MSSP Alert covers how Censys is embedding real-time Internet context and risk scoring directly into SOC workflows—closing the visibility gap that slows investigations. Read the full article: https://bit.ly/422RYf5

Announcing new capabilities allowing SOCs to move faster. Real-time authoritative Internet context delivered directly into workflows with: ✔️Real-Time Internet Context ✔️Real-Time Adversary Infrastructure Intelligence ✔️Reputation-Based Risk Scoring ✔️Expanded Intelligence censys.com/blog/censys-...

Censys researchers warned that thousands of devices are exposed to the Iranian government’s campaign targeting energy, water, and U.S. government services and facilities. via @mattkapko.com www.youtube.com/watch?v=Qe87... | cyberscoop.com/iran-attacke...

🌐 In new research, Censys ARC Principal Security Researcher Andrew Northern shares a technique-based approach to hunting web-delivered malware. Read for Censys infrastructure analysis, indicators of compromise & practical defense guidance for security teams censys.com/blog/techniq...

Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework Censys censys.com/blog/under-c... @censys.bsky.social

Today, we announced $70m in Series D & debt financing to accelerate our Internet Intelligence platform and the next generation of AI-driven security workflows. We provide first-party, real-time visibility into global Internet infrastructure. censys.com/blog/70-mill...

⌨️ New from #CensysARC: Previously undocumented “𝗖𝗧𝗥𝗟” .NET access framework — combining phishing, keylogging, RDP hijacking, and reverse tunneling. Active infra. No public intel. censys.com/blog/under-c...

🚨CVE-2026-3055 (CVSS 9.3) Unauth OOB read in Citrix NetScaler (SAML IDP) 🔎 #CensysARC observes 173K exposed Web Properties ⚠️ Attackers could read sensitive memory contents 🛠️ Patch now https://censys.com/advisory/cve-2026-3055/

Cyberattacks on healthcare don’t just hit data - they disrupt operations. An attack on Stryker (claimed by Iran-linked group #Handala) impacted manufacturing and shipping. www.securityweek.com/iranian-hack... Protecting healthcare systems starts with visibility: www.censys.com/blog/state-o...

We have introduced additional fingerprints for various remote monitoring and management (RMM) tools, as well as enhanced protocol and application scanners. For more info, please visit: docs.censys.com/changelog Stay informed by subscribing to our updates via RSS: docs.censys.com/changelog.rss

🚨Critical: CVE-2026-22557 CVSS 10.0 unauthenticated remote path traversal vulnerability in Ubiquiti UniFi Network Application ⚠️ Attacker could access and manipulate system files w/potential for account takeover 🔎 Censys sees 87,196 exposed hosts 🛠️ Patches immediately censys.com/advisory/cve...

Critical vulnerability: CVE-2026-32746 is a pre-authentication remote code execution (RCE) in the telnet daemon 🛠️ Affects GNU Inetutils telnetd through version 2.7 🔎 Censys sees ~3,362 exposed hosts 🔴 Exploitation could grant an attacker control of the host censys.com/advisory/cve... #CVE202632746

New Censys ARC™ Exposure Brief examines cyberattack on Stryker attributed to the Iran-linked group #Handala. Censys observed ~2,000 internet-facing hosts tied to the company, including 150+ login interfaces — illustrating how complex enterprise attack surfaces can be. censys.com/blog/iranian...

If your SIEM runs on patchwork enrichment and stale Internet context, AI just produces faster delusions. First-party Internet visibility is the missing layer. Censys brings the Internet intelligence layer that helps your AI SOC succeed. More ➡️https://censys.com/blog/what-ai-is-missing-modern-soc/

Multiple US gov agencies have warned orgs to stay vigilant for potential Iran-affiliated cyber activity. We studied exposure of 4 vendors previously known to be of interest to IR-affiliated groups. Read more: censys.com/blog/ics-ira...

🔌 #Iran Internet #Outage Update ---- June 21 marked lowest visibility—but signs of recovery. 📉 Some networks (e.g., DATAK, HAMYAR-AS) remain unstable. 📈 Others (e.g., RESPINA-AS, MOBINNET-AS) are bouncing back strong. View at #Censys: censys.com/blog/irans-i...

🔍 We looked at the C2 server associated with the Flodrix botnet and used an internet-exposed RPC service to uncover a world-readable NFS mount and 745 compromised hosts! 👀 censys.com/blog/poking-...

Around 12PM UTC on June 18, scan error rates in Iran surged to nearly 100%, indicating a sudden, nationwide outage affecting almost all services. Systems that were previously reachable are now timing out or rejecting connections.

We used the new Censys Threat Hunting Module to investigate a Colombian threat actor, uncovering a series of remote access trojan (RAT) C2 servers. We also show how to use this information to create a set of IOCs for defensive measures: censys.com/blog/unmaski...

A defining moment for Censys - We are excited to announce that the Threat Hunting Module in the new Censys Platform is now #GA! www.censys.com/blog/interne...

Great research. They found 400 web-based HMIs for US water facilities exposed online. All used same HMI/SCADA software. Some required credentials to access, some were in read-only mode and couldn't be manipulated. But 40 systems didn't require authentication and were fully controllable via internet

In October 2024, Censys researchers discovered ~400 U.S. water facility web-based HMIs exposed online. Within a month of sharing data with the EPA and the vendor, 58% of systems were protected. Read more here: censys.com/blog/turning...

