We all know that @hrbrmstr.dev is a mad scientist, and when you give him the amazing telemetry our new fleet has been collecting lately, you get knowledge drops like this! Super proud of our @greynoise.io team’s work on the deception capabilities we now have! hashtag#threatintel

An unexpected cluster of malicious IPs in a remote U.S. town led GreyNoise researchers to uncover a 500+ device botnet. Full analysis ⬇️ #Cybersecurity #ThreatIntel #Botnet #VoIP #GreyNoise #Cyber #Tech

🫖 & #threatintel - noticing a few other spikes orgs should be mindful of: 🔥 CVE-2025-49132 (Pterodactyl Panel RCE) (10/10 RCE) ⚡ CVE-2024-20439 (Cisco Smart Licensing Utility) (9.8/10, KEV) 📝 CVE-2017-18370 (Zyxel P660HN) 1/4

🩸& #threatintel | We (GreyNoise) just published a quick note (www.greynoise.io/blo...#threatintel regarding CVE-2025-5777 - CitrixBleed 2 1/2

🥜 & #threatintel - Thanks to @horizon3ai.bsky.social, we pushed a tag out today for CitrixBleed 2 CVE-2025-5777 and are backfilling. Currently, we see 233 hits starting on July 1 from: 64.176.50[.]109 38.154.237[.]100 102.129.235[.]108 121.237.80[.]241 45.135.232[.]2 Follow along... 1/2

Just a totally normal trip home from the airport last night… passing the national guard rolling down the highway as they prepare for NO KINGS DAY protests. F this administration. About 3 more months before they start trying to censor social media via tech controls.

Seems like a lot of work when you could have found 200 year old brain proteins in the US Congress rn. phys.org/news/2025-0...

It's hard to beat good deception. :)

If you're ever feeling lonely, just close Zoom. This works because a funny thing always happens: a random last-minute Zoom will appear if you close it completely.

🥤& #threat-intel: CISA added Langflow Code Injection CVE-2025-3248 to the KEV on May 5. Recently, it has garnered considerable attention, with South Korea leading the pack. This vuln enables unauthenticated attackers to execute arbitrary code via /api/v1/validate/code viz.greynoise.io/tag...

This change legitimately pisses me off. TL;DR—They appear to be removing RSS for KEV alerts and moving them to email or X. They gave orgs 0 days to prepare. RSS is already a thing. The emails arrive many hours later. X is NOT a gov website(!); it even warns you when you click their link! 1/2

Join us live! Or later? Looking forward to chatting with Tracy!

Hi yes. Help your local cybersecurity researchers. If you blog a thing, please date the blog. kthx.

🚨 New GreyNoise Tag Alert: We've added a fresh tag tracking CrushFTP Authentication Bypass (CVE-2025-2825) exploitation attempts. Thanks to @horizon3ai.bsky.social for the intel! Dive into the details: viz.greynoise.io/tags/crushft...

Today is Opening Day for baseball season in the US. At least now I have my fav sport to put on when I want to watch something but avoid TV news.

Dammit

Headed to RSAC next month? 👀 NoiseFest will be just a few blocks away...no nonsense (well maybe a little 😈), just drinks, good people, and real security talk. House of Shields | April 30 | 7–10PM Spots are limited. RSVP now. info.greynoise.io/events/noise...

Absolutely disgusting. The Trump admin (DHS) has repurposed opt-in email signups to spread their propaganda. Years ago (4+) I signed up for Homeland Security emails; I don't recall doing this but based on the ones in my email it was related to something cyber -- not surprising. 1/4

Happy ~Fat~ Tariff Tuesday to all that celebrate stupidity.

Greetings, esteemed colleagues of LUMON. Our annual report highlights the accelerated pace of mass exploitation, transcending new vulnerabilities. It guides CISOs toward strategic refinement and equips security teams with real-time intelligence, surpassing mere theoretical risks.

Live in 2 hours! Very much looking forward to this conversation. Join us live and ask questions!

Words have meanings. Words have consequences. apple.news/AcP5I9x7Q...

