Check out @hrbrmstr.dev today on @huntress.com's Tradecraft Tuesday at 1pm ET to chat about all things #React2Shell. 🤘 🔗 www.huntress.com/upcoming-web...

New on the GreyNoise blog: We borrow from some unexpected fields, enzyme kinetics, species biodiversity models, astrophotography, to understand internet-wide scanning activity and measure what we might be missing. #GreyNoise #Cybersecurity

🚨 We are hiring across sales, alliances, and customer experience for our US + EMEA teams 🌍 See a role you'd crush? We would love to hear from you! 👉 Apply now: greynoise.io/careers #hiring #cybersecuritycareers

GreyNoise analyzed activity targeting exposed Ollama and LLM infrastructure, identifying SSRF abuse attempts and large-scale probing of LLM model endpoints. #GreyNoise #ThreatIntelligence #LLMSecurity

All internet traffic from Iran ceased in @greynoise.io one hour ago. Tier 1 dropped off two hours ago.

Ransomware starts with reconnaissance: we observed a recent large-scale scanning campaign validating exploitable systems, data that feeds the initial access market and shows up later in real attacks. 🕵️‍♀️ #GreyNoise #Ransomware #InitialAccess #IAB #Recon

Back from the holidays and afraid to open your inbox? Same. Open the latest NoiseLetter instead.

React2Shell Update – 7 January 2026 Full update & analysis ⬇️ #GreyNoise #React2Shell

New year, new opportunities? Check out our current openings for a new start in the new year! 🪩🎉 🔗 greynoise.io/careers

See ya'll in 10 ⏳

GreyNoise is tracking a coordinated credential-based campaign targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect. #Cisco #PaloAltoNetworks #GreyNoise #VPN #CiscoSSLVPN #GlobalProtect #ThreatIntel

See you all TOMORROW at 12ET for our last GreyNoise University LIVE of the year! ✨

Update: Analyzing React2Shell payloads. Full breakdown from @hrbrmstr.dev 👇 #React2Shell #Nextjs #CVE202555182

Just in: Watch #React2Shell exploitation unfold over time in the map below (geo of source IPs attempting to exploit CVE-2025-55182). #GreyNoise #ThreatIntel #CVE202555182 #Nextjs #Cybersecurity

Ron & my talk from SuriCon 2025 | Abusing HTTP Quirks to Evade Detection I think it turned out pretty well; pardon the disco effect where a stage light was failing :) www.youtube.com/watc... CC: @iagox86.bsky.social @greynoise.io

Lots of React4Shell in @greynoise.io. Visualization a la @hrbrmstr.dev

Going LIVE in 30 to talk all things React2Shell with the Storm ⚡️ Watch crew! www.linkedin.com/events/storm...

👀 React2Shell attacker profiles fresh from GreyNoise telemetry: info.greynoise.io/hubfs/PDFs-S..., don't miss the latest contribution from GreyNoise Labs on React2Shell: www.labs.greynoise.io/grimoire/202... #React2Shell #Nextjs #CVE202555182 #CVE #GreyNoise

React2Shell blog update 🚨 compromised Next.js nodes are rapidly being enlisted into botnets; threat actor activity reaches ~80 source countries; and more. #React2Shell #Nextjs #GreyNoise #ThreatIntel

London, we are headed your way THIS week! See you there!

React Server CVE-2025-55182 popping off in @greynoise.io right now. Blog from @hrbrmstr.dev up: www.greynoise.io/blog/cve-202...

CVE-2025-55182 (React2Shell) attacks have begun. We are seeing broad automated exploitation, PoE math probes, encoded PS stagers, and AMSI bypass attempts, with botnets already adding the vuln. Patch fast. Watch your logs.

Palo + SonicWall campaign uncovered. We dug into a spike of GlobalProtect login attempts earlier this week and found something unexpected. Full analysis: www.greynoise.io/blog/hidden-... #Palo #SonicWall #Cybersecurity

Headed to BlackHat EU? 🇬🇧 Swing by the @corelight-inc.bsky.social + GreyNoise booth for a chat and then grab drinks with the team after the con on Wednesday, Dec 10th. Sign up today to reserve your spot!

