News · BaselineWatch

GreyNoise blog 15 Oct

skynox7: Proxyjacking Edge Devices Into Residential Proxies

How a live GreyNoise product demo turned into an incident response. Inside a proxyjacking campaign that hit 143 devices across 34 countries.

GreyNoise blog 8 Oct

Spike in Attacks Targeting Digital Video Recorders in Ukraine

For months, GreyNoise recorded almost no Hikvision camera exploit attempts against Ukraine. On Sept 21 activity surged for nine days during Russian strikes, almost all from four IPs, then stopped. We can't say if the two are linked.

GreyNoise blog 28 Sep

Swarming Against Citrix 0-Day Exploitation

On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. At the time, there were no CVE-specific detections for the attack due to it occurring pre-disclosure. However, GreyNoise still detected and labeled the activity as fundamentally malicious within seconds due to behavioral detections.

GreyNoise blog 21 Sep

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We detail a few of the more notable intrusions we observed including the theft of more than 18,000 sensitive records from a western government.

GreyNoise blog 9 Sep

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

11 organizations compromised in 26 seconds. GreyNoise breaks down the AI-enabled campaign against PaperCut that hit 440 instances across 48 countries.

GreyNoise blog 31 Aug

GreyNoise + CrowdStrike: Real-Time Edge Intelligence in Falcon Next-Gen SIEM and Charlotte Agentic SOAR

Today we’re announcing an expanded integration between GreyNoise and the CrowdStrike Falcon® platform, with new content for CrowdStrike Falcon® Next-Gen SIEM and CrowdStrike Charlotte Agentic SOAR. The expanded integration includes a purpose-built Falcon Next-Gen SIEM dashboard, correlation rules that detect allowed inbound traffic from malicious infrastructure, and SOAR playbooks that bring GreyNoise threat context into automated response workflows.

GreyNoise blog 28 Aug

Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets

GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies, using forged user agents while requesting the files where misconfigured web servers frequently leak secrets and credentials.

GreyNoise blog 17 Aug

A New Way to Navigate GreyNoise

Today, we’re introducing a redesigned GreyNoise Visualizer that makes it easier to navigate those capabilities and brings related workflows together in one place.

GreyNoise blog 13 Aug

GreyNoise Welcomes New SVP of Adversary Operations

Former Google Threat Intelligence leader joins GreyNoise as SVP of Adversary Operations to advance proactive discovery and disruption of cyber threats.

GreyNoise blog 31 Jul

Introducing Tactics: See What Adversaries Do After They’re Inside

GreyNoise Tactics gives anyone running a Deception Sensor visibility into what adversaries do after initial compromise, automatically mapping qualifying sessions to the MITRE ATT&CK framework.

GreyNoise blog 30 Jul

Enhanced Detection Engineering at Scale in the Agentic Era

Check out GreyNoise's new Head of Adversary Engagement, Mark Mager, on why traditional detection engineering can't keep pace with CVE growth — and the agentic pipeline replacing it.

GreyNoise blog 21 Jul

Now Available: Intelligence Dashboard in the GreyNoise Platform

With the new Intelligence Dashboard, pin any combination of CVEs, tags, countries, IPs, and GNQL queries into one persistent, always-current view.

GreyNoise blog 13 Jul

Now Available: The Threat Brief Library in the GreyNoise Platform

GreyNoise's Threat Brief Library is now live in the Visualizer — browse, search, filter, and download weekly At The Edge briefs, Executive Situation Reports, and more, all built on primary-source sensor data.

GreyNoise blog 17 Jun

5 Things I Show Every SOC Team When We Wire GreyNoise Into Their SOAR

Your playbooks move fast, but GreyNoise helps them move smarter. Here are five ways GreyNoise drives better decisions in SOAR.

GreyNoise blog 4 Jun

4 Ways GreyNoise Improves SOC Outcomes

Learn four practical ways GreyNoise improves SOC outcomes—from reducing alert volume and surfacing targeted threats to identifying compromised hosts.

GreyNoise blog 22 May

The Coverage Gap: Why Your Blocklist Is Missing 119,000 Malicious IPs Today

GreyNoise compared 119,842 malicious IPs against 11 major threat feeds. The average coverage: just 2%, exposing the limits of static blocklists.

