportunities? Check out our current openings for a new start in the new year! 🪩🎉 🔗 greynoise.io/careers

GreyNoise@greynoise· Dec 11

Just in: Watch #React2Shell exploitation unfold over time in the map below (geo of source IPs attempting to exploit CVE-2025-55182). #GreyNoise #ThreatIntel #CVE202555182 #Nextjs #Cybersecurity