How a live GreyNoise product demo turned into an incident response. Inside a proxyjacking campaign that hit 143 devices ...
GreyNoise’s new research reveals a recurring pattern: spikes in malicious activity often precede the disclosure of new CVEs — especially in enterprise edge technologies like VPNs and firewalls. In 80 ...
Washington, DC – February 24, 2026 – GreyNoise Intelligence, the cybersecurity company providing real-time intelligence about network-based attacks, today released the “2026 GreyNoise State of the ...
Mass exploitation is faster and broader than ever. 40% of exploited CVEs in 2024 were at least four years old — some dating back to the 1990s. Attackers are targeting zero-days within hours of ...
Coordinated Brute Force Activity Targeting Apache Tomcat Manager Indicates Possible Upcoming Threats
Roughly 400 unique IPs were involved in the activity observed across both tags during this period of elevated activity. Most of the activity originating from these IPs exhibited a narrow focus on ...
GreyNoise has identified a significant escalation in malicious activity targeting Palo Alto Networks GlobalProtect portals. Beginning on 14 November 2025, activity rapidly intensified, culminating in ...
GreyNoise measured 212 exploitation attempts per second across H2 2025 — and the patterns inside that volume expose specific, measurable gaps in common edge defense strategies. The 2026 GreyNoise ...
GreyNoise’s Global Observation Grid (GOG) confirms exploitation of these CVEs in the past 24 hours. The heatmap below shows activity over the past 45 days, and the following data reflects the last 30 ...
GreyNoise has received a statement from TeleMessage, stating: CVE-2025-48927 was fully remediated in the TeleMessage environment in early May. That remediation has been independently verified by our ...
In a significant escalation, the botnet has grown to ~300,000 IPs — more than tripling in size. The threat actor(s) continues its focus on RDP infrastructure in the United States, leveraging IPs from ...
A major leak of internal chat logs from the Black Basta ransomware group has revealed 62 CVEs discussed by the group — offering a glimpse into the vulnerabilities considered for exploitation by one of ...
GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal — typically fewer than 10 IPs ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results