#greynoise

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

2 weeks ago

2026 State of the Edge Report GreyNoise observed 212 exploitation attempts per second in H2 2025. The 2026 State of the Edge Report reveals attack patterns, exposes defense gaps, and prioritizes what to fix.

52% of RCE attempts came from IPs with no prior GreyNoise history. New research on where edge defenses fall short + what to do about it: www.greynoise.io/resources/2026-state-of-...

#ThreatIntel #Cybersecurity #GreyNoise

GreyNoise

@greynoise.io

2 weeks ago

2026 State of the Edge Report GreyNoise observed 212 exploitation attempts per second in H2 2025. The 2026 State of the Edge Report reveals attack patterns, exposes defense gaps, and prioritizes what to fix.

52% of RCE attempts came from IPs with no prior GreyNoise history. New research on where edge defenses fall short + what to do about it.

#ThreatIntel #Cybersecurity #GreyNoise

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

3 weeks ago

A GreyNoise Intelligence weekly brief cover page titled “Weekly Intelligence Brief” for February 9–16, 2026, using a clean corporate layout with the GreyNoise logo at the top. Large headline text reads “IoT, Edge, Credentials. All Surging at Once.” followed by a short summary paragraph describing rising IoT botnet recruitment, Fortinet VPN brute-forcing, and credential harvesting. Four bold numeric callouts highlight “91% IoT default password surge,” “98% increase Fortinet VPN brute-force,” “8.28M credential harvesting sessions,” and “84 days of crypto C2 beaconing.” Below, four brief section teasers describe IoT botnet activity, enterprise edge credential attacks, broad credential harvesting, and an 84-day crypto exchange C2 operation. The footer includes a “Want the full brief?” marketing call-to-action with the GreyNoise contact URL and social handle, plus a “TLP: CLEAR” label indicating public sharing is allowed.

This week's At the Edge: CLEAR is out — a preview of the intel brief GreyNoise customers get every week.

🔗 www.greynoise.io/resources/at-the-edge-cl...

That's just the preview. greynoise.io/contact

#ThreatIntel #CyberSecurity #GreyNoise

GreyNoise

@greynoise.io

3 weeks ago

A GreyNoise Intelligence weekly brief cover page titled “Weekly Intelligence Brief” for February 9–16, 2026, using a clean corporate layout with the GreyNoise logo at the top. Large headline text reads “IoT, Edge, Credentials. All Surging at Once.” followed by a short summary paragraph describing rising IoT botnet recruitment, Fortinet VPN brute-forcing, and credential harvesting. Four bold numeric callouts highlight “91% IoT default password surge,” “98% increase Fortinet VPN brute-force,” “8.28M credential harvesting sessions,” and “84 days of crypto C2 beaconing.” Below, four brief section teasers describe IoT botnet activity, enterprise edge credential attacks, broad credential harvesting, and an 84-day crypto exchange C2 operation. The footer includes a “Want the full brief?” marketing call-to-action with the GreyNoise contact URL and social handle, plus a “TLP: CLEAR” label indicating public sharing is allowed.

This week's At the Edge: CLEAR is out — a preview of the intel brief GreyNoise customers get every week.

🔗 www.greynoise.io/resources/at...

That's just the preview. greynoise.io/contact

#ThreatIntel #CyberSecurity #GreyNoise

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

1 month ago

A dark-themed “Weekly Intelligence Brief” report from GreyNoise covering February 2–9, 2026, summarizing global malicious scanning activity. Large headline text highlights a 113% week‑over‑week surge in Remote Desktop Protocol (RDP) attacks, with 29.9 million RDP attempts, 83,000 N8N exploits, and 352 callback domains associated with OAST. Below, the layout is divided into four sections: one explaining that RDP attacks more than doubled in a week driven by a single noisy IP; one titled “Ivanti ‘Three‑Headed Hydra’” describing three independent campaigns abusing CVE‑2022‑1281 with Cobalt Strike; one on N8N exploitation describing 83,334 attempts against CVE‑2022‑21858 from a specific IP range and warning about exposed API keys; and one on the Rondodx botnet summarizing high session counts and links to previous activity. A footer invites readers to contact GreyNoise for the full brief and includes a link to the company website.

