greynoise

skynox7: Proxyjacking Edge Devices Into Residential Proxies

How a live GreyNoise product demo turned into an incident response. Inside a proxyjacking campaign that hit 143 devices ...
greynoise

Swarming Against Citrix 0-Day Exploitation

GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study ...
greynoise

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

Source: GreyNoise Global Observation Grid and adversary infrastructure. Times are UTC. Jul 22 times come from preserved file timestamps and may differ from a forensic investigation.
greynoise

Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets

GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. These forged automated scanners have been observed requesting files ...
greynoise

Ten Days Before Zero: How Activity Surges in GreyNoise Data Precede Vulnerability Disclosure

The internet changes before the advisory drops. GreyNoise found that activity surges in sensor data precede vulnerability disclosures by a median of 11 days — a pattern that held across 33 CVEs and 16 ...
greynoise

The Invisible Army: Residential Proxy Abuse in Internet-Scale Attack Traffic

Every enterprise firewall processes traffic from residential IP space. Traditional reputation feeds fail to flag IPs that rotate before they can be cataloged. GreyNoise analyzed 4 billion sessions ...
greynoise

2026 State of the Edge Report

GreyNoise measured 212 exploitation attempts per second across H2 2025 — and the patterns inside that volume expose specific, measurable gaps in common edge defense strategies. The 2026 GreyNoise ...
greynoise

2026 GreyNoise State of the Edge Report: Where Attacks Concentrate and Defenses Fall Short

GreyNoise analyzed 2.97 billion sessions over 162 days in H2 2025, and the patterns reveal where edge defenses hold up — and where they fall short. The data exposes specific concentration points in ...
greynoise

Analysis of Nearly 3 Billion Malicious Sessions Quantifies Sustained Exploitation of VPN Appliances, Routers, and Remote Access Services

Washington, DC – February 24, 2026 – GreyNoise Intelligence, the cybersecurity company providing real-time intelligence about network-based attacks, today released the “2026 GreyNoise State of the ...
greynoise

Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far

It took less than 24 hours. On February 10, a proof-of-concept exploit for CVE-2026-1731, a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged ...
greynoise

Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere

The GreyNoise Global Observation Grid observed active exploitation of two critical Ivanti Endpoint Manager Mobile vulnerabilities, and 83% of that exploitation traces to a single IP address on ...