Please turn JavaScript on
The GreyNoise Blog icon

The GreyNoise Blog

Follow The GreyNoise Blog's news and updates in a matter of seconds! We will deliver any update via email, phone or you can read them from here on the site on your own news page.

You can even combine different feeds with the feed for The GreyNoise Blog.

Subscribing and unsubscribing is fast, easy and risk free.

The whole service is free of cost.

The GreyNoise Blog: GreyNoise Intelligence | Real-Time Intelligence For Modern Threats

Is this your feed? Claim it!

Publisher:  Unclaimed!
Message frequency:  0.13 / day

Message History

How a live GreyNoise product demo turned into an incident response. Inside a proxyjacking campaign that hit 143 devices across 34 countries.

Read full story
For months, GreyNoise recorded almost no Hikvision camera exploit attempts against Ukraine. On Sept 21 activity surged for nine days during Russian strikes, almost all from four IPs, then stopped. We can't say if the two are linked.

Read full story
On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. At the time, there were no CVE-specific detections for the attack due to it occurring pre-disclosure. However, GreyNoise still detected and labeled the activity as fundamentally malicious within seconds due to behavioral detections.

Read full story
GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We detail a few of the more notable intrusions we observed including the theft of more than 18,000 sensitive records from a western government.

Read full story