The holiday season brings travel, warm drinks, and... serving as the family IT help desk. Check it all out in November's NoiseLetter ❄️

Check out @hrbrmstr.dev's convo with @npr.org about the spike in inventive holiday cyber scams, from fake shipping alerts to bogus charity requests. ’Tis the season for scammers, so slow down, double-check links, + stay safe out there. 🎁🔒

This holiday season, run our IP Check at your family’s house, a free tool that answers a question we hear constantly: "How do I know if my home network has been compromised?" www.greynoise.io/blog/your-ip...

LIVE in 8! 🚨

🚨 Palo Alto GlobalProtect scanning surged 40X in 24hrs...a 90-day high. 2.3M login attempts from concentrated infrastructure (AS200373/AS208885). Block these IPs now ⬇️

Attackers move fast, so your blocklists should too. GreyNoise now lets you convert any query into a real-time blocklist that updates automatically as attacker infrastructure changes. Start using it today on the GreyNoise platform.

Looking forward to seeing folks this Thursday at 12 ET for another GreyNoise University LIVE. Join Michael + @itsjordyn.bsky.social for a fun and informative demo + walkthrough of all things GreyNoise. ✨

We've hired Colonel Shawn Smagh to up our @greynoise.io intel reporting game and we've started producing weekly intelligence briefs. This week's is a banger.

Who's in Montreal for #Suricon? I'm there speaking and representing @greynoise.io! Come say hi! We also have a very limited special giveaway. Pro tip: if people ask me for it then I don't have to work to give them away, so if you want a cool prototype thing then just ask!

EU sanctioned Stark Industries in May. Leaked docs gave them 12 days warning. Result: ASN shuffle, rebrand to THE.Hosting. Corporate shells changed, network behavior didn't. We tracked it: AS44477→AS209847. Packets don't lie.

Hey Canada, we're packed up + headed to #SuriCon25! 🇨🇦 Check out our booth and don't miss @ntkramer.bsky.social + @iagox86.bsky.social talk ...and if you happen to run into them or @hrbrmstr.dev around the con, they might have something special for you 🥧...

🚨 GreyNoise for @microsoft.com Sentinel is here! Filter out internet background noise automatically. Focus on real threats. #MicrosoftSentinel #AppAssure 🔗 techcommunity.microsoft.com/blog/Microso...

We’ve launched At The Edge, a weekly brief for GreyNoise customers highlighting shifts in attacker behavior seen across the Global Observation Grid (GOG). Human-led analysis that turns internet noise into insight defenders can act on. #ThreatIntel #GreyNoise

We deployed MCP honeypots to understand how threat actors engage with AI middleware exposed to the internet. What we observed was unexpected. Full analysis ⬇️ #GreyNoise #AI #AISecurity #MCP #MCPSecurity #Cybersecurity #ThreatIntel

GreyNoise has observed a surge in PHP exploitation activity since late summer — now peaking as attackers deploy cryptominers at scale. Full analysis ⬇️ #GreyNoise #PHP #ThreatIntel

Headed to #FalConEurope2025 this week? Come by booth 45 and chat with the team. On Wednesday, continue the conversation at our joint happy hour with Cribl + NetBuilder from 7-?? at Nobu Barcelona, sign up today! ⬇️

Happy Halloween from your fave GreyNerds 🍬🍫

Happy Halloween from the GreyNoise ghouls + goblins! This month's NoiseLetter is packed to the brim with tricks + treats, catch up on all the haunts from this past month and be sure to check back in later for the results of our annual Candy Bracket 🎃

Starting soon! 👽

Tune in for a very spooky GreyNoise University LIVE, tomorrow October 30th @ 12 ET. Sign up today, if you dare! 🕸️

We are excited to sponsor #FalConEurope2025 next week in Barcelona! If you're there come by booth 45, or want to meet up with the team, let us know!

see ya'll Friday 😈

Want an inside look at what happens when attackers pop our honeypots + AWS slides into our inbox? 📥 Check out Corey's latest blog ⬇️

big week in the morris household. we've started tracking ORBs at @greynoise.io and I'm shitposting again btw (h/t @hrbrmstr.dev)

Threat Actors Rotating New IPs Daily to Attack Microsoft RDP Full Analysis ⬇️ #RDP #GreyNoise #ThreatIntel

GreyNoise's Threat Intelligence Map visualizes network events across the internet, scans, probes, attacks + connects them to geopolitical context. Real-time intelligence, that looks pretty cool too 😎 🗺️ threat-map.greynoise.io