Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

2,400+Reachable catalog records

57 / 100Current catalog page

24Maximum records per page

0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

2 sources: 0 stale, 0 needing attention, 0 paused, 2 unverified.

Review source update dates and status

src_0060ae82ad11b5dc16Collection status unverifiedLast successful batch: Unverified
src_4a349ec95eeb880450Collection status unverifiedLast successful batch: Unverified

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED

REPORT1 SOURCE

Checking It Twice: Profiling Benign Internet Scanners — 2024 Edition

A comprehensive analysis of benign internet scanning activity from November 2024, examining how quickly and thoroughly various legitimate scanning services (like Shodan, Censys, and others) discover and probe new internet-facing assets. The study deployed 24 new sensors across 8 geographies and 5 autonomous systems, revealing that most scanners found new nodes within 5 minutes, with ONYPHE leading

First reported Dec 23, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Amid Reports of Worldwide Reboots, GreyNoise Observes In-the-Wild Activity Against DrayTek Routers

GreyNoise is bringing awareness to in-the-wild activity against several known vulnerabilities (CVE-2020-8515, CVE-2021-20123, and CVE-2021-20124) in DrayTek devices.

First reported Mar 25, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming

GreyNoise observed two scanning surges against Cisco Adaptive Security Appliance (ASA) devices in late August including more than 25,000 unique IPs in a single burst. This activity represents a significant elevation above baseline, typically registering at less than 500 IPs per day.

First reported Sep 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Introducing Query-Based Blocklists: Fully Configurable, Real-Time Threat Blocking in the GreyNoise Platform

GreyNoise customers can turn any GreyNoise query directly into a real-time blocklist for their firewall, SOAR, or other enforcement points.

First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

FortiWeb CVE‑2025‑64446: What We’re Seeing in the Wild

GreyNoise has begun seeing active exploitation of CVE‑2025‑64446, the critical path‑traversal flaw that lets an unauthenticated actor run administrative commands on Fortinet FortiWeb appliances.

First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far

GreyNoise is already seeing opportunistic, largely automated exploitation attempts consistent with the newly disclosed React Server Components (RSC) “Flight” protocol RCE—often referred to publicly as “React2Shell” and tracked as CVE-2025-55182.

First reported Dec 05, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic

Two months after CVE-2025-55182 was disclosed on December 3, 2025, exploitation activity targeting React Server Components has consolidated significantly.

First reported Feb 02, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400

A new SonicWall scanning surge mirrors the pattern that preceded CVE-2026-0400. GreyNoise details the activity and what defenders should watch.

First reported May 21, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Coordinated Credential-Based Campaign Targets Cisco and Palo Alto Networks VPN Gateways

GreyNoise is tracking a coordinated, automated credential-based campaign targeting enterprise VPN authentication infrastructure, with activity observed against Cisco SSL VPN and Palo Alto Networks GlobalProtect services.

First reported Dec 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets

GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies, using forged user agents while requesting the files where misconfigured web servers frequently leak secrets and credentials.

First reported Aug 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

GreyNoise 2025 Mass Internet Exploitation Report: Attackers Are Moving Faster Than Ever — Are You Ready?

Attackers are automating exploitation at scale, targeting both new and old vulnerabilities — some before appearing in KEV. Our latest report breaks down which CVEs were exploited most in 2024, how ransomware groups are leveraging mass exploitation, and why real-time intelligence is critical.

First reported Feb 27, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Spike in Git Config Crawling Highlights Risk of Codebase Exposure

GreyNoise observed a significant increase in crawling activity targeting Git configuration files. While the crawling itself is reconnaissance, successful discovery of exposed Git configuration files can lead to exposure of internal codebases, developer workflows, and potentially sensitive credentials.

First reported Apr 28, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far

A PoC for CVE-2026-1731 hit GitHub on Feb 10. Within 24 hours, GreyNoise observed reconnaissance probing for vulnerable BeyondTrust instances.

First reported Feb 12, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

GreyNoise Detects Active Exploitation of Silk Typhoon-Linked CVEs

Silk Typhoon-linked CVEs are under active exploitation. GreyNoise observed 90+ threat IPs exploiting them in the past 24 hours, following Microsoft’s report on the group's evolving tactics.

First reported Mar 06, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

From PoC to Attacker Interest in Hours: Real-Time Insights into Mitel MiCollab Vulnerabilities

Attackers exploit vulnerabilities within hours of PoC releases. Learn how GreyNoise provides real-time intelligence to detect and disrupt threats, helping defenders respond faster and stay ahead of evolving risks.

First reported Dec 10, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891)

CVE-2024-40891: Zyxel CPE Zero-day Exploitation. Hackers are actively exploiting a telnet-based command injection vulnerability in Zyxel CPE devices, impacting 1,500+ exposed systems. No patch is available yet.

First reported Jan 28, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign

‍GreyNoise data confirms that exploitation of CVE-2024-4577 extends far beyond initial reports. Attack attempts have been observed across multiple regions, with notable spikes in the United States, Singapore, Japan, and other countries throughout January 2025.

First reported Mar 07, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity

GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal — typically fewer than 10 IPs observed per day. But on May 27, that number spiked to over 100 unique IPs, followed by 319 IPs on May 29.

First reported Jun 25, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere

The GreyNoise Global Observation Grid observed active exploitation of two critical Ivanti Endpoint Manager Mobile vulnerabilities, and 83% of that exploitation traces to a single IP address on bulletproof hosting infrastructure that does not appear on widely circulated IOC lists.

First reported Feb 10, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Introducing GreyNoise Block: Fully configurable, real-time blocklists

Discover why traditional blocklists fail and how GreyNoise Block offers real-time, configurable, low-noise IP blocking powered by primary-sourced intelligence.

First reported Oct 14, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public

GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.

First reported Jul 16, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

GreyNoise Welcomes New SVP of Adversary Operations

Former Google Threat Intelligence leader joins GreyNoise as SVP of Adversary Operations to advance proactive discovery and disruption of cyber threats.

First reported Aug 13, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

Key Takeaways Private Threat Briefs: 20+ private DFIR reports annually. Contact us today for pricing or a demo! Table of Contents: Case Summary Analysts Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact Timeline Diamond Model Indicators Detections MITRE ATT&CK Case Summary The in

First reported Sep 08, 2025 14:20 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

REPORT1 SOURCE

Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting

Key Takeaways We identified an exposed server that provided unusual visibility into a large-scale, multi-victim exploitation and collection operation. Artifacts on the host showed that Claude Code and OpenClaw were embedded in the operator’s day-to-day workflow, supporting troubleshooting, orchestration, and refinement of the collection pipeline. This AI-assisted workflow resulted in the modular p

First reported Apr 22, 2026 14:51 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record

The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.