GreyNoise

NoiseLetter July 2025 Get GreyNoise updates! Read the July 2025 NoiseLetter for product news, key resources, the latest tags and vulnerabilities, and more.

This month's NoiseLetter will make the perfect light reading for a trip to say...Vegas? Make sure to check it out (even if you're not headed to BlackHat/DEF CON there is something in it for you). 🤘

Yesterday, we published new research revealing an early warning system for CVE disclosure.

📌 Full report: www.greynoise.io/resources/ea...

#Cybersecurity #ThreatIntel #VulnerabilityManagement #GreyNoise #InfoSec #CISO

Starting in 10! 👀

Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities GreyNoise’s new research reveals a recurring pattern: spikes in malicious activity often precede the disclosure of new CVEs — especially in enterprise edge technologies like VPNs and firewalls.

🚨 New Research: GreyNoise identifies an early warning signal, spikes in attacker activity tend to precede new CVE disclosures within six weeks. Which vendors show the strongest signal and more, all in our latest report ⬇️

GreyNoise University LIVE

GN University LIVE is headed your way tomorrow @ 12pm ET, don't miss it! 🔥

A Spike in the Desert: How GreyNoise Uncovered a Global Pattern of VOIP-Based Telnet Attacks A spike in botnet traffic from a single utility in a rural part of New Mexico led to the discovery of a global botnet. Explore how human-led, AI-powered analysis exposed compromised devices, uncovered...

An unexpected cluster of malicious IPs in a remote U.S. town led GreyNoise researchers to uncover a 500+ device botnet. Full analysis ⬇️
#Cybersecurity #ThreatIntel #Botnet #VoIP #GreyNoise #Cyber #Tech

Flaw in Signal App Clone Could Leak Passwords — GreyNoise Identifies Active Reconnaissance and Exploit Attempts A vulnerability disclosed in May 2025, CVE-2025-48927, affects certain deployments of TeleMessageTM SGNL. If exposed, this endpoint can return a full snapshot of heap memory which may include plaintex...

A vulnerability in a Signal-based enterprise messaging app could expose plaintext usernames and passwords via an unauthenticated memory dump. We're seeing exploit attempts in real time. Full analysis ⬇️ #Cybersecurity #ThreatIntel #GreyNoise

Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.

GreyNoise observed exploitation of CitrixBleed 2 (CVE-2025-5777) nearly two weeks before a public PoC was released. Full breakdown ⬇️
#GreyNoise #ThreatIntel #CitrixBleed #Citrix #NetScaler

GreyNoise Identifies New Scraper Botnet Concentrated in Taiwan GreyNoise has identified a previously untracked variant of a scraper botnet, detectable through a globally unique network fingerprint. To detect it, GreyNoise analysts created a signature using JA4+, ...

🚨 GreyNoise uncovered a previously untracked botnet, mostly based in Taiwan. Detected using JA4H + JA4T behavioral fingerprinting. Full analysis and list of IPs ⬇️ #GreyNoise #ThreatIntel #Cybersecurity

NoiseLetter June 2025 Get GreyNoise updates! Read the June 2025 NoiseLetter for product news, key resources, the latest tags and vulnerabilities, and more.

For the 5th year, we’re on summer break✈️Mandatory PTO starts TODAY! Services will stay up, with a skeleton crew on call for emergencies. Miss us? Check out this month’s NoiseLetter. See ya July 7! ✌️

See ya in 46 minutes...but who's counting 😬

GreyNoise University LIVE

See ya'll tomorrow at 12pm ET, for June's GreyNoise University LIVE! 🔥

Surge in MOVEit Transfer Scanning Activity Could Signal Emerging Threat Activity GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal — typically fewer than 10 IPs obser...

🚨 GreyNoise has observed a surge in scanning activity against MOVEit Transfer. Read the blog & see suspicious and malicious IPs ⬇️

#GreyNoise #ThreatIntel #Cybersecurity

@runzero.com we are stoked to have you back this year! 🔥

GreyNoise - NoiseFest at BlackHat 2025 Join us for NoiseFest at BlackHat/DEFCON on Thursday, August 7th. Enjoy drinks, snacks, and engaging conversations with your peers. RSVP now!

VEGAS, WE ARE SO BACK! 🤘

Exploiting Erlang OTP with Zip files: CVE-2025-4748 – GreyNoise Labs Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation

New GreyNoise Labs research: CVE-2025-4748. Our team demonstrates how path traversal via zip archives can be used to achieve file write and code execution against Erlang OTP environments.