Three campaigns. One has Cobalt Strike ready.

RDP nearly quadrupled. A botnet picked up a new CVE. And someone built a Kubernetes cluster just to exploit n8n.

A preview of what GreyNoise customers get every week. Full brief has the IOCs, attribution, and […]

[Original post on infosec.exchange]

2rZiKKbOU3nTafniR2qMMSE0gwZ

@2rzikkbou3ntafnir2qmmse0gwz.activitypub.awakari.com.ap.brid.gy

1 month ago

The Day Telnet Went Silent: Inside the Mysterious Global Collapse of Botnet Scanning Traffic On February 10, 2025, global Telnet scanning traffic plummeted over 60% in a single day. GreyNoise Labs ...

#CybersecurityUpdate #botnet #traffic #cybersecurity […]

[Original post on webpronews.com]

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

1 month ago

We observed a 65% drop in global telnet traffic in a single hour on Jan 14, settling into a sustained 59% reduction. 18 ASNs went silent, 5 countries disappeared, but cloud providers were unaffected.

Our analysis of 51.2M sessions points to backbone-level port 23 filtering by a North American […]

Micha the DevOp

@michabbb.bsky.social

1 month ago

📊 #GreyNoise threat intelligence reports multiple exploit attempts per hour already detected in the wild

🔄 Telnet's unencrypted nature makes attacks visible to defenders monitoring plaintext traffic for "-f root" patterns

CySecurity News

@cysecuritynews.bsky.social

1 month ago

Threat Actors Target Misconfigured Proxies for Paid LLM Access  GreyNoise, a cybersecurity company, has discovered two campaigns against the infrastructure of large language models (LLMs) where the attackers used misconfigured proxies to gain illicit access to commercial AI services. Starting late December 2025, the attackers scanned over 73 LLM endpoints and had more than 80,000 sessions in 11 days, using harmless queries to evade detection. These efforts highlight the growing threat to AI systems as attackers begin to map vulnerable systems for potential exploitation.  The first campaign, which started in October 2025, focused on server-side request forgery (SSRF) vulnerabilities in Ollama honeypots, resulting in a cumulative 91,403 attack sessions. The attackers used malicious registry URLs via Ollama’s model pull functionality and manipulated Twilio SMS webhooks to trigger outbound connections to their own infrastructure. A significant spike during Christmas resulted in 1,688 sessions over 48 hours from 62 IP addresses in 27 countries, using ProjectDiscovery’s OAST tools, indicating the involvement of grey-hat researchers rather than full-fledged malware attacks. The second campaign began on December 28 from IP addresses 45.88.186.70 and 204.76.203.125. This campaign systematically scanned endpoints that supported OpenAI and Google Gemini API formats. The targets included leading providers such as OpenAI’s GPT-4o, Anthropic’s Claude series, Meta’s Llama 3.x, Google’s Gemini, Mistral, Google’s Gemini, Alibaba’s Qwen, Alibaba’s DeepSeek-R1, and xAI’s Grok. The attackers used low-noise queries like basic greetings or factual questions like “How many states in the US?” to identify models while avoiding detection systems.  GreyNoise links the scanning IPs to prior CVE exploits, including CVE-2025-55182, indicating professional reconnaissance rather than casual probing.While no immediate exploitation or data theft was observed, the scale signals preparation for abuse, like free-riding on paid APIs or injecting malicious prompts. "Threat actors don't map infrastructure at this scale without plans to use that map," the report warns. Organizations should restrict Ollama pulls to trusted registries, implement egress filtering, and block OAST domains like *.oast.live at DNS. Additional defenses include rate-limiting suspicious ASNs (e.g., AS210558, AS51396), monitoring JA4 fingerprints, and alerting on multi-endpoint probes. As AI surfaces expand, proactive securing of proxies and APIs is crucial to thwart these evolving threats.

