Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
GreyNoise Tactics gives anyone running a Deception Sensor visibility into what adversaries do after initial compromise, automatically mapping qualifying sessions to the MITRE ATT&CK framework.
First reported Jul 31, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordRansomware group Black Basta’s chat logs were leaked, revealing 62 mentioned CVEs (Source: VulnCheck). GreyNoise identified 23 of these CVEs as actively exploited, with some targeted in the last 24 hours. Notably, CVE-2023-6875 is being exploited despite not appearing in CISA’s KEV catalog — reinforcing the need for real-time intelligence beyond static lists.
First reported Feb 26, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure or Ivanti Pulse Secure VPN systems. More than 230 unique IPs probed ICS/IPS endpoints. This surge may indicate coordinated reconnaissance and possible preparation for future exploitation.
First reported Apr 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record11 organizations compromised in 26 seconds. GreyNoise breaks down the AI-enabled campaign against PaperCut that hit 440 instances across 48 countries.
First reported Sep 09, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise deployed MCP honeypots to see what happens when AI middleware meets the open internet — revealing how attackers interact with this new layer of AI infrastructure.
First reported Nov 05, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordOn March 3, 2025, the Cybersecurity and Infrastructure Security Agency added five vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming their exploitation in the wild.
First reported Mar 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise has identified a significant escalation in malicious activity targeting Palo Alto Networks GlobalProtect portals. Beginning on 14 November 2025, activity rapidly intensified, culminating in a 40x surge within 24 hours, marking a new 90-day high.
First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise observed a sharp one-day surge of exploitation attempts targeting CVE-2021-43798 — a Grafana path traversal vulnerability that enables arbitrary file reads. All observed IPs are classified as malicious.
First reported Oct 02, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordDiscover why over 220 cybersecurity professionals ranked effective communication as the most undervalued skill in the industry. A Storm⚡️Watch podcast poll revealed the critical role "soft skills" play in bridging technical complexity with business needs. Explore real-world stories from industry experts who honed their communication abilities, from simplifying incident reports for executives to ad
First reported Nov 27, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise's Threat Brief Library is now live in the Visualizer — browse, search, filter, and download weekly At The Edge briefs, Executive Situation Reports, and more, all built on primary-source sensor data.
First reported Jul 13, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordOn August 3rd, 2025 GreyNoise observed a significant spike in brute-force traffic targeting Fortinet SSL VPNs. Over 780 unique IPs triggered our Fortinet SSL VPN Bruteforcer tag in a single day — the highest single-day volume seen on this tag in recent months.
First reported Aug 12, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordClose the speed gap in your security. GreyNoise unveils new real-time dynamic blocklists, push-based threat intelligence feeds, and SOAR integrations to help defenders detect, block, and respond to automated attacks faster than ever.
First reported Jul 31, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordBefore Cisco disclosed a CVSS 10.0 zero-day, GreyNoise sensors had already observed eight surges of targeting activity compressing from 39 days to 2 days. A new study finds this pattern repeated across 33 CVEs and 16 vendor families — with a median lead time of 11 days. Read the full findings.
First reported Apr 20, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordEU sanctions hit Stark Industries in May 2025. GreyNoise data shows how the group quietly rebranded to THE.Hosting and kept its malicious infrastructure running.
First reported Nov 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordIn 2025, 59 KEV entries silently flipped to “known ransomware use.” GreyNoise uncovers the hidden flips, why they matter, and a new feed to track them.
First reported Feb 02, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordA newly discovered global cyber threat is rapidly expanding, infecting tens of thousands of internet-connected devices to launch powerful cyberattacks. Nokia Deepfield’s Emergency Response Team (ERT) has identified a new botnet, tracked as Eleven11bot, which they estimated has compromised over 30,000 devices, primarily security cameras and network video recorders (NVRs).
First reported Feb 28, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordWe're launching C2 Detection — a new GreyNoise intelligence module that gives you two distinct, high-confidence signals that a device in your environment has been compromised.
First reported Apr 07, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordToday, we’re introducing a redesigned GreyNoise Visualizer that makes it easier to navigate those capabilities and brings related workflows together in one place.
First reported Aug 17, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordOver four days in December, one operator scanned the internet for vulnerable systems, testing 240+ exploits and logging confirmed vulnerabilities that could power targeted intrusions in 2026.
First reported Jan 08, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordRecall is a time-series capability that enables customers to query GreyNoise data over specific historical ranges. Instead of a static summary of current IP behavior, Recall allows you to see exactly how scanner activity looked at any given hour.
First reported Jan 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordFrom Aug–Oct 2025, GreyNoise observed a surge in exploitation attempts against PHP and PHP-based frameworks as attackers deployed cryptominers—driven by rising Bitcoin prices and higher mining payoffs.
First reported Nov 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordAttackers route malicious traffic through ordinary home internet connections — and to a reputation feed, the source IP is indistinguishable from a legitimate user's connection. GreyNoise analyzed 4 billion sessions over 90 days and found that 39% of unique IPs targeting the edge come from residential address space. 78% vanish after just 1–2 sessions, before any reputation system can flag them. The
First reported Apr 02, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordDive into the scientific methods GreyNoise uses to separate internet noise from real threats, providing defenders a clearer, more accurate view of malicious activity.
First reported Jan 12, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordAttackers are actively exploiting Apache Tomcat servers by leveraging CVE-2025-24813, a newly disclosed vulnerability that, if successfully exploited, could enable remote code execution (RCE). GreyNoise has identified multiple IPs engaging in this activity across multiple regions.
First reported Mar 20, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.