Glenn

Noticing it's been a while since a CVE in KEV flipped to known ransomware campaign. Not unheard of, just unusual. kev.inferenceandin.tel/

ai.rud.isJevaluating Vendor Patch Avalanches | ai.rud.isCVSS cannot triage 106 Juniper CVEs against your own network. A decision model answers factual questions per CVE; your code owns the patch/don't-patch thresholds.

Great example of a practical application of JEV by @hrbrmstr.dev ai.rud.is/posts/2026-1...

New resource alert: If you've followed my work, you know I've always been into the KEV, because you can infer intel from it. I'm always hunting for the between-the-lines "so what" in intel data, and I've done talks and research on inferred KEV intel over the years.

One tool I've leaned on is a dashboard I built to track trends, ransomware changes, comparisons and more. Well, @hrbrmstr.dev ~strongarmed~ helped me get it online for everyone to use. You can find it on our burgeoning site: kev.inferenceandin.tel/

greynoise.ioThe Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware UpdatesIn 2025, 59 KEV entries silently flipped to “known ransomware use.” GreyNoise uncovers the hidden flips, why they matter, and a new feed to track them.

It even includes a heatmap, timeline, and RSS feed that tracks the still-sneaky ransomware use flips! Some prior work that came out of this: - www.greynoise.io/blo... → which led to a bot account that tracks the flips: infosec.exchange/@ke... -

Gosh, this post really helped pinpoint a lot of my feelings on what we're losing with AI lately. "The value of writing a paper was never really the artefact – it was the forcing function.

researchagenda.newsThe Waymo effect: how AI is quietly making research less collaborative How frictionless technologies teach us to prefer our own company – and why research leaders should worry.

Writing is where we discover that the argument we were sure of has a hole in section three; where a vague intuition either becomes a precise claim or dissolves under the pressure of having to be one."

28 Aug

🍟 & #threatintel It’s been a minute since I climbed onto my KEV known-ransomware-use “silent flip” soapbox, so this Friday afternoon seemed like a good time to get back up there: 20(!) flips in August, the most since May 2025.

28 Aug

Dwell times range anywhere from 40 days to 5 years(!) on the KEV before flipping to known-ransomware-use. If you still aren’t addressing 12-year-old CVEs, “Mythos” probably should not be your focus right now.

14 July

I’ll be at Black Hat / DEF CON next month, so DM me if you want to meet up! I’ve lost count of how many I’ve been to now (actually it'd be depressing to know). As logistically chaotic as the week is, it’s always worth it to catch up with old friends and make new ones. 1/2

14 July

Share the real behind-the-scenes of your journeys. I want to hear it all: the successes, the failures, the highs, and the lows! #blackhat #defcon 2/2

18 May

It seems that CISA is, in fact, shortening the time-to-fix for vulns added to the KEV of late. (Casual reminder that the KEV should not be used as "what we should patch" but it is a signal worth watching for awareness). #threatintel

4 May

Big day! Today I start at Censys leading Applied AI, Intelligence (A²I²?). Threat hunting is getting a major upgrade with what we’re scheming. Stay tuned…

27 Apr

Bittersweet yet exciting transition ahead. This week marks my last at GreyNoise. Lately I've spent a lot of time thinking about what I value most in this field: research and findings grounded in clarity, integrity, actionability, and truth that drives outcomes. #TheSignalShift

13 Apr

When the signal gets lost in the noise, you learn to tune into a new frequency. Sometimes change doesn’t ask; it hums beneath the static. #TheSignalShift

unpromptedcon.orgAgenda - [un]prompted

16 Feb

Looking forward to sharing the stage at [un]prompted with the wizard himself, @hrbrmstr.dev, as we showcase "Orbie" (a custom-built AI agent that analyzes internet-scale honeypot data to surface emerging threats and even identify campaigns).

unpromptedcon.orgAgenda - [un]prompted

16 Feb

We’ll share what works, what doesn’t, and the specific campaigns we caught that traditional methods missed. You’ll see how domain expertise embedded in tooling enables LLMs to operate on billions of network sessions, and why that matters more than the model you choose. unpromptedcon.org

12 Feb

Excited to share that I've been asked to speak at the Minorities in Cybersecurity Conference this March! I’ll be on a panel “How Do You Define Cybersecurity Experience? A Change in Perspective” where we’ll dig into what really counts as cybersecurity experience

12 Feb

(beyond job titles, traditional career paths, and gatekeeping checklists)

12 Feb

If you’re passionate about broadening who gets seen, heard, and valued in this field, attend and lets continue the conversation in person. www.mincybsec.org/an...