Threat Actors Target Misconfigured Proxies for Paid LLM Access #AIEndpoints #GreyNoise #LLM

Python Bytes

@pythonbytes.fm

1 month ago

Toads in my AI News and announcements from the Python community for the week of Jan 26th, 2026

🎙️ Python Bytes 467: Toads in my AI
with @mkennedy.codes and @brianokken.bsky.social
pythonbytes.fm/467
#Python #GreyNoise #tprof #TOAD #FastAPI #Digg

Hasamba

@hasamba72.bsky.social

2 months ago

Ollama honeypot saw 91,403 attack sessions (Oct 2025–Jan 2026); analysis revealed two distinct campaigns mapping LLM deployment surfaces. GreyNoise issued a SITREP with IOCs to customers. #LLMs #GreyNoise #Ollama https://bit.ly/3YChjuU

GreyNoise

@greynoise.io

2 months ago

Filtering Noise in (Cyber)Space Dive into the scientific methods GreyNoise uses to separate internet noise from real threats, providing defenders a clearer, more accurate view of malicious activity.

New on the GreyNoise blog: We borrow from some unexpected fields, enzyme kinetics, species biodiversity models, astrophotography, to understand internet-wide scanning activity and measure what we might be missing.

#GreyNoise #Cybersecurity

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

2 months ago

Filtering Noise in (Cyber)Space Dive into the scientific methods GreyNoise uses to separate internet noise from real threats, providing defenders a clearer, more accurate view of malicious activity.

New on the GreyNoise blog: We borrow from some unexpected fields, enzyme kinetics, species biodiversity models, astrophotography, to understand internet-wide scanning activity and measure what we might be missing.

www.greynoise.io/blog/filtering-noise-cyb...

#GreyNoise #Cybersecurity

2rZiKKbOU3nTafniR2qMMSE0gwZ

@2rzikkbou3ntafnir2qmmse0gwz.activitypub.awakari.com.ap.brid.gy

2 months ago

Inside Vercel’s sleep-deprived race to contain React2Shell Talha Tariq quickly found his company at the center of a fast-moving, high-stakes mitigation effort. The result: a bounty program, a cat...

#Cybersecurity #Technology #Threats #greynoise #HackerOne […]

[Original post on cyberscoop.com]

2rZiKKbOU3nTafniR2qMMSE0gwZ

@2rzikkbou3ntafnir2qmmse0gwz.activitypub.awakari.com.ap.brid.gy

2 months ago

Inside Vercel’s sleep-deprived race to contain React2Shell Talha Tariq quickly found his company at the center of a fast-moving, high-stakes mitigation effort. The result: a bounty program, a cat...

#Cybersecurity #Technology #Threats #greynoise #HackerOne […]

[Original post on cyberscoop.com]

GreyNoise

@greynoise.io

2 months ago

Threat Actors Actively Targeting LLMs Our Ollama honeypot infrastructure captured 91,403 attack sessions between October 2025 and January 2026. Buried in that data: two distinct campaigns that reveal how threat actors are systematically m...

GreyNoise analyzed activity targeting exposed Ollama and LLM infrastructure, identifying SSRF abuse attempts and large-scale probing of LLM model endpoints.
#GreyNoise #ThreatIntelligence #LLMSecurity

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

2 months ago

Threat Actors Actively Targeting LLMs Our Ollama honeypot infrastructure captured 91,403 attack sessions between October 2025 and January 2026. Buried in that data: two distinct campaigns that reveal how threat actors are systematically mapping the expanding surface area of AI deployments.

GreyNoise analyzed activity targeting exposed Ollama and LLM infrastructure, identifying SSRF abuse attempts and large-scale probing of LLM model endpoints.
Analysis: www.greynoise.io/blog/threat-actors-activ...
#GreyNoise #ThreatIntelligence #LLMSecurity

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

2 months ago

Ransomware starts with reconnaissance: we observed a recent large-scale scanning campaign validating exploitable systems, data that feeds the initial access market and shows up later in real attacks. 🕵️‍♀️

www.greynoise.io/blog/christmas-scanning-...

#GreyNoise […]

GreyNoise

@greynoise.io

2 months ago

The Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 Attacks Over four days in December, one operator scanned the internet with 240+ exploits, logging confirmed vulnerabilities that could power targeted intrusions in 2026.

Ransomware starts with reconnaissance: we observed a recent large-scale scanning campaign validating exploitable systems, data that feeds the initial access market and shows up later in real attacks. 🕵️‍♀️

#GreyNoise #Ransomware #InitialAccess #IAB #Recon

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

2 months ago

React2Shell Update – 7 January 2026
Full update & analysis: www.greynoise.io/blog/cve-2025-55182-reac...