GreyNoise blog 21 May

A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400

A new SonicWall scanning surge mirrors the pattern that preceded CVE-2026-0400. GreyNoise details the activity and what defenders should watch.

CVE-2026-0400

GreyNoise blog 29 Apr

Project Swarm: Join the Collective. Defend the Edge

Today, we're launching Project Swarm — a research initiative that opens the GreyNoise deception platform to the global security community. Project Swarm transforms GreyNoise from a proprietary sensor network into a collective intelligence platform.

GreyNoise blog 20 Apr

The Internet Changes Before the Advisory Drops

Before Cisco disclosed a CVSS 10.0 zero-day, GreyNoise sensors had already observed eight surges of targeting activity compressing from 39 days to 2 days. A new study finds this pattern repeated across 33 CVEs and 16 vendor families — with a median lead time of 11 days. Read the full findings.

GreyNoise blog 10 Apr

Just 21 IP Addresses Are Now Behind Nearly Half of All RDP Scanning on the Internet

GreyNoise uncovers a concentrated RDP scanning campaign, revealing infrastructure patterns, rapid traffic shifts that impact detection, and recommendations for defenders.

GreyNoise blog 7 Apr

Introducing C2 Detection: Know When Your Edge Devices Are Calling Home to Attackers

We're launching C2 Detection — a new GreyNoise intelligence module that gives you two distinct, high-confidence signals that a device in your environment has been compromised.

GreyNoise blog 2 Apr

The Invisible Army: Why IP Reputation Fails Against the Rotation Economy

Attackers route malicious traffic through ordinary home internet connections — and to a reputation feed, the source IP is indistinguishable from a legitimate user's connection. GreyNoise analyzed 4 billion sessions over 90 days and found that 39% of unique IPs targeting the edge come from residential address space. 78% vanish after just 1–2 sessions, before any reputation system can flag them. The report documents why detection must shift from where the traffic comes from to what it is doing.

GreyNoise blog 25 Mar

Ghost Fleet: Half of All New Scanning IPs Last Week Geolocated to Hong Kong — Nearly None Completed a Connection

Last week, the GreyNoise Observation Grid observed something unusual: 242,666 new scanning IPs geolocating to Hong Kong appeared in seven days and 99.7% of them never completed a single TCP connection.

GreyNoise blog 10 Mar

GreyNoise Integrates with Google Security Operations to Enhance Detection and Response Capabilities

GreyNoise's integration with Google Security Operations delivers standardized indicator ingestion, pre-built dashboards, YARA-L detection rules, saved searches, response actions, webhook support, and ready-to-deploy playbooks.‍

GreyNoise blog 4 Mar

GreyNoise Intelligence Is Available Across the CrowdStrike Falcon Platform

GreyNoise intelligence is now available across the CrowdStrike Falcon platform, bringing internet-wide scanning context to SIEM queries, SOAR workflows, and AI-driven triage.

GreyNoise blog 27 Feb

Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure

84,000+ scanning sessions targeting SonicWall SonicOS infrastructure in four days. GreyNoise details a coordinated reconnaissance campaign using rotating proxy infrastructure.

GreyNoise blog 24 Feb

2026 GreyNoise State of the Edge Report: Where Attacks Concentrate and Defenses Fall Short

GreyNoise analyzed 2.97 billion malicious sessions over 162 days — and the patterns challenge assumptions about where edge defenses are strongest. From VPN targeting to infrastructure concentration to attackers rapidly rotating through fresh IPs, new research quantifies where the gaps are and what to do about it. Read the full findings.

GreyNoise blog 12 Feb

Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far

A PoC for CVE-2026-1731 hit GitHub on Feb 10. Within 24 hours, GreyNoise observed reconnaissance probing for vulnerable BeyondTrust instances.

CVE-2026-1731

GreyNoise blog 10 Feb

Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere

The GreyNoise Global Observation Grid observed active exploitation of two critical Ivanti Endpoint Manager Mobile vulnerabilities, and 83% of that exploitation traces to a single IP address on bulletproof hosting infrastructure that does not appear on widely circulated IOC lists.

GreyNoise blog 3 Feb

New in Event Feeds: Vendor CVE Spike & Tag Spike

GreyNoise introduces Vendor CVE Spike and Tag Spike. Learn how to detect coordinated vendor targeting and botnet surges before a CVE is assigned.

