The week's signal: a long-running MikroTik RouterOS brute-force operation (VPSVAULT, AS215925) reversed a multi-week decline — adding a second node and climbing back to ~1.9M sessions against the management API. Rented infrastructure, inventorying the edge. 🔗 www.greynoise.io/resources/at...

We're in Toronto for CrowdStrike #CrowdTour2026 tomorrow, May 28th! Attending the event or local to the area? We'd love to connect. Book time with our team: info.greynoise.io/crowdtour-20...

Got questions? We've got answers. Tune in tomorrow at 12 ET for GreyNoise University LIVE! 📺

We measured 11 major IP blocklists against 119,842 malicious IPs we observed on one day. The best feed covered less than 5%. Most were under 2%. Your blocklist isn't broken. It was built for a slower threat landscape. Full breakdown ⬇️

A scanning pattern similar to the one preceding CVE-2026-0400 in February is active again. May 12 saw the largest single-day session volume on this SonicWall tag in 90 days. #GreyNoise #ThreatIntel #SonicWall

GreyNoise enrichment is now built into #IOC Insight Cards so you get behavioral signals, classification data, and validated #OSINT from 10,000+ #CTI sources, in one place. feedly.com/new-features...

The mission: make sure no attack works twice. 🚀 We're hiring a Detection Engineer and a Federal Customer Success Manager to help us get there. Remote-friendly, high-impact, great benefits. Sound like you? 👇 www.greynoise.io/careers

May the 4th be with you + so be the signal. 🚀 The April Noiseletter is live: Project Swarm is open to the global security community, new research drops, and a packed events calendar. Let's get into it. 👇

Today's the perfect day for a matinee double feature: GreyNoise University LIVE: www.greynoise.io/events/greyn... The Invisible Army: What 4 Billion Sessions Reveal About Residential Proxy Abuse Webinar: info.greynoise.io/webinar/invi...

We're so back, after taking last month off, we are refreshed + ready for April's GreyNoise University LIVE!! 📺 Tune in TOMORROW at 12 ET! www.greynoise.io/events/greyn...

Introducing Project Swarm: a research initiative to defend the network edge and we're inviting you to join. Deploy a sensor on your infrastructure, capture real attacker traffic + compare what's hitting you to the GreyNoise global baseline. Join today! 🐝

Residential proxies, sleep cycles, and 4 BILLION sessions 👀 Join us Thursday, April 30th at 2pm ET to see why IP reputation is broken against home traffic + what actually works instead. Save your spot now 👇

GN At The Edge: 4 themes dominated activity on our sensor network: recon, exploitation, brute-force, + botnet recruitment. Top story: a broad credential and configuration discovery campaign with ~6.2M sessions across hundreds of IPs hunting exposed .env, .git, AWS metadata, + path traversal.

11 hosting ASNs appeared in pre-disclosure surges across 3+ vendor families. When targeting concentrates, lead time drops from 21 days to 7.5. The infrastructure behind these surges is recognizable.

My team at @greynoise.io is hiring a Junior Detection Engineer - somebody who understands network traffic and can write detection rules. Hit me up if you have any questions! job-boards.greenhouse.io/greynoiseint...

See you in Glasgow for #CyberUK! 🇬🇧 Find GreyNoise at Booth D2 + catch our talks: 🗓 Apr 22, 12:20 – Nishawn Smagh 🗓 Apr 23, 14:30 – Glenn Thorpe III Happy Hour @ Golf Fang on Apr 22 ⛳️ Book 1:1 time: info.greynoise.io/cyberuk-meet... #CyberSecurity #ThreatIntelligence #GreyNoise

Atlanta!!! 🍑 We will be in town for the CrowdStrike #CrowdTour this week + we're kicking things off early with a Happy Hour TOMORROW! Come hang out with us from 4-6 at the Blue Moon Brewery & Grill. 🍻

The internet changes before the advisory drops. New from GreyNoise: activity surges preceded 33 CVEs across 16 vendor families with a median 11-day lead. The pattern holds up to rigorous testing.

