GreyNoise

GreyNoise analyzes Internet background noise. Use GreyNoise to remove pointless security alerts, find compromised devices, or identify emerging threats.

(Yes, it's really us. - Love, GreyNoise )

Last Notes

2026-02-10 20:42:17 UTC

We observed a 65% drop in global telnet traffic in a single hour on Jan 14, settling into a sustained 59% reduction. 18 ASNs went silent, 5 countries disappeared, but cloud providers were unaffected.
Our analysis of 51.2M sessions points to backbone-level port 23 filtering by a North American Tier 1 transit provider.
🔗 https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/
#GreyNoise #ThreatIntel #CyberSecurity #InfoSec

2025-11-19 21:04:48 UTC

🚨 Palo Alto GlobalProtect scanning surged 40X in 24hrs...a 90-day high.
2.3M login attempts from concentrated infrastructure (AS200373/AS208885).
Block these IPs now: https://www.greynoise.io/blog/palo-alto-scanning-surges-90-day-high

2025-11-17 20:56:56 UTC

EU sanctioned Stark Industries in May. Leaked docs gave them 12 days warning.
Result: ASN shuffle, rebrand to THE.Hosting. Corporate shells changed, network behavior didn't.
We tracked it: AS44477→AS209847. Packets don't lie.
🔗 https://www.greynoise.io/blog/stark-industries-shell-game

2025-10-01 22:03:23 UTC

GreyNoise now has coverage for Cisco zero-days CVE-2025-20333 and CVE-2025-20362. Watch for exploit attempts in real-time:CVE-2025-20333
(Net-new): https://viz.greynoise.io/tags/cisco-asa-vpn-input-validation-cve-2025-20333-rce-attempt?days=1CVE-2025-20362
(Updated tag): https://viz.greynoise.io/tags/cisco-asa-directory-traversal-cve-2018-0296-and-cve-2025-20362-attempt
#CiscoASA #Cisco #ZeroDay #CiscoZeroDays #CVE202520333 #CVE202520362 #GreyNoise #ThreatIntel

2025-08-25 19:00:06 UTC

On August 21, GreyNoise observed nearly 2,000 malicious IPs probing Microsoft Remote Desktop (RDP) services in a single day — a sharp deviation from baseline activity. Full blog: https://www.greynoise.io/blog/surge-malicious-ips-probe-microsoft-remote-desktop
#ThreatIntel #RDP #Cybersecurity #GreyNoise #Analysis #RemoteDesktop
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/090/941/432/782/395/original/a498b25dbf6f7c24.png

2025-05-16 16:33:19 UTC

Two critical Ivanti zero-days (CVE-2025-4427 + CVE-2025-4428) are now being actively exploited after a surge in scanning activity last month. Immediate patching is required. Get more details here ⬇️ https://www.greynoise.io/blog/ivanti-epmm-zero-days-reconnaissance-exploitation
#ZeroDay #CyberSecurity #threatintel
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/518/471/220/723/020/original/c3b5c5b4674c1b28.png

2025-04-23 20:40:23 UTC

🚨 9X Surge in Scanning for Ivanti Connect Secure. No CVEs are tied to this yet, but patterns like this often precede exploitation. Full analysis + suspicious IPs: https://www.greynoise.io/blog/surge-ivanti-connect-secure-scanning-activity #Ivanti #Cybersecurity #Scanning

2025-03-27 21:31:36 UTC

🚨 New GreyNoise Tag Alert: We've added a fresh tag tracking CrushFTP Authentication Bypass (CVE-2025-2825) exploitation attempts. Thanks to @npub13ar…p2f4 for the intel! Dive into the details: https://viz.greynoise.io/tags/crushftp-authentication-bypass-cve-2025-2825-attempt

2025-03-20 19:29:00 UTC

🚨Active Exploitation Alert: Critical Apache Tomcat RCE (CVE-2025-24813). Majority of traffic targeting U.S.-based systems. Full analysis & attacker IPs: https://greynoise.io/blog/active-exploitation-critical-apache-tomcat-rce-vulnerability-cve-2025-24813
#ApacheTomcat #Apache #GreyNoise #Vulnerability #CVE202524813
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/196/407/729/558/204/original/bd5acbbb497fb86e.png

2025-03-12 20:41:21 UTC

🚨 March 12 UPDATE: Grafana Exploitation May Signal Multi-Phase SSRF Attacks. Update + original analysis: https://www.greynoise.io/blog/new-ssrf-exploitation-surge #Cybersecurity #GreyNoise #Vulnerability

2025-03-10 18:42:01 UTC

Where do you get the most actionable threat intel? 🧐

2025-01-28 20:04:00 UTC

🚨 Hackers Are Exploiting Fortinet Firewalls 🚨
15k+ FortiGate firewalls were breached via CVE-2022-40684. GreyNoise has spotted 366 compromised devices behaving abnormally. Defenders: Patch now, secure your systems, and check your IPs.
https://www.greynoise.io/blog/hackers-actively-exploiting-fortinet-firewalls-real-time-insights-from-greynoise
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/907/770/149/546/063/original/3d85b319fc4d6966.png