DOGE = Department of Gross Errors

Our show planning meeting (yes, we DO* plan) today was some real talk -- looking forward to Tuesday's conversation! *try to

🍵 & #threatintel: @greynoise.io is observing a massive spike in exploitation attempts for CVE-2017-18368, Zyxel Command Injection Vulnerability. The source countries for this spike are pretty diverse; perhaps added to a botnet? viz.greynoise.io/tag...#threatintel:

<reads latest asteroid hitting earth percentages> "Don't Look Up" is turning into a documentary; much like Idiocracy. ☄️

We’re really about to lose the G in MAGA.

🫖 & #threatintel - it took no time for the POC of CVE-2025-0108 (PAN-OS Authentication Bypass) to start being fired off across the internet. We're back-processing some data now to pick up some prior exploitation as well.

If you're not subscribed to the GreyNoise-Noiseletter (next edition ships Monday), you are about to miss out on a BANGER... 1/2

2025-01-29 Update After identifying a significant overlap between IPs exploiting CVE-2024-40891 and those classified as Mirai, the team investigated a recent variant of Mirai and confirmed that the ability to exploit CVE-2024-40891 has been incorporated into some Mirai strains.

⤵️

The little flag has, what, 38 stars on it? If they’re cutting costs by dropping states sign me up for one of those. (TBH I expected the flag to have 51 or 52 stars on it but they aren’t that clever).

FYSA: If you were following the official POTUS or VP or FLOTUS etc social media accounts, those have swapped over without clearing the followers (not abnormal practice; just was alarming).

“In 150 characters or less” by @nikitagill.bsky.social

Regarding the Murdoc botnet delivering Mirai malware (www.darkreading.com/...) GreyNoise has 👀 1) viz.greynoise.io/tag... 2) viz.greynoise.io/tag...

Censys released an advisory regarding Kerio CVE-2024-52875. We at GreyNoise began observing exploit attempts on December 28. Although the IP addresses involved are currently quite noisy, it's notable that they predominantly trace from Singapore to Lithuania. #threatintel viz.greynoise.io/tag...

Being sick on preplanned PTO should result in a PTO rain check. :/

Checking It Twice: Profiling Benign Internet Scanners — 2024 Edition 🧵 👋! We did a follow-up from our October, 2022 post on "Sensors & Benign Activity" (www.greynoise.io/blo...) We took a slightly different approach, this year, & the findings are pretty fun/interesting (post 🔗 at the end). 1/9

Happy Festivus! _|_

Was there a CVE for this? 😆 support.microsoft.com/en-us/office...

🎅 & #threatintel: We at GreyNoise recently added a tag for Apache Struts2 CVE-2024-53677 regarding unauthenticated file upload attempts. Despite numerous reports of exploitation in the wild, we have not observed any beyond the originally published PoC. viz.greynoise.io/tag...#threatintel:1/2

I'm having doubts about the information circulating around CVE-2024-53677 (the Apache Struts2 file upload vuln). We're still digging into this but many POCs seem to be, not. We do see scanning for it, but exploitation.... TBD.

Join us @ 10:30 ET for GreyNoise Storm⚡️Watch! This week, you — our fab listeners — have delivered once again — & we take a look at your most pressing cyber concerns as we enter the final fray of this holiday season. https://stormwatch.ing/ 1/4

Amplifying this from our /noiseletter/. Today marks a significant milestone for GreyNoise as we (essentially) launch GreyNoise v2. 1/5

We (GreyNoise Intelligence) are expanding our team and looking for talented folks to join us. Here are the positions we currently have open; if any of these appeal to you or you have any questions, hit me up! #infosecjobs #remotejobs grnh.se/33c450465us#infosecjobs#remotejobs1/2

Shocking revaluation: communication skills are immensely valuable, especially in cybersecurity!

@iagox86.bsky.social is at it again! The guy just loves broken exploits!

HI @zakir.bsky.social

Vulnerability names: this is log4shell. We named it this way because it's in log4j and gives you shell. Threat actor names: this is HAIRY EEL, aka VIOLIN HIPPO, no relation to VEXING MACKEREL. Also known as APT-74, formely APT-C-92. We named it this way because he's a guy in Bulgaria

What a journey it’s been too. 🙃 Today in history: In 1985 Microsoft released Windows 1.0, its first graphical personal computer operating environment.