Censys

A dark-themed slide shows a table summarizing the internet exposure of four device types targeted by Iranian threat actors, comparing counts from January 2025 to June 2025 and showing the percentage change. Unitronics, Red Lion, and Tridium Niagara all increased in exposure, while Orpak SiteOmat decreased by nearly 25%.

Multiple US gov agencies have warned orgs to stay vigilant for potential Iran-affiliated cyber activity. We studied exposure of 4 vendors previously known to be of interest to IR-affiliated groups.

Read more: censys.com/blog/ics-ira...

Screenshot of dashboard depicting Censys observed host counts in Iran from June 16 through June 23

🔌 #Iran Internet #Outage Update
----
June 21 marked lowest visibility—but signs of recovery.
📉 Some networks (e.g., DATAK, HAMYAR-AS) remain unstable.
📈 Others (e.g., RESPINA-AS, MOBINNET-AS) are bouncing back strong.

View at #Censys: censys.com/blog/irans-i...

Screenshot of a terminal with white text on black background, showing results of the "showmount -a" command on an IP address

🔍 We looked at the C2 server associated with the Flodrix botnet and used an internet-exposed RPC service to uncover a world-readable NFS mount and 745 compromised hosts!

👀 censys.com/blog/poking-...

Two line graphs depicting scan error and success rates for Iran. Around 12pm UTC on June 18, the bottom graph depicts a sharp increase in scan error rates, while the top depicts a complementary decrease in scan success rates

Around 12PM UTC on June 18, scan error rates in Iran surged to nearly 100%, indicating a sudden, nationwide outage affecting almost all services. Systems that were previously reachable are now timing out or rejecting connections.

Censys Community | Censys Community Ask, discuss, learn, and connect in the Censys Community

Hey there, sorry to hear you're having a problem with your account. Make a post about your issue in our Community forum and we'll try to help! community.censys.com

Screenshot of Censys Platform

We used the new Censys Threat Hunting Module to investigate a Colombian threat actor, uncovering a series of remote access trojan (RAT) C2 servers.

We also show how to use this information to create a set of IOCs for defensive measures: censys.com/blog/unmaski...

A defining moment for Censys - We are excited to announce that the Threat Hunting Module in the new Censys Platform is now #GA!

www.censys.com/blog/interne...

Great research. They found 400 web-based HMIs for US water facilities exposed online. All used same HMI/SCADA software. Some required credentials to access, some were in read-only mode and couldn't be manipulated. But 40 systems didn't require authentication and were fully controllable via internet

Turning Off the (Information) Flow: Working With the EPA to Secure Hundreds of Exposed Water HMIs

In October 2024, Censys researchers discovered ~400 U.S. water facility web-based HMIs exposed online. Within a month of sharing data with the EPA and the vendor, 58% of systems were protected. Read more here: censys.com/blog/turning...

Tracking AyySSHush: a Newly Discovered ASUS Router Botnet Campaign

Thousands of compromised ASUS routers are being co-opted into a volatile but persistent botnet. Our latest blog takes IoCs from @greynoise.io and breaks down how the AyySSHush campaign has evolved over the past 5 months — and what makes it stand out: censys.com/blog/trackin...

TikTok and Malware

Trend Micro recently uncovered a campaign abusing TikTok to distribute malware via AI-generated videos, tricking users into installing infostealers. Using IOCs provided by Trend Micro, we found more related infrastructure, including a newer bulletproof service provider: censys.com/blog/tiktok-...

The Importance of Poppin’ Fresh Data A recent study by the Censys Research Team evaluated Censys’s IPv4 scanning capability against other engines and found that while these alternatives sometimes self-report higher numbers of results, th...

The Censys Research Team evaluated Censys’s IPv4 scanning capability against other engines and found that while these alternatives sometimes self-report higher numbers of results, their data is often stale and inaccurate.
censys.com/blog/the-imp...

YouTube video by Censys The Big Story: Langflow CVE-2025-3248

Our latest video dives into the details of CVE-2025-3248, a critical flaw in the Langflow, an open source Python app, that is being exploited in the wild.

youtu.be/vK4iYy_A130?...

YouTube video by Censys The Big Story: Langflow CVE-2025-3248

New @censys.bsky.social video on the Langflow CVE-2025-3248 bug and the ongoing exploitation.
youtu.be/vK4iYy_A130?...

Speeding up Threat Hunting with Censys Learn how the Censys Threat module allows users to rapidly investigate identified threat actor infrastructure.

Threat hunting tools should be built for speed and designed by threat hunters. Now they are.
The Censys Threat Module:
⏱️ Speeds up investigations
🌐 Surfaces enriched threat context
📈 Enables real-time pivoting

Act faster. Hunt smarter. See how: censys.com/blog/speedin...

Salt Typhoon Attacks Highlight Need for Advanced Defenses The Salt Typhoon attacks on critical infrastructure show the need for better threat hunting.

