GreyNoise

Detection engineering is drowning in manual work. In this RSAC webcast, GreyNoise’s Mark Mager is discussing how agentic workflows can change that. 🔗 www.rsaconference.com/Library/webc...

In GreyNoise data this week, a recurring pool of malicious IPs checked Microsoft Exchange servers for ProxyNotShell in passes no more than two days apart. 🔗 www.greynoise.io/resources/at...

Findings during a live GreyNoise demo led to follow-up research into commercial residential proxy abuse by malicious actors. What we found: a proxyjacking campaign that successfully compromised at least 143 devices across 34 countries.

Last week, GreyNoise reported Hikvision CVE-2021-36260 exploitation attempts against Ukraine that ran for nine days, then stopped. Near zero for months. A surge from Sep 23 to Oct 1, almost all from four IPs. Then nothing from those four since. 🔗 Full analysis: www.greynoise.io/blog/hikvisi...

We're proud to sponsor the FS-ISAC 2026 Americas Fall Summit in Austin! Stop by booth #82 to connect with our team and hear how GreyNoise is helping financial institutions cut through internet noise to focus on threats that are actually targeting them.

For months, GreyNoise recorded almost no Hikvision camera exploit attempts against Ukraine. On Sept 21 activity surged for nine days during Russian strikes, almost all from four IPs, then stopped. We can't say if the two are linked.

CVE volume nearly tripled between 2018 and 2025. The old detection engineering playbook can't keep up. GreyNoise's Mark Mager breaks down what has to change and how agentic AI workflows are the answer in this article featured in Cyber Defense Magazine (pages 188-191).

At The Edge Clear: September 21 – 28, 2026 An adversary tried Citrix NetScaler CVE-2026-88771 against a GreyNoise Swarm participant sensor more than three days before public disclosure. 🔗 www.greynoise.io/resources/at...

A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24. 🔗 Full analysis: www.greynoise.io/blog/swarmin...

On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.

Andrew joined Detection Dispatch (Alex's Version) to talk Project Swarm, deception-based detection, why real attack data matters more than ever in the age of AI-driven threats, and more. Watch the episode on Youtube ⬇️

At The Edge Clear: September 14 – 21, 2026 This week adversaries escalated attempts against flaws whose patches have been available for years. Customers get the full weekly brief. Our public At The Edge one-pager is attached + 🔗 www.greynoise.io/resources/at...

Welcome to the team 💪 "With the addition of these new leaders to GreyNoise, we are deepening our commitment to protecting the national security missions of the United States and our allies." Read the full announcement: www.greynoise.io/press/greyno...

A single malicious cyber actor. One IP address. GreyNoise tracked a suspected Chinese-speaking actor across months of activity, from UniFi to WordPress to ZyXEL, including a novel CVE exploit hitting 996 switches across 48 countries. Here's what we saw ⬇️

At The Edge Clear: September 8 – 14, 2026 Two CISA known-exploited remote code execution flaws in the AI application platform Langflow turned up this week inside ordinary commodity crawling. Customers get the full weekly brief. Our public At The Edge one-pager: www.greynoise.io/resources/at...

If you missed it: 395 organizations compromised across 48 countries. Hundreds of AI agents. One campaign against PaperCut NG/MF. We mapped the attack flow below⬇️ Read Agents Gone Wild: www.greynoise.io/blog/ai-orch...

The highest-volume malicious activity GreyNoise observed this week was a request for a file. Environment files, cloud configuration and repository configuration are all returned by a correctly functioning web server to anyone who asks for the right path. www.greynoise.io/resources/at...

Hundreds of AI agents powered a campaign against PaperCut NG/MF. What did the operation reveal about agentic attacks and their limits? Read GreyNoise’s latest blog ⬇️

This week exploitation attempts arrived in same-day cohorts across unrelated flaws. Customers get the full weekly brief. Our public At The Edge one-pager is attached + 🔗 www.greynoise.io/resources/at...

GreyNoise turns 9️⃣ today! 🥳 We've been busy this past month, and to mark the occasion, we've got a packed NoiseLetter. Thank you all for being a part of the GreyNoise Community and here's to nine years of cutting through the noise, together.

Great Day 1 at Fal.Con 2026 ✅ Lots of good conversations on the floor. If you're here this week, come find us at Booth #1757.

We're excited to announce an expanded integration between GreyNoise and the CrowdStrike Falcon® platform 🎉 The expanded integration includes a purpose-built Falcon Next-Gen SIEM dashboard, correlation rules, and SOAR playbooks.

Threat actors are forging the crawler names of OpenAI, Anthropic, DeepSeek and five other AI companies to request .env files and keys. Six of those names came from 824 addresses in matched volume. None asked for robots.txt in this traffic. Full analysis ⬇️

Most of the Log4Shell probing GreyNoise observed this week came from a single commercial scanning service. Our public At The Edge one-pager is attached. Customers get the full weekly brief. 🔗 www.greynoise.io/resources/at...

Back to Vegas we go! 🎲🎰 If you're headed to Fal.Con 2026, come find us at Booth #1757. We'll be showing how the GreyNoise + CrowdStrike integration helps analysts cut through internet noise and focus on threats that are actually targeting them. Book a meeting: info.greynoise.io/greynoise-fa...