GreyNoise blog 2 Feb

The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates

In 2025, 59 KEV entries silently flipped to “known ransomware use.” GreyNoise uncovers the hidden flips, why they matter, and a new feed to track them.

GreyNoise blog 2 Feb

React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic

Two months after CVE-2025-55182 was disclosed on December 3, 2025, exploitation activity targeting React Server Components has consolidated significantly.

CVE-2025-55182

GreyNoise blog 28 Jan

GreyNoise Introduces Recall: Time-Series Intelligence for GreyNoise Query Language (GNQL)

Recall is a time-series capability that enables customers to query GreyNoise data over specific historical ranges. Instead of a static summary of current IP behavior, Recall allows you to see exactly how scanner activity looked at any given hour.

GreyNoise blog 12 Jan

Filtering Noise in (Cyber)Space

Dive into the scientific methods GreyNoise uses to separate internet noise from real threats, providing defenders a clearer, more accurate view of malicious activity.

GreyNoise blog 8 Jan

The Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 Attacks

Over four days in December, one operator scanned the internet for vulnerable systems, testing 240+ exploits and logging confirmed vulnerabilities that could power targeted intrusions in 2026.

GreyNoise blog 8 Jan

Threat Actors Actively Targeting LLMs

Our Ollama honeypot infrastructure captured 91,403 attack sessions between October 2025 and January 2026. Buried in that data: two distinct campaigns that reveal how threat actors are systematically mapping the expanding surface area of AI deployments.

GreyNoise blog 17 Dec 2025

There's Payloads, And Then There's pAIloads: A Look At Selected Opportunistic (And Possibly AI-"Enhanced") React2Shell Probes and Attacks

Over the past ~1.5 weeks, the React2Shell campaign has unleashed a flood of exploitation attempts targeting vulnerable React Server Components. Analyzing the payload size distribution across these attacks reveals a clear fingerprint of modern cybercrime, and a landscape dominated by automated scanners with a handful of sophisticated outliers.

GreyNoise blog 17 Dec 2025

Coordinated Credential-Based Campaign Targets Cisco and Palo Alto Networks VPN Gateways

GreyNoise is tracking a coordinated, automated credential-based campaign targeting enterprise VPN authentication infrastructure, with activity observed against Cisco SSL VPN and Palo Alto Networks GlobalProtect services.

GreyNoise blog 5 Dec 2025

CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far

GreyNoise is already seeing opportunistic, largely automated exploitation attempts consistent with the newly disclosed React Server Components (RSC) “Flight” protocol RCE—often referred to publicly as “React2Shell” and tracked as CVE-2025-55182.

CVE-2025-55182

GreyNoise blog 4 Dec 2025

A Hidden Pattern Within Months of Credential-Based Attacks Against Palo Alto GlobalProtect

GreyNoise detected a surge of 7,000+ IPs attempting to log into GlobalProtect, sharing fingerprints with a surge in SonicWall API scanning and earlier Palo Alto campaigns, exposing a persistent credential-based attack pattern.

GreyNoise blog 25 Nov 2025

Your IP Address Might Be Someone Else's Problem (And Here's How to Find Out)

Your home network might be part of someone else’s attack. GreyNoise IP Check shows if your IP’s been caught scanning the internet—free and private.

GreyNoise blog 19 Nov 2025

Introducing Query-Based Blocklists: Fully Configurable, Real-Time Threat Blocking in the GreyNoise Platform

GreyNoise customers can turn any GreyNoise query directly into a real-time blocklist for their firewall, SOAR, or other enforcement points.

GreyNoise blog 19 Nov 2025

FortiWeb CVE‑2025‑64446: What We’re Seeing in the Wild

GreyNoise has begun seeing active exploitation of CVE‑2025‑64446, the critical path‑traversal flaw that lets an unauthenticated actor run administrative commands on Fortinet FortiWeb appliances.

GreyNoise blog 19 Nov 2025

Palo Alto Scanning Surges 40X in 24 Hours, Marking 90-Day High

GreyNoise has identified a significant escalation in malicious activity targeting Palo Alto Networks GlobalProtect portals. Beginning on 14 November 2025, activity rapidly intensified, culminating in a 40x surge within 24 hours, marking a new 90-day high.

GreyNoise blog 17 Nov 2025

News · GreyNoise blog