Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
A PoC for CVE-2026-1731 hit GitHub on Feb 10. Within 24 hours, GreyNoise observed reconnaissance probing for vulnerable BeyondTrust instances.
First reported Feb 12, 2026 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence record11 organizations compromised in 26 seconds. GreyNoise breaks down the AI-enabled campaign against PaperCut that hit 440 instances across 48 countries.
First reported Sep 09, 2026 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordOn August 21, GreyNoise observed a sharp surge in scanning against Microsoft Remote Desktop (RDP) services. The wave’s aim was clear: test for timing flaws that reveal valid usernames, laying the groundwork for credential-based intrusions.
First reported Aug 25, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordGreyNoise MCP Server is now available, enabling AI agents compatible with the Model Context Protocol (MCP) to efficiently consume GreyNoise intelligence, enhancing data-driven security insights.
First reported Sep 18, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordLearn how GreyNoise Feeds enable real-time, event-driven threat intelligence that eliminates polling delays—helping defenders react instantly to new exploits, IP threats, and zero-day activity.
First reported Oct 08, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordSilk Typhoon-linked CVEs are under active exploitation. GreyNoise observed 90+ threat IPs exploiting them in the past 24 hours, following Microsoft’s report on the group's evolving tactics.
First reported Mar 06, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordGreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure or Ivanti Pulse Secure VPN systems. More than 230 unique IPs probed ICS/IPS endpoints. This surge may indicate coordinated reconnaissance and possible preparation for future exploitation.
First reported Apr 23, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordDiscover insights from a multi-year APT campaign that exploited network perimeter vulnerabilities to target high-value entities, revealing critical gaps in edge device security. GreyNoise shares strategic intelligence and actionable steps for defending against these sophisticated threats, empowering security teams to strengthen their perimeter defenses against ongoing exploitation.
First reported Oct 31, 2024 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordToday, we’re introducing a redesigned GreyNoise Visualizer that makes it easier to navigate those capabilities and brings related workflows together in one place.
First reported Aug 17, 2026 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordA spike in botnet traffic from a single utility in a rural part of New Mexico led to the discovery of a global botnet. Explore how human-led, AI-powered analysis exposed compromised devices, uncovered attack patterns, and why defenders should take note.
First reported Jul 24, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordFrom Aug–Oct 2025, GreyNoise observed a surge in exploitation attempts against PHP and PHP-based frameworks as attackers deployed cryptominers—driven by rising Bitcoin prices and higher mining payoffs.
First reported Nov 04, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordAttackers exploit vulnerabilities within hours of PoC releases. Learn how GreyNoise provides real-time intelligence to detect and disrupt threats, helping defenders respond faster and stay ahead of evolving risks.
First reported Dec 10, 2024 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordA comprehensive analysis of benign internet scanning activity from November 2024, examining how quickly and thoroughly various legitimate scanning services (like Shodan, Censys, and others) discover and probe new internet-facing assets. The study deployed 24 new sensors across 8 geographies and 5 autonomous systems, revealing that most scanners found new nodes within 5 minutes, with ONYPHE leading in first contacts.
First reported Dec 23, 2024 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordOn March 3, 2025, the Cybersecurity and Infrastructure Security Agency added five vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming their exploitation in the wild.
First reported Mar 04, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordTwo critical Ivanti zero-days (CVE-2025-4427 and CVE-2025-4428) are now being actively exploited after a surge in scanning activity last month. When chained together, these vulnerabilities enable unauthenticated remote code execution on Ivanti Endpoint Manager Mobile systems.
First reported May 16, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordA new Censys report found 145,000 exposed ICSs and thousands of insecure human-machine interfaces (HMIs), providing attackers with an accessible path to disrupt critical operations. Real-world examples underscore the danger, with Iranian and Russian-backed hackers exploiting HMIs to manipulate water systems in Pennsylvania and Texas. GreyNoise research further highlights the urgency: attackers are actively scanning for HMIs and prioritizing Remote Access Services (RAS) over complex ICS protocols, making these easily accessible entry points prime targets for exploitation.
First reported Nov 21, 2024 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordDiscover whether your team truly needs a threat intelligence feed with our unbiased white paper. This practical guide helps cybersecurity professionals assess their needs, identify gaps, and confidently evaluate options for a tailored, effective cyber defense strategy.
First reported Jan 22, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordRecall is a time-series capability that enables customers to query GreyNoise data over specific historical ranges. Instead of a static summary of current IP behavior, Recall allows you to see exactly how scanner activity looked at any given hour.
First reported Jan 28, 2026 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordFormer Google Threat Intelligence leader joins GreyNoise as SVP of Adversary Operations to advance proactive discovery and disruption of cyber threats.
First reported Aug 13, 2026 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordYour home network might be part of someone else’s attack. GreyNoise IP Check shows if your IP’s been caught scanning the internet—free and private.
First reported Nov 25, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordGreyNoise has identified a significant escalation in malicious activity targeting Palo Alto Networks GlobalProtect portals. Beginning on 14 November 2025, activity rapidly intensified, culminating in a 40x surge within 24 hours, marking a new 90-day high.
First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordGreyNoise reports attackers using rotating IPs to exploit Microsoft RDP timing vulnerabilities, targeting RD Web Access and RDP login enumeration to evade detection.
First reported Oct 20, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordGreyNoise deployed MCP honeypots to see what happens when AI middleware meets the open internet — revealing how attackers interact with this new layer of AI infrastructure.
First reported Nov 05, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordAttackers from every corner of the internet are exploiting a uniquely dangerous class of cyber flaws: resurgent vulnerabilities. GreyNoise’s latest research breaks down these vulnerabilities — how they behave, why they’re dangerous, and what defenders and policymakers need to know to stay ahead.
First reported Apr 23, 2025 00:00 UTCCatalog metadata updated Oct 15, 2026 20:21 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.