hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈

I might be able to re-up my ancient attempt at a Waffle House Index #RStats package! Their new hidden API is great. ~5% of Waffle House locations are temporarily closed as of a query a couple minutes ago.

New research: Threat actors are actively mapping LLM infrastructure. Our Ollama honeypots captured 91K+ attack sessions. One campaign systematically probed 73+ model endpoints—GPT-4o, Claude, Llama, Gemini, and more—across 80K sessions in 11 days. www.greynoise.io/blo... 1/2

That which was originally a private customer threat intel share in our weekly At The Edge reports is now a public blog post! www.greynoise.io/blo... This is a deep dive into a massive reconnaissance campaign that unfolded between December 25–28. 1/4

* The IAB Model: This wasn't a direct hit; it was a "restocking" of the Initial Access Broker market. * Infrastructure: The activity originated from a suspicious hosting provider (CTG Server Limited) with a history of phishing and abuse. 3/4

That which was originally a private customer threat intel share in our weekly At The Edge reports is now a public blog post! www.greynoise.io/blo... This is a deep dive into a massive reconnaissance campaign that unfolded between December 25–28. 1/4

🙏🏽 Lifehacker for introducing GreyNoise Check to a broader population! 👉 lifehacker.com/tech/... If you haven't used GreyNoise Check — check.labs.greynoise.io — this is the perfect time to do so, especially if you're visiting friends/fam over the holidays. 1/2

"There's Payloads, And Then There's pAIloads: A Look At Selected Opportunistic (And Possibly AI-"Enhanced") React2Shell Probes and Attacks" www.greynoise.io/blo... 1/3

We've captured over 50K (some, barely) "unique" #React2Shell payloads, and a few caught our eye as potentially being some of the more nascent "AI"-created or enhanced ones. We took the opportunity to dig into five of them and see what makes them tick. 2/3

I had the [mis?]fortune of being awake just as attackers decided to slam the public internet with React2Shell exploits. GreyNoise had a tag up for it yesterday afternoon. Full write-up of the initial spate of attacks: www.greynoise.io/blo... 1/3

What we're seeing: Automation-heavy traffic (Go clients, scanner UAs) PoE validation via PowerShell math commands Encoded stagers downloading secondary payloads AMSI bypass attempts via reflection ~50% of IPs first seen in December 2025 Early migration into Mirai botnets 2/3

🔍 New tool alert: GreyNoise IP Check Your home network might be compromised and you'd never know. Residential proxies, IoT botnets, and router malware are everywhere—turning regular internet connections into attack infrastructure. 1/3

Our Labs team built a free tool to check: visit check.labs.greynoise.io and see instantly if your IP has been caught scanning the internet. No signup. No email harvesting. Just answers from our global sensor network that sees billions of IPs. 2/3

There once was an organization called Stark Industries (no, not *that* one! this one is real!). They emerged around the time Russia decided to invade Ukraine. Oddly enough, their ASN real estate was the source of scads of Russian state-sponsored cyber ops. 1/5

While others look through "legal documents" we got receipts right from the network packets. You can read the whole thing @ "When Bulletproof Hosting Proves Bulletproof: The Stark Industries Shell Game" 👉 www.greynoise.io/blo... 4/5

There once was an organization called Stark Industries (no, not *that* one! this one is real!). They emerged around the time Russia decided to invade Ukraine. Oddly enough, their ASN real estate was the source of scads of Russian state-sponsored cyber ops. 1/5

Back in May, the EU decided to wield its mighty¹ fist & drop some sanctions on Stark. Except…they (the EU) suck @ OPSEC & the impending sanctions leaked. 2/5

Nobody (nobody) should trust the 110% centralized record store that is Bluesky's ATproto dumping ground. There is zero sign of a plan for having $ to keep it independent of any malicious entity. It is a centralized store that can purge your record tomorrow on a billionaire's whim.