Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
GreyNoise's integration with Google Security Operations delivers standardized indicator ingestion, pre-built dashboards, YARA-L detection rules, saved searches, response actions, webhook support, and ready-to-deploy playbooks.
First reported Mar 10, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordBefore Cisco disclosed a CVSS 10.0 zero-day, GreyNoise sensors had already observed eight surges of targeting activity compressing from 39 days to 2 days. A new study finds this pattern repeated across 33 CVEs and 16 vendor families — with a median lead time of 11 days. Read the full findings.
First reported Apr 20, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordToday we’re announcing an expanded integration between GreyNoise and the CrowdStrike Falcon® platform, with new content for CrowdStrike Falcon® Next-Gen SIEM and CrowdStrike Charlotte Agentic SOAR. The expanded integration includes a purpose-built Falcon Next-Gen SIEM dashboard, correlation rules that detect allowed inbound traffic from malicious infrastructure, and SOAR playbooks that bring GreyNoise threat context into automated response workflows.
First reported Aug 31, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordHow a live GreyNoise product demo turned into an incident response. Inside a proxyjacking campaign that hit 143 devices across 34 countries.
First reported Oct 15, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordGreyNoise compared 119,842 malicious IPs against 11 major threat feeds. The average coverage: just 2%, exposing the limits of static blocklists.
First reported May 22, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordCVE-2024-40891: Zyxel CPE Zero-day Exploitation. Hackers are actively exploiting a telnet-based command injection vulnerability in Zyxel CPE devices, impacting 1,500+ exposed systems. No patch is available yet.
First reported Jan 28, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordGreyNoise has begun seeing active exploitation of CVE‑2025‑64446, the critical path‑traversal flaw that lets an unauthenticated actor run administrative commands on Fortinet FortiWeb appliances.
First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordGreyNoise recently observed a coordinated spike in malicious activity against Apache Tomcat Manager interfaces. On June 5, 2025, two GreyNoise tags — Tomcat Manager Brute Force Attempt and Tomcat Manager Login Attempt — registered well above baseline volumes, indicating a deliberate attempt to identify and access exposed Tomcat services at scale.
First reported Jun 10, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordA new SonicWall scanning surge mirrors the pattern that preceded CVE-2026-0400. GreyNoise details the activity and what defenders should watch.
First reported May 21, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordThe GreyNoise Global Observation Grid observed active exploitation of two critical Ivanti Endpoint Manager Mobile vulnerabilities, and 83% of that exploitation traces to a single IP address on bulletproof hosting infrastructure that does not appear on widely circulated IOC lists.
First reported Feb 10, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordWith the new Intelligence Dashboard, pin any combination of CVEs, tags, countries, IPs, and GNQL queries into one persistent, always-current view.
First reported Jul 21, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordGreyNoise has identified a notable resurgence of in-the-wild activity targeting three ServiceNow vulnerabilities: "Resurgence of in-the-wild Activity targeting critical ServiceNow vulns. Overwhelming majority of traffic hitting Israel.
First reported Mar 18, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordA PoC for CVE-2026-1731 hit GitHub on Feb 10. Within 24 hours, GreyNoise observed reconnaissance probing for vulnerable BeyondTrust instances.
First reported Feb 12, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence record11 organizations compromised in 26 seconds. GreyNoise breaks down the AI-enabled campaign against PaperCut that hit 440 instances across 48 countries.
First reported Sep 09, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordOn August 21, GreyNoise observed a sharp surge in scanning against Microsoft Remote Desktop (RDP) services. The wave’s aim was clear: test for timing flaws that reveal valid usernames, laying the groundwork for credential-based intrusions.
First reported Aug 25, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordGreyNoise MCP Server is now available, enabling AI agents compatible with the Model Context Protocol (MCP) to efficiently consume GreyNoise intelligence, enhancing data-driven security insights.
First reported Sep 18, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordLearn how GreyNoise Feeds enable real-time, event-driven threat intelligence that eliminates polling delays—helping defenders react instantly to new exploits, IP threats, and zero-day activity.
First reported Oct 08, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordSilk Typhoon-linked CVEs are under active exploitation. GreyNoise observed 90+ threat IPs exploiting them in the past 24 hours, following Microsoft’s report on the group's evolving tactics.
First reported Mar 06, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordGreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure or Ivanti Pulse Secure VPN systems. More than 230 unique IPs probed ICS/IPS endpoints. This surge may indicate coordinated reconnaissance and possible preparation for future exploitation.
First reported Apr 23, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordDiscover insights from a multi-year APT campaign that exploited network perimeter vulnerabilities to target high-value entities, revealing critical gaps in edge device security. GreyNoise shares strategic intelligence and actionable steps for defending against these sophisticated threats, empowering security teams to strengthen their perimeter defenses against ongoing exploitation.
First reported Oct 31, 2024 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordToday, we’re introducing a redesigned GreyNoise Visualizer that makes it easier to navigate those capabilities and brings related workflows together in one place.
First reported Aug 17, 2026 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordA spike in botnet traffic from a single utility in a rural part of New Mexico led to the discovery of a global botnet. Explore how human-led, AI-powered analysis exposed compromised devices, uncovered attack patterns, and why defenders should take note.
First reported Jul 24, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordFrom Aug–Oct 2025, GreyNoise observed a surge in exploitation attempts against PHP and PHP-based frameworks as attackers deployed cryptominers—driven by rising Bitcoin prices and higher mining payoffs.
First reported Nov 04, 2025 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordAttackers exploit vulnerabilities within hours of PoC releases. Learn how GreyNoise provides real-time intelligence to detect and disrupt threats, helping defenders respond faster and stay ahead of evolving risks.
First reported Dec 10, 2024 00:00 UTCCatalog metadata updated Oct 16, 2026 20:22 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.