Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
2 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
A spike in botnet traffic from a single utility in a rural part of New Mexico led to the discovery of a global botnet. Explore how human-led, AI-powered analysis exposed compromised devices, uncovered attack patterns, and why defenders should take note.
First reported Jul 24, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordFrom Aug–Oct 2025, GreyNoise observed a surge in exploitation attempts against PHP and PHP-based frameworks as attackers deployed cryptominers—driven by rising Bitcoin prices and higher mining payoffs.
First reported Nov 04, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordAttackers exploit vulnerabilities within hours of PoC releases. Learn how GreyNoise provides real-time intelligence to detect and disrupt threats, helping defenders respond faster and stay ahead of evolving risks.
First reported Dec 10, 2024 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordA comprehensive analysis of benign internet scanning activity from November 2024, examining how quickly and thoroughly various legitimate scanning services (like Shodan, Censys, and others) discover and probe new internet-facing assets. The study deployed 24 new sensors across 8 geographies and 5 autonomous systems, revealing that most scanners found new nodes within 5 minutes, with ONYPHE leading in first contacts.
First reported Dec 23, 2024 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordOn March 3, 2025, the Cybersecurity and Infrastructure Security Agency added five vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming their exploitation in the wild.
First reported Mar 04, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordTwo critical Ivanti zero-days (CVE-2025-4427 and CVE-2025-4428) are now being actively exploited after a surge in scanning activity last month. When chained together, these vulnerabilities enable unauthenticated remote code execution on Ivanti Endpoint Manager Mobile systems.
First reported May 16, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordA new Censys report found 145,000 exposed ICSs and thousands of insecure human-machine interfaces (HMIs), providing attackers with an accessible path to disrupt critical operations. Real-world examples underscore the danger, with Iranian and Russian-backed hackers exploiting HMIs to manipulate water systems in Pennsylvania and Texas. GreyNoise research further highlights the urgency: attackers are actively scanning for HMIs and prioritizing Remote Access Services (RAS) over complex ICS protocols, making these easily accessible entry points prime targets for exploitation.
First reported Nov 21, 2024 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordDiscover whether your team truly needs a threat intelligence feed with our unbiased white paper. This practical guide helps cybersecurity professionals assess their needs, identify gaps, and confidently evaluate options for a tailored, effective cyber defense strategy.
First reported Jan 22, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordRecall is a time-series capability that enables customers to query GreyNoise data over specific historical ranges. Instead of a static summary of current IP behavior, Recall allows you to see exactly how scanner activity looked at any given hour.
First reported Jan 28, 2026 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordFormer Google Threat Intelligence leader joins GreyNoise as SVP of Adversary Operations to advance proactive discovery and disruption of cyber threats.
First reported Aug 13, 2026 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordYour home network might be part of someone else’s attack. GreyNoise IP Check shows if your IP’s been caught scanning the internet—free and private.
First reported Nov 25, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordGreyNoise has identified a significant escalation in malicious activity targeting Palo Alto Networks GlobalProtect portals. Beginning on 14 November 2025, activity rapidly intensified, culminating in a 40x surge within 24 hours, marking a new 90-day high.
First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordGreyNoise reports attackers using rotating IPs to exploit Microsoft RDP timing vulnerabilities, targeting RD Web Access and RDP login enumeration to evade detection.
First reported Oct 20, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordGreyNoise deployed MCP honeypots to see what happens when AI middleware meets the open internet — revealing how attackers interact with this new layer of AI infrastructure.
First reported Nov 05, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordAttackers from every corner of the internet are exploiting a uniquely dangerous class of cyber flaws: resurgent vulnerabilities. GreyNoise’s latest research breaks down these vulnerabilities — how they behave, why they’re dangerous, and what defenders and policymakers need to know to stay ahead.
First reported Apr 23, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 05:38 UTCOpen evidence recordCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
First reported Jun 02, 2026 16:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
First reported Sep 03, 2026 12:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordCyber Threat Intelligence Framework
First reported Apr 08, 2026 16:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
First reported Jul 01, 2026 14:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
First reported Oct 02, 2026 15:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
First reported Mar 02, 2026 17:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
First reported May 04, 2026 15:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordCyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
First reported Aug 03, 2026 15:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordCERT-EU Cyber Threat Landscape Report for 2025 - Year Review
First reported Apr 08, 2026 16:00 UTCCatalog metadata updated Oct 15, 2026 05:37 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.