39% of IPs targeting the edge are residential. Geolocation catches 0% of them. We analyzed 4 billion sessions and the findings break A LOT of assumptions. Join us April 30 at 2 PM ET as we unpack what's really hiding in your traffic.

Fortinet remains the #1 targeted perimeter vendor: • CVE-2026-35616 auth bypass: 1,535,690 sessions • SSL VPN brute-force: 116,753 sessions (trending ↑) • CISA KEV since April 6 See it on GreyNoise → www.greynoise.io/resources/at...

Attending #CYBERUK26 April 21-23 or local to Glasgow? Join our upcoming happy hour 🍻 where we'll have (mini) golf , grub, and good conversation! 🔗 info.greynoise.io/cyberuk-happ... #CyberSecurity #ThreatIntel

21 IPs generated nearly half of all RDP scanning on the internet in 48 hours. Then vanished — for the second time in 30 days. 🔗 www.greynoise.io/blog/ip-addr... #ThreatIntel #RDP #CyberSecurity #InfoSec #ThreatHunting

🚨We just shipped C2 Detection. Compromised edge devices call home to attacker infrastructure. The evidence is in your outbound logs...most teams just can’t see it. Now they can. 👀 Learn more ⬇

GreyNoise is on the move 🌍 Next up: CrowdTours (8 cities), Glasgow + Tampa It’s all in the March Noiseletter 🗞️ + fresh research (more coming soon 👀)

New GreyNoise Report: 39% of unique IPs targeting the edge come from home internet connections. They are everywhere, briefly — 78% appear at most twice before rotating. The rotation rate makes feed-based IP reputation structurally ineffective against this traffic. 🔗 www.greynoise.io/resources/in...

GreyNoise is headed to 🇸🇪 Stockholm for CrowdStrike #CrowdTour2026 on 🗓️ April 15th. Attending the event or local to the area? We’d love to connect. 🔗 Book a dedicated time to meet with our team here: lnkd.in/e4_FA-7h #CyberSecurity #CrowdStrike #GreyNoise #ThreatIntel #Stockholm

NEW: GreyNoise At The Edge Intel Brief (March 23-30) 187,998,900 sessions. 100 top source IPs. Daily volumes surged 4x mid-week as at least 4 new scanning operations activated simultaneously. Here's what we found: 🔗 www.greynoise.io/resources/at...

GreyNoise is proud to be sponsoring the CrowdStrike CrowdTour across 8 cities! 🌏 We’re excited to highlight how our integration with Falcon Next-Gen SIEM helps SOC teams stop chasing ghosts and start catching real threats. 👇Book a meeting with us here: info.greynoise.io/crowdtour-20...

Last week, half of all new scanning IPs observed by GreyNoise geolocated to Hong Kong. A quarter-million never completed a TCP handshake. The ones that did were scanning MySQL, SSH, SMB, and RDP across 20+ countries. One of these is the signal. The other is noise. www.greynoise.io/blog/ghost-f...

NEW: GreyNoise At The Edge Intel Brief (Mar 16–23) 200,886,675 sessions. 101 unique source IPs. Here's what we found: www.greynoise.io/resources/at...

New GreyNoise At The Edge brief: The internet's scanning infrastructure is reorganizing. UCLOUD (HK) surged +578% to become the #1 scanning ASN, now 15.6% of all observed traffic. Western providers declining simultaneously. 301.8M sessions. 439K IPs. Here's what we found.

Starting at the top of the hour! 🚨 Hope to see you there to break down all things State of the Edge with @andrewmorr.is, @hrbrmstr.dev + Shawn! There's still time to register 👉 info.greynoise.io/webinar/stat...

TOMORROW! 🚨 Join us for a fast-paced dive into the 2026 GreyNoise State of the Edge Report...from rogue residential botnets to 26-year-old CVEs still getting hammered. Save your spot and see what’s actually hitting the edge.

