Real-time intelligence
for modern threats

^{March 25, 2025}

‍Amid reports of global reboots, GreyNoise observes in-the-wild activity against DrayTek routers. Block IPs and see the top destination countries.

^{March 20, 2025}

Attackers actively exploiting critical Apache Tomcat RCE vuln (CVE-2025-24813). 70% of traffic targeting U.S.-based systems.

^{March 18, 2025}

Resurgence of in-the-wild activity targeting critical ServiceNow vulns. Overwhelming majority of traffic hitting Israel.

^{March 11, 2025}

Surge in SSRF exploitation detected. GreyNoise observed 400+ IPs exploiting multiple SSRF vulnerabilities across various platforms, with recent activity concentrated in Israel and the Netherlands.

‍

^{March 7, 2025}

Mass exploitation of CVE-2024-4577 detected. GreyNoise observed 1,089+ IPs exploiting this PHP-CGI vulnerability across multiple regions, with 43% originating from Germany & China.

^{March 6, 2025}

Silk Typhoon-linked CVEs are under active exploitation. GreyNoise observed 90+ threat IPs exploiting them in the past 24 hours, following Microsoft’s report on the group's evolving tactics.

^{March 4, 2025}

Threat actors are exploiting newly added KEV vulnerabilities. GreyNoise observed exploitation of CVE-2022-43939, CVE-2022-43769, and CVE-2024-4885 months before CISA’s KEV update.

‍

^{February 28, 2025}

A new botnet, Eleven11bot, has reportedly been used in DDoS attacks. GreyNoise observed activity from 1,042 IPs linked to it, with 61% traced to Iran.

^{February 27, 2025}

GreyNoise's 2025 Mass Internet Exploitation Report is here. Attackers are exploiting vulnerabilities at scale, targeting both new and old CVEs — some before appearing in KEV.

^{February 26, 2025}

Attackers are exploiting CVEs from Black Basta’s leaked chat logs. 23 under active attack, including some in the last 24 hours.

^{February 24, 2025}

Exploitation detected for Cisco CVEs tied to Salt Typhoon reports. See the malicious IPs and where the activity is coming from.

‍

^{February 13, 2025}

Attackers are exploiting a PAN-OS authentication bypass vulnerability (CVE-2025-0108). See how GreyNoise detects and tracks this serious threat in real time.