greynoise

Swarming Against Citrix 0-Day Exploitation

GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study ...
greynoise

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study ...
greynoise

Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets

GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. These forged automated scanners have been observed requesting files ...
greynoise

Introducing Tactics: See What Adversaries Do After They’re Inside

GreyNoise has spent years observing the earliest stages of an attack. Our Global Observation Grid sees adversaries as they scan the internet, probe exposed systems, and attempt to exploit ...
greynoise

Ten Days Before Zero: How Activity Surges in GreyNoise Data Precede Vulnerability Disclosure

The internet changes before the advisory drops. GreyNoise found that activity surges in sensor data precede vulnerability disclosures by a median of 11 days — a pattern that held across 33 CVEs and 16 ...
greynoise

Just 21 IP Addresses Are Now Behind Nearly Half of All RDP Scanning on the Internet

A fleet of 21 IP addresses is now generating nearly half of all the RDP scanning traffic on the public internet. On April 7, 2026 alone, those IPs produced 1,856,167 of the 2,753,274 RDP Crawler ...
greynoise

GreyNoise Integrates with Google Security Operations to Enhance Detection and Response Capabilities

Your SIEM ingests everything. Every port scan, every crawl, every opportunistic spray across the internet. The problem isn't the collection — it's context. Which of those IPs are scanning everyone, ...
greynoise

Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure

GreyNoise observed 84,142 scanning sessions targeting SonicWall SonicOS infrastructure between February 22 and February 25, 2026. The activity originated from 4,305 unique IP addresses across 20 ...
greynoise

2026 State of the Edge Report

GreyNoise measured 212 exploitation attempts per second across H2 2025 — and the patterns inside that volume expose specific, measurable gaps in common edge defense strategies. The 2026 GreyNoise ...
greynoise

Analysis of Nearly 3 Billion Malicious Sessions Quantifies Sustained Exploitation of VPN Appliances, Routers, and Remote Access Services

Washington, DC – February 24, 2026 – GreyNoise Intelligence, the cybersecurity company providing real-time intelligence about network-based attacks, today released the “2026 GreyNoise State of the ...
greynoise

Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere

The GreyNoise Global Observation Grid observed active exploitation of two critical Ivanti Endpoint Manager Mobile vulnerabilities, and 83% of that exploitation traces to a single IP address on ...