2 Feb

My latest pet project, an RSS feed to alert you to the silent KEV knownRansomwareCampaignUse flips! (Did you know there were four CVEs flipped last week?) #threatintel

GreyNoise@greynoise.io

In 2025, 59 CVEs quietly flipped to “known ransomware use” in CISA’s KEV...no alerts, no fanfare. 🧐 We dug through a year of JSON to catch every silent flip and built an RSS feed so you don’t miss the next one. Read the blog + grab the feed 🗞️

31 Jan

🍩 & #threatintel - 95% of exploitation attempts targeting CVE-2026-20045, a critical vulnerability in Cisco Unified Communications Manager, have used a distinctive user-agent: Mozilla/5.0 (compatible; CiscoExploit/1.0) and are heavily targeting our Cisco Unified Communications Manager sensors. 1/2

viz.greynoise.ioGreyNoise Visualizer | GreyNoise VisualizerAt GreyNoise, we collect and analyze untargeted, widespread, and opportunistic scan and attack activity that reaches every server directly connected to the Internet.

31 Jan

We're tracking it here: viz.greynoise.io/tag... Appears to be from github.com/Ashwesker... 2/2

labs.greynoise.ioInside the Infrastructure: Who’s Scanning for Ivanti Connect Secure? – GreyNoise LabsGreyNoise detected a 100x surge in Ivanti Connect Secure reconnaissance targeting CVE-2025-0282 (EPSS 93%). Analysis reveals two distinct campaigns: an aggressive AS213790-based operation generating 34K+ sessions and a stealthier distributed botnet approach across 6K IPs. Infrastructure analysis and defender recommendations included.

29 Jan

☕ & #threatintel - Two campaigns (100x spike!) are hitting Ivanti Connect Secure; one loud (34K sessions from Romania/Moldova), one stealthy (~6K distributed IPs). Both target a pre-exploitation endpoint for CVE-2025-0282.

28 Jan

CISA's KEV hit 1,500 yesterday. I'm working on a cool #threatintel blog (yes, I'm biased) about additional hidden intel in KEV that should be published soon, along with a helpful tool hosted by GreyNoise! :)

10 Dec 2025

☕ & #threatintel: CISA has moved the due date for mitigating CVE-2025-55182 (Meta React Server Components Remote Code Execution Vulnerability) up by two weeks. It was initially set for December 26, but it is now due on December 12. 1/2

10 Dec 2025

If I recall correctly, this is the first time the due date has been modified. In all honesty, if you haven't already patched this vulnerability, it's likely too late. As a reminder, patching does not boot attackers, so you should check for indicators of compromise. 2/2

youtube.comSuriCon 2025 | Abusing HTTP Quirks to Evade DetectionPresented at SuriCon 2025 by Ron Bowes and Glenn Thorpe Network protocols are messy! Sure, there are standards — RFCs, IEEEs, you name it — but there are also multiple ways to do basically everything. If you’re relying on network IDS/IPS tools like Suricata, I have bad news — a sufficiently cl

9 Dec 2025

Ron & my talk from SuriCon 2025 | Abusing HTTP Quirks to Evade Detection I think it turned out pretty well; pardon the disco effect where a stage light was failing :) www.youtube.com/watc... CC: @iagox86.bsky.social @greynoise.io

texastribune.orgNoise from crypto mine pushes Texas neighbors to start a townLeaders of the effort say they moved to rural Hood County for its quiet country charm, which was shattered by what locals call “that roar” from the facility.

23 Oct 2025

I hate everything. http://www.texastrib...

21 Oct 2025

Ron (@iagox86.bsky.social) and I are presenting at #Suricon (Montreal) next month! If you're around, you'll definitely want to find us for some sweet swag (oh, and our talk is pretty cool too!). suricon.net/agenda-m...

greynoise.ioCoordinated Grafana Exploitation Attempts on 28 SeptemberGreyNoise observed a sharp one-day surge of exploitation attempts targeting CVE-2021-43798 — a Grafana path traversal vulnerability that enables arbitrary file reads. All observed IPs are classified a...

3 Oct 2025

It’s time for many folks’ annual cultural learning session. 🤣

Glenn reposted

GreyNoise

@greynoise.io

2 Oct 2025

On 28 September, GreyNoise observed a sharp one-day surge in attempts to exploit Grafana CVE-2021-43798. Full analysis & malicious IPs ⬇️ #Grafana #GreyNoise #ThreatIntel

greynoise.ioEarly Warning Signals: When Attacker Behavior Precedes New VulnerabilitiesGreyNoise’s new research reveals a recurring pattern: spikes in malicious activity often precede the disclosure of new CVEs — especially in enterprise edge technologies like VPNs and firewalls.