Thousands of compromised ASUS routers are being co-opted into a volatile but persistent botnet. Our latest blog takes IoCs from @greynoise.io and breaks down how the AyySSHush campaign has evolved over the past 5 months — and what makes it stand out: censys.com/blog/trackin...

Trend Micro recently uncovered a campaign abusing TikTok to distribute malware via AI-generated videos, tricking users into installing infostealers. Using IOCs provided by Trend Micro, we found more related infrastructure, including a newer bulletproof service provider: censys.com/blog/tiktok-...

The Censys Research Team evaluated Censys’s IPv4 scanning capability against other engines and found that while these alternatives sometimes self-report higher numbers of results, their data is often stale and inaccurate. censys.com/blog/the-imp...

Our latest video dives into the details of CVE-2025-3248, a critical flaw in the Langflow, an open source Python app, that is being exploited in the wild. youtu.be/vK4iYy_A130?...

New @censys.bsky.social video on the Langflow CVE-2025-3248 bug and the ongoing exploitation. youtu.be/vK4iYy_A130?...

Threat hunting tools should be built for speed and designed by threat hunters. Now they are. The Censys Threat Module: ⏱️ Speeds up investigations 🌐 Surfaces enriched threat context 📈 Enables real-time pivoting Act faster. Hunt smarter. See how: censys.com/blog/speedin...

If you think Salt Typhoon has moved on—you might want to double-check your attack surface. We’re still seeing critical telecom infrastructure exposed to active targeting. Find out what we uncovered (and what you should be looking for) censys.com/blog/salt-ty...

Censys was a proud contributor to the 2025 Verizon Data Breach Investigations Report, shedding light on the growing threat to firewalls, VPNs, and other perimeter gear. See that this sharp increase in targeting edge security devices means ➡️ censys.com/blog/postcar...

Zero days attract a huge amount of attention in the security community, an amount that is completely disproportionate to how many of these vulnerabilities emerge each year and how often they’re actually used. They’re the Cybertrucks of security. censys.com/blog/google-...

From an attacker’s perspective it makes perfect sense to target enterprise products, especially networking and security appliances. Those devices can grant a successful adversary broad access to the target organization, and there are often many different options. censys.com/blog/google-...

See every port. Secure every protocol. 🔐 The new Censys Ports & Protocols Dashboard is your exposure command center. Find out how we're helping SOC teams pinpoint exposures, track protocol misconfigurations, and close compliance gaps faster. censys.com/blog/introdu...

Whether you're at RSA Conference this week or dealing with #RSAC2025 FOMO, we've got your next stop. Join us May 6-8 in Baltimore to connect and collaborate with security leaders across the military and government sectors.

Our monitoring flagged a single host containing the source code for a command-and-control (C2) server, a backdoor, and a trojan dropper build system—a set of tools that (to our knowledge) has not been publicly documented before. censys.com/blog/scoutin...

When the AI hype is real. 🎆 The new Censys Query Assistant brings 2+ years of R&D into a tool that makes threat investigation faster, easier, and smarter. Find out how we're bringing the power of natural language search to security teams. censys.com/blog/acceler...

Threat hunters, this is your inside track. 🎥 We just dropped an exclusive threat intelligence briefing from malware analyst Silas Cutler. Get insight into the BeaverTail malware campaign, North Korea’s infiltration of global tech, and more. Watch now. censys.com/podcasts-vid...

🚨 Launch Alert 🚨Censys just redefined threat hunting. Our new Threat Hunting Module delivers unmatched visibility and context from real-time Internet Intelligence that empowers you to proactively hunt emerging threats. See it in action: censys.com/solutions/th... #cybersecurity #threathunting

Fresh new video with @silascutler.bsky.social and @dennisf.bsky.social discussing the BeaverTail and InvisibleFerret malware and the DPRK threat actor landscape. youtu.be/z-KImQiHRck?...

With our new Threat module, Censys is focused on delivering timely, actionable and context rich information. Over the past few months, we've been tracking a part of BeaverTail deployments used to serve the InvisibleFerret malware in a Collection in the Censys Platform. censys.com/blog/the-end...

CISA's SCuBA reminds us: strong government cloud security starts with strong fundamentals. 🔐 Censys' lead federal solutions engineer calls for a return to basics in @federalnewsnetwork.com federalnewsnetwork.com/commentary/2...

Threat intel feeds can often be full of stale IP addresses and other indicators. We're trying to end all that. censys.com/blog/the-end...

Data from the new Verizon DBIR shows a spike in the number of breaches that involved vulnerability exploitation as an initial access vector--now up to 20% of breaches. censys.com/blog/postcar...

The botnets are out there, you just have to know how to grab them. See, we know how to grab them. censys.com/blog/hunting...

Pulling together the power of @censys.bsky.social and @greynoise.io brings threat hunting to the next level. censys.com/blog/hunting...

When you're looking for a specific protocol or service on the internet, checking the standard port is a great place to start. But more and more often, protocols such as HTTP and more esoteric ones are showing up on non-standard ports. We dig into why that is. youtu.be/qr6Xdl9WfLM?...

New @censys.bsky.social video with me and the brilliant Ariana Mirian talking about finding various services on weird ports. youtu.be/qr6Xdl9WfLM?...

Your attack surface is bigger than you think. 👀 Here's how to find the external threats other tools miss. Read the new Frost: Radar report on EASM for more. censys.com/reports/fros...