On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. At the time, there were no CVE-specific detections for the ...
When a new CVE hits critical perimeter systems, it can trigger emergency response and disruption. Early warnings from GreyNoise let teams prepare in advance and minimize impact ...
Actionable intelligence on real-world threats as they unfold. Get insights into attacker behavior, infrastructure, exploitation of zero-days and n-days, temporal pattern, and geographic hotspots — all ...
GreyNoise’s new research reveals a recurring pattern: spikes in malicious activity often precede the disclosure of new CVEs — especially in enterprise edge technologies like VPNs and firewalls. In 80 ...
Coordinated Brute Force Activity Targeting Apache Tomcat Manager Indicates Possible Upcoming Threats
Roughly 400 unique IPs were involved in the activity observed across both tags during this period of elevated activity. Most of the activity originating from these IPs exhibited a narrow focus on ...
GreyNoise measured 212 exploitation attempts per second across H2 2025 — and the patterns inside that volume expose specific, measurable gaps in common edge defense strategies. The 2026 GreyNoise ...
To ensure we have as much visibility into activity on the internet as possible, we regularly deploy new sensors in different “geographical” network locations. We’ve selected two sensors for a short ...
Mass exploitation is faster and broader than ever. 40% of exploited CVEs in 2024 were at least four years old — some dating back to the 1990s. Attackers are targeting zero-days within hours of ...
2025-01-29 Update After identifying a significant overlap between IPs exploiting CVE-2024-40891 and those classified as Mirai, the team investigated a recent variant of Mirai and confirmed that the ...
GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal — typically fewer than 10 IPs ...
Washington, DC – February 24, 2026 – GreyNoise Intelligence, the cybersecurity company providing real-time intelligence about network-based attacks, today released the “2026 GreyNoise State of the ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results