NoiseLetter January 2024

We hope that your January has been just as exciting as ours. Our amazing Labs team has launched an impressive 37 new tags this month! Additionally, we have unveiled our highly anticipated 2023 Internet Exploitation Retrospective report, along with a new case study, four blog posts, and even a three-part series on GreyNoise tags. Be sure to explore these resources and more in this month's NoiseLetter.

Andrew Unfiltered

GreyNoise CEO Andrew Morris gives his thoughts, hot-takes, and whatever else he feels like.

‍

Featured

Decoding 2023: A GreyNoise Retrospective on Internet Exploitation

Where to find us

• GreyNoise Open Forum (Virtual | Thursday, Feb 15th) Join us for our next Open Forum, our townhall style event where the GreyNoise team shares what we've been up to lately and what's to come in the near future.‍
• FS-ISAC Americas Summit (In-Person| San Diego, CA | March 3-6) This year's theme is Thriving Together in a Dynamic World. This year's theme is Thriving Together in a Dynamic World. If you want to meet up with the team for a demo or a beer hit up abigail@greynoise.io.

Fresh Content

• Webinar Series: GreyNoise Tags 101, 201, 301
• Case Study: Detecting Cisco IOS XE Emerging Exploitation
• Blog:  Ivanti Connect Secure Exploited to Install Cryptominers
• Blog: The Confusing History of F5 BIG-IP RCE Vulnerabilities
• Blog: Decoding Mass Exploitation in 2023: A GreyNoise Perspective
• Blog: The Confusing History of F5 BIG-IP RCE Vulnerabilities
  
• Podcast/Vlog: Weekly Livestream - Storm Watch

Newly Released Tags

GreyNoise Labs released 37 tags during the month of January.

• 2024-01-26 — Narcissus RCE Attempt
• 2024-01-25 — Traq RCE Attempt
• 2024-01-25 — Jenkins API Scanner
• 2024-01-24 — SAP Parameter Injection Attempt
• 2024-01-24 — Jenkins Authenticated RCE Attempt
• 2024-01-23 — GoAnywhere MFT Authentication Bypass Attempt
• 2024-01-23 — TOTOLink CVE-2024-0292 RCE Attempt
• 2024-01-23 — Panalog SQLi Attempt
• 2024-01-23 — Tenda AX1803 Buffer Overflow Attempt
• 2024-01-23 — VMware Version Check
• 2024-01-22 — NextGen Mirth Connect CVE-2023-37679 RCE Attempt
• 2024-01-22 — NextGen Mirth Connect CVE-2023-43208 RCE Attempt
• 2024-01-22 — Joomla! PHP Object Injection RCE Attempt
• 2024-01-22 — Atlassian Confluence Template Injection RCE Attempt
• 2024-01-22 — Feroxbuster
• 2024-01-19 — TikiWiki Sirius jhot.php RCE Attempt
• 2024-01-19 — Narcissus Image Configuration RCE Attempt
• 2024-01-19 — Adobe ColdFusion CVE-2023-44353 RCE Attempt
• 2024-01-19 — MajorDoMo RCE attempt
• 2024-01-19 — WordPress LearnPress RCE Attempt
• 2024-01-18 — Adobe ColdFusion CVE-2023-38203 RCE Attempt
• 2024-01-18 — SonicOS RCE Attempt
• 2024-01-18 — Wordpress CVE-2023-6875 Auth Bypass Attempt
• 2024-01-18 — ESAFENET DLP dataimport RCE
• 2024-01-16 — JetNexus/EdgeNexus RCE Attempt
• 2024-01-16 — Ivanti Connect Secure (ICS) RCE Attempt
• 2024-01-12 — Jboss Application Server CVE-2017-12149 Check
• 2024-01-12 — Ivanti Connect Secure (ICS) Scanner
• 2024-01-12 — GitLab Account Takeover Attempt
• 2024-01-12 — ThinkPHP RCE Attempt
• 2024-01-12 — Sangfor IOM Arbitrary File Read Attempt
• 2024-01-09 — F5 BIG-IP iControl CVE-2021-22986 RCE Attempt
• 2024-01-09 — F5 BIG-IP iControl CVE-2021-23015 RCE Attempt
• 2024-01-08 — Allaire Forums CVE-1999-0800 Attempt
• 2024-01-08 — Bank Locker Management System SQL Injection Attempt
• 2024-01-05 — GLPI CVE-2013-5696 Attempt
• 2024-01-03 — Apache OFBiz Authentication Bypass Attempt

Community

• Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
• ‍Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
• ‍Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 
• Join the GreyNoise Team - Help develop the next generation of internet intelligence products. GreyNoise culture is rooted in transparency, communication, and community. We believe these core tenets enable diversity, equity, and inclusion. Check out our current openings.

Joke of the Month

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

‍

‍

Not subscribed to our NoiseLetter? Subscribe here.

‍