Four findings this period, one shared exposure pattern: each involves a surface an organization puts on the internet deliberately and then rarely inventories completely. 🔗https://www.greynoise.io/resources/at-the-edge-clear-081726

The new GreyNoise Visualizer just dropped 💥 We redesigned the GreyNoise Visualizer to match how defenders actually work. Log in and hit "Try the New Visualizer" to explore it today. 🔗https://www.greynoise.io/blog/new-way-to-navigate-greynoise

NoiseFest 2026 is a wrap. What a ride 🚎 🏵️✌️ Thank you to everyone who came out last week and made it such an incredible night. And a huge thank you to our wonderful sponsors: Sublime Security, Mallory, StepSecurity, and ProjectDiscovery. See you next year for NoiseFest 2027.....

We’re thrilled to welcome @imposecost.bsky.social to GreyNoise as our new SVP of Adversary Operations⚡

Four findings this period, one shared exposure pattern: each involves a system that holds credentials or files for a secondary environment, so a successful attempt against one would likely open the next without a second exploit. 🔗https://www.greynoise.io/resources/at-the-edge-clear-081026

This week in GreyNoise data, rented crawlers probed for credentials and configuration secrets across widely deployed web software. Customers get the full weekly brief. Our public At The Edge Clear one-pager: www.greynoise.io/resources/at...

New in the GreyNoise Visualizer: the Intelligence Dashboard. Build one saved view of the threats you actually track, then watch it stay current on its own. Read the launch blog: greynoise.io/blog/intelli...

The June NoiseLetter is live! In this edition, we're diving into GreyNoise use cases, sharing the latest product releases, and getting ready for our biggest event of the year, NoiseFest.

The Threat Brief Library is now live in the GreyNoise Visualizer! Browse, search, filter, and download weekly At The Edge briefs, Executive Situation Reports, and more. All built on primary-source data from our global sensor network. Check it out: www.greynoise.io/blog/threat-...

NoiseFest is just a few weeks away!🎉 If you're in Las Vegas for #BlackHat or #DEFCON, come join us for a night of cold drinks, good company, and 60s and 70s vibes. 🏵️ 📅Thursday, August 6th | 6–9 PM PT | Las Vegas 🔗RSVP: info.greynoise.io/events/black... #NoiseFest #GreyNoise #cybersecurity

This week a long-dormant Palo Alto flaw came back to life in GreyNoise data. Separately, two coordinated hosting fleets ran the week's highest-volume web exploitation, roughly 7.5M connection attempts. 🔗https://www.greynoise.io/resources/at-the-edge-clear-070626

Four things that caught our eye at the edge this week: www.greynoise.io/resources/at...

Three things that caught our eye at the edge this week: - One host mapped the enterprise edge. - A pair ran a Hikvision camera RCE (CISA KEV) on shared tooling. - VPN logins stayed under steady pressure. This week's At The Edge Clear 👉 www.greynoise.io/resources/at...

We're in London tomorrow for CrowdStrike #CrowdTour2026. If you're attending our team would love to connect! Schedule some time to meet with us: info.greynoise.io/crowdtour-20... #CyberSecurity #GreyNoise #ThreatIntel

GreyNoise At The Edge Intel Brief (June 1-8, 2026) This week attackers went after the front door of remote access — RDP, SSL VPN, router management — not new CVEs. 🔗 www.greynoise.io/resources/at...

NoiseFest is BACK 🎉 We're throwing our 4th annual party during Black Hat / DEF CON 2026 with a 60s and 70s theme 🏵️🎸✌️. Cold drinks, new connections, and stories from the front lines of cybersecurity at House of Blues B-Side in Las Vegas. #BlackHat #DEFCON #NoiseFest #GreyNoise #cybersecurity

Less noise. Better signal. Faster response. New blog breaks down 4 ways GreyNoise helps SOC teams cut through internet background noise and focus on what actually matters: www.greynoise.io/blog/ways-gr... #CyberSecurity #ThreatIntel #SOC #GreyNoise

The May NoiseLetter is live! Early warning signals, blocklist gaps, and a SonicWall spike that echoes the pattern that preceded a CVE: www.greynoise.io/resources/no...

The week's signal: a long-running MikroTik RouterOS brute-force operation (VPSVAULT, AS215925) reversed a multi-week decline — adding a second node and climbing back to ~1.9M sessions against the management API. Rented infrastructure, inventorying the edge. 🔗 www.greynoise.io/resources/at...

We're in Toronto for CrowdStrike #CrowdTour2026 tomorrow, May 28th! Attending the event or local to the area? We'd love to connect. Book time with our team: info.greynoise.io/crowdtour-20...

Got questions? We've got answers. Tune in tomorrow at 12 ET for GreyNoise University LIVE! 📺

We measured 11 major IP blocklists against 119,842 malicious IPs we observed on one day. The best feed covered less than 5%. Most were under 2%. Your blocklist isn't broken. It was built for a slower threat landscape. Full breakdown ⬇️

A scanning pattern similar to the one preceding CVE-2026-0400 in February is active again. May 12 saw the largest single-day session volume on this SonicWall tag in 90 days. #GreyNoise #ThreatIntel #SonicWall

GreyNoise enrichment is now built into #IOC Insight Cards so you get behavioral signals, classification data, and validated #OSINT from 10,000+ #CTI sources, in one place. feedly.com/new-features...

The mission: make sure no attack works twice. 🚀 We're hiring a Detection Engineer and a Federal Customer Success Manager to help us get there. Remote-friendly, high-impact, great benefits. Sound like you? 👇 www.greynoise.io/careers