Multiple US gov agencies have warned orgs to stay vigilant for potential Iran-affiliated cyber activity. We studied exposure of 4 vendors previously known to be of interest to IR-affiliated groups. Read more: censys.com/blog/ics-ira...

🔌 #Iran Internet #Outage Update ---- June 21 marked lowest visibility—but signs of recovery. 📉 Some networks (e.g., DATAK, HAMYAR-AS) remain unstable. 📈 Others (e.g., RESPINA-AS, MOBINNET-AS) are bouncing back strong. View at #Censys: censys.com/blog/irans-i...

🔍 We looked at the C2 server associated with the Flodrix botnet and used an internet-exposed RPC service to uncover a world-readable NFS mount and 745 compromised hosts! 👀 censys.com/blog/poking-...

Around 12PM UTC on June 18, scan error rates in Iran surged to nearly 100%, indicating a sudden, nationwide outage affecting almost all services. Systems that were previously reachable are now timing out or rejecting connections.

We used the new Censys Threat Hunting Module to investigate a Colombian threat actor, uncovering a series of remote access trojan (RAT) C2 servers. We also show how to use this information to create a set of IOCs for defensive measures: censys.com/blog/unmaski...

A defining moment for Censys - We are excited to announce that the Threat Hunting Module in the new Censys Platform is now #GA! www.censys.com/blog/interne...

Great research. They found 400 web-based HMIs for US water facilities exposed online. All used same HMI/SCADA software. Some required credentials to access, some were in read-only mode and couldn't be manipulated. But 40 systems didn't require authentication and were fully controllable via internet

In October 2024, Censys researchers discovered ~400 U.S. water facility web-based HMIs exposed online. Within a month of sharing data with the EPA and the vendor, 58% of systems were protected. Read more here: censys.com/blog/turning...

Thousands of compromised ASUS routers are being co-opted into a volatile but persistent botnet. Our latest blog takes IoCs from @greynoise.io and breaks down how the AyySSHush campaign has evolved over the past 5 months — and what makes it stand out: censys.com/blog/trackin...

Trend Micro recently uncovered a campaign abusing TikTok to distribute malware via AI-generated videos, tricking users into installing infostealers. Using IOCs provided by Trend Micro, we found more related infrastructure, including a newer bulletproof service provider: censys.com/blog/tiktok-...

The Censys Research Team evaluated Censys’s IPv4 scanning capability against other engines and found that while these alternatives sometimes self-report higher numbers of results, their data is often stale and inaccurate. censys.com/blog/the-imp...

Our latest video dives into the details of CVE-2025-3248, a critical flaw in the Langflow, an open source Python app, that is being exploited in the wild. youtu.be/vK4iYy_A130?...

New @censys.bsky.social video on the Langflow CVE-2025-3248 bug and the ongoing exploitation. youtu.be/vK4iYy_A130?...

Threat hunting tools should be built for speed and designed by threat hunters. Now they are. The Censys Threat Module: ⏱️ Speeds up investigations 🌐 Surfaces enriched threat context 📈 Enables real-time pivoting Act faster. Hunt smarter. See how: censys.com/blog/speedin...

If you think Salt Typhoon has moved on—you might want to double-check your attack surface. We’re still seeing critical telecom infrastructure exposed to active targeting. Find out what we uncovered (and what you should be looking for) censys.com/blog/salt-ty...

Censys was a proud contributor to the 2025 Verizon Data Breach Investigations Report, shedding light on the growing threat to firewalls, VPNs, and other perimeter gear. See that this sharp increase in targeting edge security devices means ➡️ censys.com/blog/postcar...

Zero days attract a huge amount of attention in the security community, an amount that is completely disproportionate to how many of these vulnerabilities emerge each year and how often they’re actually used. They’re the Cybertrucks of security. censys.com/blog/google-...

From an attacker’s perspective it makes perfect sense to target enterprise products, especially networking and security appliances. Those devices can grant a successful adversary broad access to the target organization, and there are often many different options. censys.com/blog/google-...

See every port. Secure every protocol. 🔐 The new Censys Ports & Protocols Dashboard is your exposure command center. Find out how we're helping SOC teams pinpoint exposures, track protocol misconfigurations, and close compliance gaps faster. censys.com/blog/introdu...

Whether you're at RSA Conference this week or dealing with #RSAC2025 FOMO, we've got your next stop. Join us May 6-8 in Baltimore to connect and collaborate with security leaders across the military and government sectors.

Our monitoring flagged a single host containing the source code for a command-and-control (C2) server, a backdoor, and a trojan dropper build system—a set of tools that (to our knowledge) has not been publicly documented before. censys.com/blog/scoutin...

When the AI hype is real. 🎆 The new Censys Query Assistant brings 2+ years of R&D into a tool that makes threat investigation faster, easier, and smarter. Find out how we're bringing the power of natural language search to security teams. censys.com/blog/acceler...

Threat hunters, this is your inside track. 🎥 We just dropped an exclusive threat intelligence briefing from malware analyst Silas Cutler. Get insight into the BeaverTail malware campaign, North Korea’s infiltration of global tech, and more. Watch now. censys.com/podcasts-vid...

