Glenn

@ntkramer

261 Siguiendo2627 Seguidores158 Publicaciones

Bluesky

¿Es tu perfil?Reclámalo y ntkramer.dirty.social es tuyo.Reclamar perfil

Glenn@ntkramer· May 18

It seems that CISA is, in fact, shortening the time-to-fix for vulns added to the KEV of late. (Casual reminder that the KEV should not be used as "what we should patch" but it is a signal worth watching for awareness). #threatintel

Glenn@ntkramer· Apr 13

When the signal gets lost in the noise, you learn to tune into a new frequency. Sometimes change doesn’t ask; it hums beneath the static. #TheSignalShift

Glenn@ntkramer· Jan 31

🍩 & #threatintel - 95% of exploitation attempts targeting CVE-2026-20045, a critical vulnerability in Cisco Unified Communications Manager, have used a distinctive user-agent: Mozilla/5.0 (compatible; CiscoExploit/1.0) and are heavily targeting our Cisco Unified Communications Manager sensors. 1/2

Glenn@ntkramer· Dec 10

☕ & #threatintel: CISA has moved the due date for mitigating CVE-2025-55182 (Meta React Server Components Remote Code Execution Vulnerability) up by two weeks. It was initially set for December 26, but it is now due on December 12. 1/2

Glenn@ntkramer· Oct 21

Ron (@iagox86.bsky.social) and I are presenting at #Suricon (Montreal) next month! If you're around, you'll definitely want to find us for some sweet swag (oh, and our talk is pretty cool too!). suricon.net/agenda-m...

Network protocols are messy! Sure, there are standards — RFCs, IEEEs, you name it — but there are also multiple ways to do basically everything. If you’re relying on network IDS/IPS tools like Suricata, I have bad news — a sufficiently clever attacker can bypass *a lot* of your signatures, leaving you completely blind.

The cool part about HTTP is that, at every level of the stack, your software tries to make sense of the user’s (aka: the attacker’s) requests. From the web server (Apache, IIS, etc) to the language parser (PHP, .NET, etc) — everything just wants your requests to work, often at the expense of security! That’s great for ensuring the internet keeps working, but creates makes it *really* hard to write signatures!

This talk will start with the basics: we’ll look at HTTP requests and learn the in-depth quirks of how the protocol works. Then we’ll look at a variety of different HTTP-based exploits (path traversal, SQL injection, shell command injection, and more!). We’ll exam

Glenn@ntkramer· Oct 3

It’s time for many folks’ annual cultural learning session. 🤣

Glenn@ntkramer· May 15

🥤& #threat-intel: CISA added Langflow Code Injection CVE-2025-3248 to the KEV on May 5. Recently, it has garnered considerable attention, with South Korea leading the pack. This vuln enables unauthenticated attackers to execute arbitrary code via /api/v1/validate/code viz.greynoise.io/tag...

Glenn@ntkramer· May 12

This change legitimately pisses me off. TL;DR—They appear to be removing RSS for KEV alerts and moving them to email or X. They gave orgs 0 days to prepare. RSS is already a thing. The emails arrive many hours later. X is NOT a gov website(!); it even warns you when you click their link! 1/2

Glenn@ntkramer· Mar 22

And another one. Two in one day.

Glenn@ntkramer· Mar 21

March 21, 2025, I received this: 3/4

Glenn@ntkramer· Mar 21

March 13, 2025, I received this: 2/4

Glenn@ntkramer· Mar 21

Absolutely disgusting. The Trump admin (DHS) has repurposed opt-in email signups to spread their propaganda. Years ago (4+) I signed up for Homeland Security emails; I don't recall doing this but based on the ones in my email it was related to something cyber -- not surprising. 1/4

Glenn@ntkramer· Feb 19

🍵 & #threatintel: @greynoise.io is observing a massive spike in exploitation attempts for CVE-2017-18368, Zyxel Command Injection Vulnerability. The source countries for this spike are pretty diverse; perhaps added to a botnet? viz.greynoise.io/tag...

