GreyNoise matches your outbound traffic against confirmed malicious and callback infrastructure derived from real exploit activity. A hit is a high-confidence signal that a device is calling out to ...
Washington, DC – February 24, 2026 – GreyNoise Intelligence, the cybersecurity company providing real-time intelligence about network-based attacks, today released the “2026 GreyNoise State of the ...
GreyNoise’s new research reveals a recurring pattern: spikes in malicious activity often precede the disclosure of new CVEs — especially in enterprise edge technologies like VPNs and firewalls. In 80 ...
Adversaries have a wide range of mechanisms they can use to obfuscate their public internet protocol (IP) addresses to avoid ...
Coordinated Brute Force Activity Targeting Apache Tomcat Manager Indicates Possible Upcoming Threats
Roughly 400 unique IPs were involved in the activity observed across both tags during this period of elevated activity. Most of the activity originating from these IPs exhibited a narrow focus on ...
Mass exploitation is faster and broader than ever. 40% of exploited CVEs in 2024 were at least four years old — some dating back to the 1990s. Attackers are targeting zero-days within hours of ...
GreyNoise has identified a significant escalation in malicious activity targeting Palo Alto Networks GlobalProtect portals. Beginning on 14 November 2025, activity rapidly intensified, culminating in ...
Exploitation of the CVE-2024-3273 command injection vulnerability requires the two valid `user=` and `passwd=` parameters. There is a companion vulnerability tracked as CVE-2024-3272 and describes the ...
While everybody has been talking about Ivanti vulnerabilities such as CVE-2024-21887 (remote code execution via path traversal - our tag) and CVE-2024-21893 (remote code execution via server-side ...
Our Ollama honeypot infrastructure captured 91,403 attack sessions between October 2025 and January 2026. Buried in that data: two distinct campaigns that reveal how threat actors are systematically ...
A major leak of internal chat logs from the Black Basta ransomware group has revealed 62 CVEs discussed by the group — offering a glimpse into the vulnerabilities considered for exploitation by one of ...
In a significant escalation, the botnet has grown to ~300,000 IPs — more than tripling in size. The threat actor(s) continues its focus on RDP infrastructure in the United States, leveraging IPs from ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results