Read the full tech breakdown here ⬇️

GreyNoise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771 ‍On June 16, GreyNoise observed exploit attempts targeting CVE-2023-28771 — a remote code execution vulnerability affecting Zyxel Internet Key Exchange (IKE) packet decoders over UDP port 500.

GreyNoise has observed exploit attempts targeting CVE-2023-28771 — an RCE vuln affecting Zyxel devices. Full analysis + malicious IPs ⬇️

#Cybersecurity #ThreatIntel #Vulnerabilities #GreyNoise

Cribl Pit Stop - Toronto Learn how to supercharge your telemetry management strategy from the world’s leader in telemetry management infrastructure. Cribl is coming to Toronto to address your data challenges.

Hey Toronto 🇨🇦! We are headed your way next week with our friends Cribl, for their #CriblPitStop. Say hi to our team and get the inside scoop about all things GreyNoise! 🍁

Coordinated Brute Force Activity Targeting Apache Tomcat Manager Indicates Possible Upcoming Threats GreyNoise recently observed a coordinated spike in malicious activity against Apache Tomcat Manager interfaces. On June 5, 2025, two GreyNoise tags — Tomcat Manager Brute Force Attempt and Tomcat Mana...

🚨 Brute force activity against Apache Tomcat Manager just spiked, indicating possible upcoming threats. 🔗 Full analysis & malicious IPs ⬇️
#GreyNoise #Apache #ThreatIntel #Tomcat

Technical Blog Drop 🔥 GreyNoise Labs explains why encoded payloads may go unnoticed.
#Suricata #Cybersecurity

GreyNoise Webinar - How Resurgent Vulnerabilities Jeopardize Organizational Security Watch as GreyNoise experts break down key insights from our latest 2025 report, A Blindspot in Cyber Defense: How Resurgent Vulnerabilities Jeopardize Organizational Security.

ICYMI 👀 @hrbrmstr.dev + Noah gave an epic talk on all things resurgent vulns, check it out 🔥

GreyNoise Webinar - How Resurgent Vulnerabilities Jeopardize Organizational Security Join GreyNoise Founder & Chief Architect Andrew Morris and VP of Data Science Bob Rudis as they break down key insights from our latest 2025 report, A Blindspot in Cyber Defense: How Resurgent Vulnera...

🧟‍♂️ Old CVEs are back from the dead + they’re coming for your edge tech.

Join @andrewmorr.is + @hrbrmstr.dev TOMORROW as they unpack the weird world of resurgent vulns and what they mean for your security strategy.

🎟️ Register now ⬇️

NoiseLetter May 2025 Get GreyNoise updates! Read the May 2025 NoiseLetter for product news, key resources, the latest tags and vulnerabilities, and more.

It may almost be summer, but not before you check out this month's NoiseLetter! 🌊

See ya soon!

GreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers GreyNoise uncovers a stealth campaign exploiting ASUS routers, enabling persistent backdoor access via CVE-2023-39780 and unpatched techniques. Learn how attackers evade detection, how GreyNoise disco...

GreyNoise Discovers Stealthy Backdoor Campaign Targeting ASUS Routers. Attacker tradecraft reflects APT-like behavior: quiet, durable, and designed for long-term access. Full blog ⬇️

#Cybersecurity #ThreatIntel #GreyNoise #ASUS

We are back this Thursday for another GreyNoise University LIVE, tune in for demos, news + what to expect this month! 🔗https://www.greynoise.io/events/greynoise-university-live

Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day On May 8, GreyNoise observed a highly coordinated reconnaissance campaign launched by 251 malicious IP addresses, all geolocated to Japan and hosted by Amazon AWS. The infrastructure and execution sug...

🚨 On May 8, GreyNoise observed a coordinated scanning operation launched by 251 malicious IPs, all hosted by Amazon and geolocated in Japan. ColdFusion, Apache Struts, Tomcat targeted. Full analysis ⬇️
#Cybersecurity #GreyNoise #ThreatIntel

GreyNoise observed a major spike in scanning against Ivanti products weeks before two zero-days were disclosed in Ivanti EPMM. Full update: www.greynoise.io/blog/surge-i...
#Ivanti #GreyNoise #Cybersecurity #ZeroDays

*in two weeks, whoops 😅

GreyNoise Webinar - How Resurgent Vulnerabilities Jeopardize Organizational Security Join GreyNoise Founder & Chief Architect Andrew Morris and VP of Data Science Bob Rudis as they break down key insights from our latest 2025 report, A Blindspot in Cyber Defense: How Resurgent Vulnera...

Old CVEs, new nightmares 😱 Resurgent vulns are rewriting the risk equation..are you prepared? Join @andrewmorr.is + boB Rudis next week as they unpack key insights from our latest 2025 report.