#GreyNoise #React2Shell

GreyNoise

@greynoise.io

2 months ago

CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far GreyNoise is already seeing opportunistic, largely automated exploitation attempts consistent with the newly disclosed React Server Components (RSC) “Flight” protocol RCE—often referred to publicly as...

React2Shell Update – 7 January 2026
Full update & analysis ⬇️
#GreyNoise #React2Shell

GreyNoise

@greynoise.io

2 months ago

Coordinated Credential-Based Campaign Targets Cisco and Palo Alto Networks VPN Gateways GreyNoise is tracking a coordinated, automated credential-based campaign targeting enterprise VPN authentication infrastructure, with activity observed against Cisco SSL VPN and Palo Alto Networks Glo...

GreyNoise is tracking a coordinated credential-based campaign targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect.
#Cisco #PaloAltoNetworks #GreyNoise #VPN #CiscoSSLVPN #GlobalProtect #ThreatIntel

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

2 months ago

GreyNoise is tracking a coordinated credential-based campaign targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect.

🔗 www.greynoise.io/blog/credential-based-ca...

#Cisco #PaloAltoNetworks #GreyNoise […]

[Original post on infosec.exchange]

CyberTaters

@potato.software

3 months ago

Just in: Watch #React2Shell exploitation unfold over time in the map below (geo of source IPs attempting to exploit CVE-2025-55182).

#GreyNoise #ThreatIntel #CVE202555182 #Nextjs #Potatosecurity

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

3 months ago

Just in: Watch #React2Shell exploitation unfold over time in the map below (geo of source IPs attempting to exploit CVE-2025-55182).

#GreyNoise #ThreatIntel #CVE202555182 #Nextjs #Cybersecurity

GreyNoise

@greynoise.io

3 months ago

Just in: Watch #React2Shell exploitation unfold over time in the map below (geo of source IPs attempting to exploit CVE-2025-55182).

#GreyNoise #ThreatIntel #CVE202555182 #Nextjs #Cybersecurity

GreyNoise

@greynoise.io

3 months ago

Graphic summarizing five React2Shell attacker profiles: Mass Scanners, VPN/Proxy Users, Cryptomining Operators, Malware Distribution Infrastructure, and Reconnaissance Specialists. Each group shows distinct characteristics, JA4+ signatures, and assessments ranging from benign scanning to organized cybercrime activity. GreyNoise notes customers receive full signatures in their intelligence brief.

👀 React2Shell attacker profiles fresh from GreyNoise telemetry: info.greynoise.io/hubfs/PDFs-S..., don't miss the latest contribution from GreyNoise Labs on React2Shell: www.labs.greynoise.io/grimoire/202...

#React2Shell #Nextjs #CVE202555182 #CVE #GreyNoise

GreyNoise

@greynoise.io

3 months ago

CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far GreyNoise is already seeing opportunistic, largely automated exploitation attempts consistent with the newly disclosed React Server Components (RSC) “Flight” protocol RCE—often referred to publicly as...

React2Shell blog update 🚨 compromised Next.js nodes are rapidly being enlisted into botnets; threat actor activity reaches ~80 source countries; and more.
#React2Shell #Nextjs #GreyNoise #ThreatIntel

GreyNoise

@greynoise.infosec.exchange.ap.brid.gy

3 months ago

GreyNoise - Happy Hour at BlackHat Europe Had a full day at BlackHat? Come put your feet up with GreyNoise and Corelight for a laid-back evening with complimentary drinks, nibbles, and great conversations.

Headed to BlackHat EU? 🇬🇧
Swing by the @corelight + GreyNoise booth for a chat and then grab drinks with the team after the con on Wednesday, Dec 10th. Sign up today to reserve your spot!

🔗 info.greynoise.io/events/blackhat-europe-h...

#BHEU #Corelight #GreyNoise

@matricedigitale.bsky.social

3 months ago

GreyNoise IP Check verifica se l’IP domestico partecipa a scansioni maligne o proxy compromessi, offrendo verdetti immediati e dati da sensori globali.

#GreyNoise #IoT #IP #malware #Proxy #rete #scansioni
www.matricedigitale.it/2025/11/29/c...