NoiseLetter February 2025

This month’s NoiseLetter is packed with action—our Mass Exploitation Report breaks down the latest chaos, GreyNoise University LIVE starts (or aired) today at 12 ET (time to level up your skills), and we’ve got fresh vuln research, including active exploitation of PAN-OS (CVE-2025-0108), a surge in ThinkPHP & ownCloud attacks, and new insights on Cisco vulnerabilities tied to Salt Typhoon attacks.

‍

A̶n̶d̶r̶e̶w̶ Bob Unfiltered

GreyNoise Founder Andrew Morris gives his thoughts, hot-takes, and whatever else he feels like, but this month, Bob Rudis, VP of Data Science + Research, takes over and gives his thoughts.

‍

Featured

Attackers are automating exploitation at scale, targeting both new and old vulnerabilities — some before appearing in KEV. Our latest report breaks down which CVEs were exploited most in 2024, how ransomware groups are leveraging mass exploitation, and why real-time intelligence is critical.

Read More >>

‍

Product Announcements

Make our product team the happiest team in the world by sharing your honest feedback! 

• We're excited to announce our new gift card campaign on Gartner Peer Insights! Share your honest review of GreyNoise and receive a $25 gift card.

‍

Where to find us

• GreyNoise University LIVE (Virtual | Feb 27) GreyNoise 101, now known as GreyNoise Univeristy LIVE is BACK! We are stoked to bring back this once-a-month webinar.  
• HIMSS 25 (In-Person | Mar 4-6) Come see us at the Carasoft Booth for a demo + some swag! ‍
• FutureCon LA (In-Person | March 20) We are proud to sponsor FutureCon LA! Come to booth for a demo and to chat with our team! ‍
• RSA (In-Person | Apr 28 - May 1) We are excited to sponsor RSA this year! Come to booth  N-5148 in the North Hall for a demo and some RSA exclusive swag! 

‍

Fresh Content

• Webcast: Storm⚡️Watch | Latest Episode
• White Paper: GreyNoise 2025 Mass Internet Exploitation Report
  
• Blog: GreyNoise 2025 Mass Internet Exploitation Report: Attackers Are Moving Faster Than Ever — Are You Ready?
• Blog: GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks
• Blog: GreyNoise Observes Active Exploitation of PAN-OS Authentication Bypass Vulnerability (CVE-2025-0108)
• Blog: New Exploitation Surge: Attackers Target ThinkPHP and ownCloud Flaws at Scale

‍

Recent Tags and Vulnerabilities

GreyNoise Labs released 34 tags during the month of February:

• Ajax File and Image Manager CVE20114825 RCE Attempt
• Ajax File and Image Manager CVE20114825 RCE Attempt
• Apache Storm Cluster Summary Access Attempt
• Barracuda Spam Firewall CVE20064000 Directory Traversal Attempt
• BeyondTrust CVE202412356 RCE Check
• Build Your Own Botnet (BYOB) CVE202445256 Unauthenticated RCE Attempt
• Chamilo LMS CVE20234220 Stored XSS RCE Attempt
• Cisco HyperFlex CVE20211497 Python Injection Attempt
• Douchat 4.0.5 Arbitrary File Upload CVE202435324 Attempt
• Draytek Vigor CVE202412987 Command Injection Attempt
• FUXA Arbitrary Command Execution CVE202333831 Attempt
• GIGA WIFI Wave 2 KM08708H Command Injection RCE Attempt
• Ivanti EPM Sensitive Information Leak Attempt
• Linksys RE7000 CVE202425852 AccessControlList Command Execution Attempt
• mySCADA PRO Manager CVE202447407 Unauthenticated Container RCE Attempt
• NetAlertX CVE202446506 Unauthenticated RCE Attempt
• Netatalk CVE202223121 Exploit Upload Attempt
• NFR Agent FSFUI Record File Upload CVE20124959 RCE Attempt
• OpenTSDB CVE202325826 Command Injection Attempt
• Oracle Web Applications Desktop Integrator CVE202221587 Arbitrary File Upload Attempt
• Palo Alto PANOS CVE20250108 Auth Bypass Attempt
• Planon CVE201818570 Cross Site Scripting Check
• Pyspider Command Execution RCE Attempt
• Roxy Fileman Arbitrary File Upload CVE201820526 Attempt
• Roxy Fileman Path Traversal CVE201820525 Attempt
• RudderStack rudderserver CVE202330625 SQL Injection RCE Attempt
• Sonatype Nexus Repository 2 CVE20245082 RCE Attempt
• TOTOLINK setPortForwardRules Command Injection CVE202424329 RCE Attempt
• Totolink X6000R CVE20242353 setDiagnosisCfg OS Command Injection Attempt
• Trend Micro Threat Discovery Appliance Arbitrary File Delete CVE20167552 DoS Attempt
• Trimble Cityworks Scanner
• Vinchin Backup and Recovery CVE202345499 Hardcoded API Key Attempt
• WebLibs Path Traversal CVE20041221 Attempt
• WSO2 API Manager CVE20247097 Arbitrary User Creation Attempt
• Zhejiang Dahua Smart Cloud Gateway Registration Platform SQL Injection Attempt

‍

Community

• Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
• ‍Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
• ‍Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 

‍

Meme of the Month

‍

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

‍

Not subscribed to our NoiseLetter? Subscribe here.