Looking forward to seeing folks this Thursday at 12 ET for another GreyNoise University LIVE. Join Michael + @itsjordyn.bsky.social for a fun and informative demo + walkthrough of all things GreyNoise. ✨

We've hired Colonel Shawn Smagh to up our @greynoise.io intel reporting game and we've started producing weekly intelligence briefs. This week's is a banger.

Who's in Montreal for #Suricon? I'm there speaking and representing @greynoise.io! Come say hi! We also have a very limited special giveaway. Pro tip: if people ask me for it then I don't have to work to give them away, so if you want a cool prototype thing then just ask!

EU sanctioned Stark Industries in May. Leaked docs gave them 12 days warning. Result: ASN shuffle, rebrand to THE.Hosting. Corporate shells changed, network behavior didn't. We tracked it: AS44477→AS209847. Packets don't lie.

Hey Canada, we're packed up + headed to #SuriCon25! 🇨🇦 Check out our booth and don't miss @ntkramer.bsky.social + @iagox86.bsky.social talk ...and if you happen to run into them or @hrbrmstr.dev around the con, they might have something special for you 🥧...

🚨 GreyNoise for @microsoft.com Sentinel is here! Filter out internet background noise automatically. Focus on real threats. #MicrosoftSentinel #AppAssure 🔗 techcommunity.microsoft.com/blog/Microso...

We’ve launched At The Edge, a weekly brief for GreyNoise customers highlighting shifts in attacker behavior seen across the Global Observation Grid (GOG). Human-led analysis that turns internet noise into insight defenders can act on. #ThreatIntel #GreyNoise

We deployed MCP honeypots to understand how threat actors engage with AI middleware exposed to the internet. What we observed was unexpected. Full analysis ⬇️ #GreyNoise #AI #AISecurity #MCP #MCPSecurity #Cybersecurity #ThreatIntel

GreyNoise has observed a surge in PHP exploitation activity since late summer — now peaking as attackers deploy cryptominers at scale. Full analysis ⬇️ #GreyNoise #PHP #ThreatIntel

Headed to #FalConEurope2025 this week? Come by booth 45 and chat with the team. On Wednesday, continue the conversation at our joint happy hour with Cribl + NetBuilder from 7-?? at Nobu Barcelona, sign up today! ⬇️

Happy Halloween from your fave GreyNerds 🍬🍫

Happy Halloween from the GreyNoise ghouls + goblins! This month's NoiseLetter is packed to the brim with tricks + treats, catch up on all the haunts from this past month and be sure to check back in later for the results of our annual Candy Bracket 🎃

Starting soon! 👽

Tune in for a very spooky GreyNoise University LIVE, tomorrow October 30th @ 12 ET. Sign up today, if you dare! 🕸️

We are excited to sponsor #FalConEurope2025 next week in Barcelona! If you're there come by booth 45, or want to meet up with the team, let us know!

see ya'll Friday 😈

Want an inside look at what happens when attackers pop our honeypots + AWS slides into our inbox? 📥 Check out Corey's latest blog ⬇️

big week in the morris household. we've started tracking ORBs at @greynoise.io and I'm shitposting again btw (h/t @hrbrmstr.dev)

Threat Actors Rotating New IPs Daily to Attack Microsoft RDP Full Analysis ⬇️ #RDP #GreyNoise #ThreatIntel

GreyNoise's Threat Intelligence Map visualizes network events across the internet, scans, probes, attacks + connects them to geopolitical context. Real-time intelligence, that looks pretty cool too 😎 🗺️ threat-map.greynoise.io

Amid the security incident involving F5 BIG-IP announced today, GreyNoise is sharing recent insights into activity targeting BIG-IP to aid in defensive posturing. The anomalies reported in our blog may not necessarily relate to the 15 Oct incident. ⬇️

A global botnet has tripled in size in the past five days, so GreyNoise is sharing an executive situation report (SITREP) to streamline decision making. Full SITREP: info.greynoise.io/hubfs/Situat...

Attacker infrastructure evolves in real time. Your defenses should too. Introducing GreyNoise Block, ensuring your blocklists update automatically. 🦾

Hey #CriblCon25! 👋 Looking forward to seeing you soon! 👻🤝🐐

A 100,000-IP botnet is actively targeting U.S. RDP infrastructure. 🔗 Read the analysis 👇 #Cybersecurity #RDP #Botnet #GreyNoise

The GreyNoise team will be at #CriblCon next week and we would love to see you there! If you are headed to Maryland for the event, check out our booth and talk to the team. 👻🤝🐐 🔗 events.cribl.io/criblcon25/b...

GreyNoise has linked three concurrent campaigns targeting remote-access technologies — Palo Alto login attempts, Fortinet SSL VPN brute-forcing, and Cisco ASA scanning — all partially driven by the same threat actor(s) [High Confidence]. Full analysis 👇 #Palo #Cisco #Fortinet #ThreatIntel

GreyNoise Feeds are here: real-time webhook alerts for CVE status changes, exploitation spikes, and IP classification changes. No more polling. Respond the moment threats emerge. 🦾

Palo login attempts are escalating, potentially driven by iteration through a large credential dataset. GreyNoise is sharing observed usernames/passwords for defender review. 🔗 Latest: www.greynoise.io/blog/palo-al... #PaloAltoNetworks #ThreatIntel

NoiseLetter, but make it fashionably late... 💅 We were at our company offsite, but we're back with our new GreyNoise MCP Server launch, Cisco ASA zero-day and VPN brute force insights, plus upcoming events, let's get into it!

