Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
54 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_0060ae82ad11b5dc16Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
What if defenders could prepare for new vulnerabilities before they’re disclosed? GreyNoise’s latest research reveals that spikes in attacker activity often precede the disclosure of new CVEs — typically within six weeks. These findings shed light on a narrow but reliable early warning signal, giving security teams a critical window to harden defenses, monitor closely, and act ahead of emerging th
First reported Jul 31, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Attackers from every corner of the internet are exploiting a uniquely dangerous class of cyber flaws: resurgent vulnerabilities. GreyNoise’s latest research breaks down these vulnerabilities — how they behave, why they’re dangerous, and what defenders and policymakers need to know to stay ahead.
First reported Apr 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Check out GreyNoise's new Head of Adversary Engagement, Mark Mager, on why traditional detection engineering can't keep pace with CVE growth — and the agentic pipeline replacing it.
First reported Jul 30, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
On August 21, GreyNoise observed a sharp surge in scanning against Microsoft Remote Desktop (RDP) services. The wave’s aim was clear: test for timing flaws that reveal valid usernames, laying the groundwork for credential-based intrusions.
First reported Aug 25, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
This blog details how attackers are actively exploiting Fortinet FortiGate firewalls vulnerable to CVE-2022-40684, with real-time insights from GreyNoise to help defenders understand and respond to these threats.
First reported Jan 28, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise has identified a previously untracked variant of a scraper botnet, detectable through a globally unique network fingerprint. To detect it, GreyNoise analysts created a signature using JA4+, the suite of JA4 signatures used to fingerprint network traffic.
First reported Jul 09, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise has observed a significant spike in exploitation attempts against TVT NVMS9000 DVRs. This information disclosure vulnerability can be used to gain administrative control over affected systems.
First reported Apr 07, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise has discovered previously undisclosed zero-day vulnerabilities in IoT-connected live streaming cameras, leveraging AI to catch an attack before it could escalate. This marks one of the first instances where threat detection has been augmented by AI to discover zero-day vulnerabilities.
First reported Oct 31, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
In his new role at GreyNoise, Smagh will serve as the principal liaison to government and enterprise partners, enhancing their ability to detect, understand and respond to cyber threats by leveraging GreyNoise capabilities.
First reported Oct 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
A new Censys report found 145,000 exposed ICSs and thousands of insecure human-machine interfaces (HMIs), providing attackers with an accessible path to disrupt critical operations. Real-world examples underscore the danger, with Iranian and Russian-backed hackers exploiting HMIs to manipulate water systems in Pennsylvania and Texas. GreyNoise research further highlights the urgency: attackers are
First reported Nov 21, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Today we’re announcing an expanded integration between GreyNoise and the CrowdStrike Falcon® platform, with new content for CrowdStrike Falcon® Next-Gen SIEM and CrowdStrike Charlotte Agentic SOAR. The expanded integration includes a purpose-built Falcon Next-Gen SIEM dashboard, correlation rules that detect allowed inbound traffic from malicious infrastructure, and SOAR playbooks that bring GreyN
First reported Aug 31, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
A vulnerability disclosed in May 2025, CVE-2025-48927, affects certain deployments of TeleMessageTM SGNL. If exposed, this endpoint can return a full snapshot of heap memory which may include plaintext usernames, passwords, and other sensitive data.
First reported Jul 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Discover insights from a multi-year APT campaign that exploited network perimeter vulnerabilities to target high-value entities, revealing critical gaps in edge device security. GreyNoise shares strategic intelligence and actionable steps for defending against these sophisticated threats, empowering security teams to strengthen their perimeter defenses against ongoing exploitation.
First reported Oct 31, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Discover whether your team truly needs a threat intelligence feed with our unbiased white paper. This practical guide helps cybersecurity professionals assess their needs, identify gaps, and confidently evaluate options for a tailored, effective cyber defense strategy.
First reported Jan 22, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Our Ollama honeypot infrastructure captured 91,403 attack sessions between October 2025 and January 2026. Buried in that data: two distinct campaigns that reveal how threat actors are systematically mapping the expanding surface area of AI deployments.
First reported Jan 08, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Over the past ~1.5 weeks, the React2Shell campaign has unleashed a flood of exploitation attempts targeting vulnerable React Server Components. Analyzing the payload size distribution across these attacks reveals a clear fingerprint of modern cybercrime, and a landscape dominated by automated scanners with a handful of sophisticated outliers.
First reported Dec 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise MCP Server is now available, enabling AI agents compatible with the Model Context Protocol (MCP) to efficiently consume GreyNoise intelligence, enhancing data-driven security insights.
First reported Sep 18, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Since October 8, 2025, GreyNoise has tracked a coordinated botnet operation involving over 100,000 unique IP addresses from more than 100 countries targeting Remote Desktop Protocol (RDP) services in the United States.
First reported Oct 10, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
On May 8, GreyNoise observed a highly coordinated reconnaissance campaign launched by 251 malicious IP addresses, all geolocated to Japan and hosted by Amazon AWS. The infrastructure and execution suggest centralized planning.
First reported May 27, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise has identified a notable resurgence of in-the-wild activity targeting three ServiceNow vulnerabilities: "Resurgence of in-the-wild Activity targeting critical ServiceNow vulns. Overwhelming majority of traffic hitting Israel.
First reported Mar 18, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise uncovers a concentrated RDP scanning campaign, revealing infrastructure patterns, rapid traffic shifts that impact detection, and recommendations for defenders.
First reported Apr 10, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Last week, the GreyNoise Observation Grid observed something unusual: 242,666 new scanning IPs geolocating to Hong Kong appeared in seven days and 99.7% of them never completed a single TCP connection.
First reported Mar 25, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
On March 28, GreyNoise observed a significant spike in activity targeting multiple edge technologies, including SonicWall, Zoho, Zyxel, F5, Linksys, and Ivanti systems. While some of these technologies are edge systems, others are primarily internal management tools.
First reported Apr 01, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.