If you think Salt Typhoon has moved on—you might want to double-check your attack surface. We’re still seeing critical telecom infrastructure exposed to active targeting. Find out what we uncovered (and what you should be looking for) censys.com/blog/salt-ty...

Postcards From the Edge: Verizon DBIR Reveals Sharp Increase in Targeting of Edge Security Devices The Verizon 2025 Data Breach Investigations Report shows a sharp increase in edge security device vulnerabilities as the initial access vector in breaches.

Censys was a proud contributor to the 2025 Verizon Data Breach Investigations Report, shedding light on the growing threat to firewalls, VPNs, and other perimeter gear. See that this sharp increase in targeting edge security devices means ➡️ censys.com/blog/postcar...

Google Data Shows Fewer Zero Days in 2024, But More Targeting of Enterprises New data compiled by Google Threat Intelligence Group shows that while the total number of zero days identified in 2024 dropped to 75 from 98 the year before

Zero days attract a huge amount of attention in the security community, an amount that is completely disproportionate to how many of these vulnerabilities emerge each year and how often they’re actually used. They’re the Cybertrucks of security.
censys.com/blog/google-...

Google Data Shows Fewer Zero Days in 2024, But More Targeting of Enterprises New data compiled by Google Threat Intelligence Group shows that while the total number of zero days identified in 2024 dropped to 75 from 98 the year before

From an attacker’s perspective it makes perfect sense to target enterprise products, especially networking and security appliances. Those devices can grant a successful adversary broad access to the target organization, and there are often many different options.

censys.com/blog/google-...

New Ports & Protocols Dashboard from Censys | Exposure Intel Get real-time visibility into open ports, running services, and exposure risks with the new Censys Ports & Protocols Dashboard—now live in Censys ASM.

See every port. Secure every protocol. 🔐 The new Censys Ports & Protocols Dashboard is your exposure command center. Find out how we're helping SOC teams pinpoint exposures, track protocol misconfigurations, and close compliance gaps faster. censys.com/blog/introdu...

Whether you're at RSA Conference this week or dealing with #RSAC2025 FOMO, we've got your next stop. Join us May 6-8 in Baltimore to connect and collaborate with security leaders across the military and government sectors.

Scouting a Threat Actor

Our monitoring flagged a single host containing the source code for a command-and-control (C2) server, a backdoor, and a trojan dropper build system—a set of tools that (to our knowledge) has not been publicly documented before.
censys.com/blog/scoutin...

Introducing the Censys Query Assistant: Natural Language Threat Search Experience faster, easier threat hunting with the new Censys Query Assistant. Search internet intelligence using natural language—no complex syntax required.

When the AI hype is real. 🎆 The new Censys Query Assistant brings 2+ years of R&D into a tool that makes threat investigation faster, easier, and smarter. Find out how we're bringing the power of natural language search to security teams. censys.com/blog/acceler...

Threat hunters, this is your inside track. 🎥 We just dropped an exclusive threat intelligence briefing from malware analyst Silas Cutler. Get insight into the BeaverTail malware campaign, North Korea’s infiltration of global tech, and more. Watch now. censys.com/podcasts-vid...

Censys Threat Hunting – Regain the Initiative and Seize Control The Censys Threat Hunting module delivers critical threat insights and crucial hunt capabilities that empowers security teams to hunt faster, accelerate investigations, and preemptively defend against...

🚨 Launch Alert 🚨Censys just redefined threat hunting. Our new Threat Hunting Module delivers unmatched visibility and context from real-time Internet Intelligence that empowers you to proactively hunt emerging threats. See it in action: censys.com/solutions/th... #cybersecurity #threathunting

YouTube video by Censys The Big Story: BeaverTail, InvisibleFerret and the Carnival of North Korean Threats

Fresh new video with @silascutler.bsky.social and @dennisf.bsky.social discussing the BeaverTail and InvisibleFerret malware and the DPRK threat actor landscape.
youtu.be/z-KImQiHRck?...

The End of Stale Indicators Far too often, indicator feeds are full of stale IPs—ones that were active months before they were ever added to a blocklist. We want to end the use of stale indicators.

With our new Threat module, Censys is focused on delivering timely, actionable and context rich information. Over the past few months, we've been tracking a part of BeaverTail deployments used to serve the InvisibleFerret malware in a Collection in the Censys Platform.
censys.com/blog/the-end...

Securing federal cloud environments: CISA SCuBA reminds cloud service providers of the basics These steps are essential for maintaining strong cybersecurity hygiene and preventing many of the attacks organizations face today.

CISA's SCuBA reminds us: strong government cloud security starts with strong fundamentals. 🔐 Censys' lead federal solutions engineer calls for a return to basics in @federalnewsnetwork.com federalnewsnetwork.com/commentary/2...

The End of Stale Indicators Far too often, indicator feeds are full of stale IPs—ones that were active months before they were ever added to a blocklist. We want to end the use of stale indicators.

Threat intel feeds can often be full of stale IP addresses and other indicators. We're trying to end all that.

censys.com/blog/the-end...