GreyNoise observed a ~500% surge in IPs scanning Palo Alto Networks login portals on October 3, 2025 — the highest level we’ve seen in 90 days. Read our full analysis here 👇 #PaloAltoNetworks #PaloAlto #GreyNoise #ThreatIntel #PANOS

On 28 September, GreyNoise observed a sharp one-day surge in attempts to exploit Grafana CVE-2021-43798. Full analysis & malicious IPs ⬇️ #Grafana #GreyNoise #ThreatIntel

We got (most of) the team together last week and it was magical, so grateful for each + every one of these GreyNoids ✨

GreyNoise now has coverage for Cisco zero-days CVE-2025-20333 and CVE-2025-20362. Watch for exploit attempts in real-time: CVE-2025-20333 (Net new): viz.greynoise.io/tags/cisco-a... CVE-2025-20362 (Updated tag): viz.greynoise.io/tags/cisco-a... #CiscoASA #ZeroDay #CVE202520333 #CVE202520362

🚨GreyNoise has published a new Situation Report on Cisco ASA reconnaissance activity we observed before the new zero-days were disclosed. Read the full report: info.greynoise.io/hubfs/Situat... #Cisco #ASA #CiscoASA #GreyNoise #ThreatIntel #CVE202520333 #CVE202520362

Sept 25: Cisco disclosed two ASA/FTD zero-days (#CVE-2025-20333, #CVE-2025-20362). Weeks earlier, GreyNoise saw 25k IPs scanning ASA — another case of recon surges preceding disclosures. Read the update: www.greynoise.io/blog/scannin... #CiscoASA #ZeroDay #Cisco

Hey Toronto! 🇨🇦 We will be up North next week with runZero for #SecTor! Come hang out on Wednesday for some drinks + good conversation! 🔗 www.runzero.com/sector-happy...

🗣️ Catch Dio9sys' talk this weekend at #PancakesCon! ⏰ Sunday, 9/21 from 12:20–1:00 PM CT 🎤 One-liners and One Needle: Bash and Needlebinding 📺 www.youtube.com/live/P4Shsxw...

LIVE in 15 ⏲️

GreyNoise Intel is now accessible via MCP! AI agents and SOCs can triage, respond, and monitor threats with real-time IP reputation + behavior tags. Automate remediation, reduce false positives, + prioritize active threats. Learn more ⬇️

GreyNoise University LIVE is back from a little summer break and ready to dive into demos, events, updates + dad jokes. Catch up with us TOMORROW at 12 ET! 📺

We're looking for some awesome folks to join our team! If one of these roles catches your eye, we'd love to hear from you. 👩‍💻 greynoise.io/careers

Our very own @dtg.bsky.social is dropping knowledge on how to outsmart malicious AI in his latest feature. 🤖

See you soon! @hrbrmstr.dev + Noah are bringing a jam-packed webinar getting into our most recent report, Early Warning Signals: When Attacker Activity Precedes New Vulns, you’ll definitely want to tune in. 📺

Hey London 👋🇬🇧 Join us Sept 11 at the Crowne Plaza Docklands during #DSEI for a GreyNoise Threat Brief! Insights, drinks, light fare, networking, limited swag + CPE credits all waiting for you!🍻 ⏰ 16:30–18:30 👇 Save your spot today!

GreyNoise observed two scanning surges against Cisco ASA devices in late August, both representing significant elevations above baseline. This activity led to the discovery of a botnet cluster solely scanning for Cisco ASA on August 26. #CiscoASA #Cisco #GreyNoise #Cybersecurity #ThreatIntel

We survived August in the desert, with fresh insights on early warning signals, 73 new threat tags, + lots of upcoming events. Check out August's NoiseLetter for everything you need to know this month. ☀️

We’re honored that GreyNoise Intelligence was acknowledged in the latest joint cyber advisory from the NSA Cybersecurity Collaboration Center and partner agencies. Read the full advisory here: media.defense.gov/2025/Aug/22/... #GreyNoise #Cybersecurity #ThreatIntelligence

30,000+ IPs hit Microsoft Remote Desktop on Aug 24, a significant escalation from our original reporting of nearly 2,000 IPs on August 21. Full analysis: www.greynoise.io/blog/surge-m... #ThreatIntel #RDP #Cybersecurity #IncidentResponse #GreyNoise #SOC #VulnerabilityManagement #MicrosoftRDP

On August 21, GreyNoise observed nearly 2,000 malicious IPs probing Microsoft Remote Desktop (RDP) services in a single day — a sharp deviation from baseline activity. Full blog: www.greynoise.io/blog/surge-m... #ThreatIntel #RDP #Cybersecurity #GreyNoise #Analysis #RemoteDesktop