1 Aug 2025

We all know that @hrbrmstr.dev is a mad scientist, and when you give him the amazing telemetry our new fleet has been collecting lately, you get knowledge drops like this! Super proud of our @greynoise.io team’s work on the deception capabilities we now have! hashtag#threatintel

GreyNoise@greynoise.io

🚨 New Research: GreyNoise identifies an early warning signal, spikes in attacker activity tend to precede new CVE disclosures within six weeks. Which vendors show the strongest signal and more, all in our latest report ⬇️

Glenn reposted

GreyNoise

@greynoise.io

24 July 2025

An unexpected cluster of malicious IPs in a remote U.S. town led GreyNoise researchers to uncover a 500+ device botnet. Full analysis ⬇️ #Cybersecurity #ThreatIntel #Botnet #VoIP #GreyNoise #Cyber #Tech

greynoise.ioA Spike in the Desert: How GreyNoise Uncovered a Global Pattern of VOIP-Based Telnet AttacksA spike in botnet traffic from a single utility in a rural part of New Mexico led to the discovery of a global botnet. Explore how human-led, AI-powered analysis exposed compromised devices, uncovered...

🫖 & #threatintel - noticing a few other spikes orgs should be mindful of: 🔥 CVE-2025-49132 (Pterodactyl Panel RCE) (10/10 RCE) ⚡ CVE-2024-20439 (Cisco Smart Licensing Utility) (9.8/10, KEV) 📝 CVE-2017-18370 (Zyxel P660HN) 1/4

View full thread

⚡ CVE-2024-20439 (Cisco Smart Licensing Utility) (9.8/10, KEV) Hardcoded credentials have been known since late last year. viz.greynoise.io/tag... 3/4

📝 CVE-2017-18370 (Zyxel P660HN) Oldie but goodie. viz.greynoise.io/tag... 4/4

🔥 CVE-2025-49132 (Pterodactyl Panel RCE) (10/10 RCE) Active exploitation observed within days of disclosure. viz.greynoise.io/tag... 2/4

greynoise.ioExploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was PublicGreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.

🩸& #threatintel | We (GreyNoise) just published a quick note (www.greynoise.io/blo...) regarding CVE-2025-5777 - CitrixBleed 2 1/2

The main takeaway is we, first hand, observed exploitation almost two weeks before the POC was released, so ensure all retro threat hunting goes back at LEAST a month, but ideally further. 2/2

7 July 2025

🥜 & #threatintel - Thanks to @horizon3ai.bsky.social, we pushed a tag out today for CitrixBleed 2 CVE-2025-5777 and are backfilling. Currently, we see 233 hits starting on July 1 from: 64.176.50[.]109 38.154.237[.]100 102.129.235[.]108 121.237.80[.]241 45.135.232[.]2 Follow along... 1/2

7 July 2025

...here: viz.greynoise.io/tag... 2/2

12 June 2025

Just a totally normal trip home from the airport last night… passing the national guard rolling down the highway as they prepare for NO KINGS DAY protests. F this administration. About 3 more months before they start trying to censor social media via tech controls.

phys.orgPaleoproteomic profiling recovers diverse proteins from 200-year-old human brainsA new method developed by researchers at the Nuffield Department of Medicine, University of Oxford, could soon unlock the vast repository of biological information held in the proteins of ancient soft ...

29 May 2025

Seems like a lot of work when you could have found 200 year old brain proteins in the US Congress rn. phys.org/news/2025-0...

greynoise.ioGreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS RoutersGreyNoise uncovers a stealth campaign exploiting ASUS routers, enabling persistent backdoor access via CVE-2023-39780 and unpatched techniques. Learn how attackers evade detection, how GreyNoise disco...

28 May 2025

It's hard to beat good deception. :)

GreyNoise@greynoise.io

GreyNoise Discovers Stealthy Backdoor Campaign Targeting ASUS Routers. Attacker tradecraft reflects APT-like behavior: quiet, durable, and designed for long-term access. Full blog ⬇️ #Cybersecurity #ThreatIntel #GreyNoise #ASUS

27 May 2025

If you're ever feeling lonely, just close Zoom. This works because a funny thing always happens: a random last-minute Zoom will appear if you close it completely.

15 May 2025

🥤& #threat-intel: CISA added Langflow Code Injection CVE-2025-3248 to the KEV on May 5. Recently, it has garnered considerable attention, with South Korea leading the pack. This vuln enables unauthenticated attackers to execute arbitrary code via /api/v1/validate/code viz.greynoise.io/tag...

12 May 2025

This change legitimately pisses me off. TL;DR—They appear to be removing RSS for KEV alerts and moving them to email or X. They gave orgs 0 days to prepare. RSS is already a thing. The emails arrive many hours later. X is NOT a gov website(!); it even warns you when you click their link! 1/2

cisa.govUpdate to How CISA Shares Cyber-Related Alerts and Notifications | CISACISA is changing how we announce cybersecurity updates and the release of new guidance.

13 May 2025

Good news everyone! www.cisa.gov/news-events/... "Update May 13: (...) As such, we have paused immediate changes while we re-assess the best approach to sharing with our stakeholders."

12 May 2025