🚨 Launch Alert 🚨Censys just redefined threat hunting. Our new Threat Hunting Module delivers unmatched visibility and context from real-time Internet Intelligence that empowers you to proactively hunt emerging threats. See it in action: censys.com/solutions/th... #cybersecurity #threathunting

Fresh new video with @silascutler.bsky.social and @dennisf.bsky.social discussing the BeaverTail and InvisibleFerret malware and the DPRK threat actor landscape. youtu.be/z-KImQiHRck?...

With our new Threat module, Censys is focused on delivering timely, actionable and context rich information. Over the past few months, we've been tracking a part of BeaverTail deployments used to serve the InvisibleFerret malware in a Collection in the Censys Platform. censys.com/blog/the-end...

CISA's SCuBA reminds us: strong government cloud security starts with strong fundamentals. 🔐 Censys' lead federal solutions engineer calls for a return to basics in @federalnewsnetwork.com federalnewsnetwork.com/commentary/2...

Threat intel feeds can often be full of stale IP addresses and other indicators. We're trying to end all that. censys.com/blog/the-end...

Data from the new Verizon DBIR shows a spike in the number of breaches that involved vulnerability exploitation as an initial access vector--now up to 20% of breaches. censys.com/blog/postcar...

The botnets are out there, you just have to know how to grab them. See, we know how to grab them. censys.com/blog/hunting...

Pulling together the power of @censys.bsky.social and @greynoise.io brings threat hunting to the next level. censys.com/blog/hunting...

When you're looking for a specific protocol or service on the internet, checking the standard port is a great place to start. But more and more often, protocols such as HTTP and more esoteric ones are showing up on non-standard ports. We dig into why that is. youtu.be/qr6Xdl9WfLM?...

New @censys.bsky.social video with me and the brilliant Ariana Mirian talking about finding various services on weird ports. youtu.be/qr6Xdl9WfLM?...

Your attack surface is bigger than you think. 👀 Here's how to find the external threats other tools miss. Read the new Frost: Radar report on EASM for more. censys.com/reports/fros...

📢 #RSAC2025 speaking session announcement! Join Celestine Jahren (Censys) & Allison Wikoff (PwC) to uncover evolving attacker playbooks, geopolitical shifts, and strategies to disrupt threats early. Add to your calendar now➡️ www.addevent.com/event/mH2524...

👀 It has been quite a wild week in the land of CVEs. Get the Censys research team perspective in our latest blog, "Now You CVE, Now You Don't: How the MITRE CVE Program Nearly Went Dark". censys.com/blog/now-you...

It’s unclear what exactly would have happened if the MITRE contract had actually expired, but we’ve already gotten a small glimpse of one potential future. censys.com/blog/now-you...

🚨 Today on Storm⚡ Watch: InfosecSherpa Interview, Ukraine Drone Malware, & VulnCon Recap www.youtube.com/watch?v=AItI... @greynoise.io @vulncheck.bsky.social @runzero.com @censys.bsky.social

💬 Join Frost & Sullivan and Censys tomorrow, April 16 @ 2PM EST for a deep dive into the visibility challenges plaguing security teams across industries — and how Attack Surface Management is helping to close the gap. Register now: go.censys.com/202504-WE-PR...

“Salt Typhoon will happen again unless we make radical changes." censys.com/blog/salt-ty...

Adversaries shift their tactics and infrastructure all the time, which makes identification of threats that much more challenging. What was there yesterday may be gone today. censys.com/blog/salt-ty...

🆕 April 10 Advisory: Vulnerability in FortiSwitch Allows Unauthenticated Attackers to Change Admin Passwords [CVE-2024-48887] censys.com/advisory/cve...

Cyber threats are evolving. So are we. 👀 Something groundbreaking is coming to #RSAC, and you don’t want to miss it. (Hint: get ready to revolutionize threat hunting and attack surface management). See it in action—sign up for a demo now. go.censys.com/2025-rsac-me...

Two recently disclosed vulnerabilities--Ivanti CVE-2025-22457 and CrushFTP CVE-2025-31161--are under active attack. We took a look at both and talked about their respective impact for defenders in this new video. youtu.be/9DEeWwou7wY?...

The smartest security decisions start with the right intel 💡Forrester’s Q1 2025 report shows why ETISPs are key to proactive, risk-aligned defense—and why Censys is a notable provider. Get the key analyst takeways here: censys.com/blog/key-fin...

🔬 New research team updates. See the newest security advisory for this week. April 1 Advisory: Arbitrary File Read Vulnerability in NAKIVO Backup & Replication Added to CISA KEV censys.com/advisory/cve...

🚀 Big news: The new Censys is here! Our evolved brand reflects the global leader we’ve become—trusted by Fortune 500s & governments worldwide. Check out our bold new look at www.censys.com 👀And stay tuned… we’ve got more to reveal at RSA. #Cybersecurity #ThreatHunting #AttackSurfaceManagement #RSAC

✈️We're heading out to #VulnCon2025 April 7-10 for 40+ sessions and expert insights from CISA, MITRE, ENISA & OpenSSF. Find out how Censys fits into your vulnerability management, coordination, or response strategy censys.chilipiper.com/book/event-m...

#VulnCon2025! GreyNoise, @censys.bsky.social + @vulncheck.bsky.social invite you to unwind at Dram & Draught in Raleigh, April 7th, 6-9pm ET, register today! 🍻🛡️