Glenn@ntkramer· Jan 21

Regarding the Murdoc botnet delivering Mirai malware (www.darkreading.com/...) GreyNoise has 👀 1) viz.greynoise.io/tag... 2) viz.greynoise.io/tag...

Glenn@ntkramer· Jan 7

Censys released an advisory regarding Kerio CVE-2024-52875. We at GreyNoise began observing exploit attempts on December 28. Although the IP addresses involved are currently quite noisy, it's notable that they predominantly trace from Singapore to Lithuania. #threatintel viz.greynoise.io/tag...

Glenn@ntkramer· Dec 23

Happy Festivus! _|_

Glenn@ntkramer· Dec 23

Was there a CVE for this? 😆 support.microsoft.com/en-us/office...

Keyboard shortcut for Bold changed in Word after update

Glenn@ntkramer· Dec 4

Amplifying this from our /noiseletter/. Today marks a significant milestone for GreyNoise as we (essentially) launch GreyNoise v2. 1/5

Glenn@ntkramer· Oct 30

We, @greynoise.bsky.social, are seeing a massive uptick in IPs attempting to authenticate via telnet using one of several known backdoor accounts in FiberHome routers. viz.greynoise.io/tag...

Glenn@ntkramer· Oct 18

🎃 & #threatintel: We/GreyNoise have observed a significant increase in Fortinet SSL brute force attempts recently. This is the highest level in the past two months and the third highest of 2024. viz.greynoise.io/tag...

Chart showing the rise of Fortinet SSL brute force attempts over the last 10 days. It is climbing quickly.

Glenn@ntkramer· Sep 22

🗞️ & #threatintel: Increased interest in IPs attempting to exploit CVE-2023-4966, an unauthenticated information disclosure vulnerability in Citrix ADC & NetScaler platforms. viz.greynoise.io/tag...

Glenn@ntkramer· Sep 5

You disappoint ME! 😅 You must have a short name thing going on.

Glenn@ntkramer· Aug 14

☕️ & #threatintel: GreyNoise is observing a sizable increase in IPs attempting to brute-force credentials against Fortinet SSL VPNs. This is the most activity we've observed since mid January 2024. viz.greynoise.io/tag...

Glenn@ntkramer· Aug 5

🎰 & #threatintel: GreyNoise has observed an increase in the exploitation of CVE-2021-28799 over the past few days. This vulnerability affects QNAP NAS devices and allows unauthorized remote access. viz.greynoise.io/tag...

Chart showing increase in the exploitation of CVE-2021-28799 over the past few days.

Glenn@ntkramer· Aug 5

I'll be around the hackery summery campy things this week starting late Tues; looking forward to all the things except the germs and exhaustion. See you around! #blackhat #BHUSA #DEFCON #defcon32 #brathacker #bsideslv #HackerSummercamp #didimissone

Glenn@ntkramer· Aug 3

🌭 & #threatintel: Not loving the bump in interest of Cisco CVE-2019-1935 right before #blackhat #defcon week. viz.greynoise.io/tag...

Glenn@ntkramer· Jul 15

Looking back further, you can see how unusual it is: 2/2

Glenn@ntkramer· Jul 15

🥪 & #threatintel: something suspicious a-bot this spike in IP addresses attempting to exploit Mikrotik CVE-2018-14847... new botnet/addition? viz.greynoise.io/tag... 1/2

Chart showing huge increase in IP addresses attempting to exploit Mikrotik CVE-2018-14847.

Glenn@ntkramer· Jun 13

🥪 & #threatintel: We're seeing a significant uptick (the most in the last 6+ months) in the inventorying of Outlook Web Access (OWA) instances; I can't imagine why... [Narrator: Microsoft’s June 2024 Patch Tuesday] viz.greynoise.io/tag...

Chart showing a significant uptick in inventorying Outlook Web Access (OWA) instances

Glenn@ntkramer· Jun 8

⛱️ and #threatintel: GreyNoise has observed exploitation for CVE-2024-4577, a remote code execution vulnerability in Windows-based PHP installations. viz.greynoise.io/tag...