🚀 New GreyNoise + Google SecOps integrations are live. See which IPs scan everyone vs just you, now directly inside Google SecOps. 🧩 SIEM: Standardized ingestion, dashboards, YARA-L rules, and saved searches ⚡️ SOAR: v7.0 actions, webhooks, and playbooks to automate triage

Hey London! We are closing down day 1 at #ecrimecongress today + cant wait to see you tomorrow! If you're around, say hi to the team, watch a demo, and grab some great swag! 🔥

Edge attacks are evolving faster than your playbook. Join @andrewmorr.is, @hrbrmstr.dev + Shawn Smagh next Tuesday for a live breakdown of where edge targeting is concentrating, where defenses are failing, + what 162 days of internet-scale data says about your real exposure.

February was anything but quiet at GreyNoise, from our 2026 State of the Edge Report to new edge attack research, Ivanti + BeyondTrust deep dives, and a packed March of events, check it all out in this month's Noiseletter! 🚀

GreyNoise is now integrated across CrowdStrike Falcon. 🚀 Falcon users can bring GreyNoise IP classification into Next-Gen SIEM searches, Fusion SOAR playbooks, and Charlotte AI workflows to triage faster, cut background noise + prioritize real threats.

Here's a taste of what GreyNoise customers got in this week's At The Edge intelligence brief. 268M sessions. 540K unique IPs. Four findings that matter. Full brief: IOCs, attribution, recommendations. 🔗 www.greynoise.io/resources/at... greynoise.io/contact

Noise: analyzed. Security: certified. GreyNoise is now ISO 27001 certified 🔐 We spend our days tracking internet background noise and we hold ourselves to the same high security standards we expect from the ecosystem.

GreyNoise observed a coordinated campaign probing SonicWall firewalls to identify which devices have SSL VPN enabled — the prerequisite step before credential attacks. 4️⃣ infrastructure clusters, a commercial proxy service rotating thousands of IPs, and near-zero exploitation. This is target mapping.

🕵 What started as a simple "Hey, I keep seeing this string. Any ideas?" message kicked off an investigation finding a cryptostealing and database wiping operation. Follow the string in the latest GreyNoise Labs post: www.labs.greynoise.io/grimoire/202...

Join us today at 12pm ET for February’s GreyNoise University LIVE session, where you’ll get an overview of what’s new at GreyNoise, plus a live demo of our tools and latest product releases.

52% of RCE attempts came from IPs with no prior GreyNoise history. New research on where edge defenses fall short + what to do about it. #ThreatIntel #Cybersecurity #GreyNoise

This week's At the Edge: CLEAR is out — a preview of the intel brief GreyNoise customers get every week. 🔗 www.greynoise.io/resources/at... That's just the preview. greynoise.io/contact #ThreatIntel #CyberSecurity #GreyNoise

It took less than a day. A PoC for BeyondTrust CVE-2026-1731 hit GitHub, and GreyNoise immediately started seeing reconnaissance from multi-exploit actors hiding behind VPNs + custom tooling. See what our data reveals about who’s mapping targets + how.

Three campaigns. One has Cobalt Strike ready. RDP nearly quadrupled. A botnet picked up a new CVE. And someone built a Kubernetes cluster just to exploit n8n. A preview of what GreyNoise customers get every week. Full brief has the IOCs, attribution, and analysis.

We observed a 65% drop in global telnet traffic in 1 hour on Jan 14, settling into a sustained 59% reduction. 18 ASNs went silent, 5 countries disappeared, but cloud providers were unaffected. Our analysis of 51.2M sessions points to backbone-level port 23 filtering by a Tier 1 transit provider.

83% of observed Ivanti EPMM exploitation (CVE-2026-1281) traces to one bulletproof IP that isn't on any published IOC list. The IPs that are? VPN exits with zero Ivanti activity. We broke down who's actually doing this ⬇️ #Ivanti #ThreatIntel #CVE20261281 #InfoSec

Attackers are operating at machine speed + so should defenders. 🤖 Check out the Government Technology Insider article, where our Principal Intelligence Liaison, Shawn Smagh, shares what we’re seeing in the data and 4️⃣ steps to get to active defense at machine speed.