NoiseLetter March 2025

It's time for your monthly dose of vuln talk, product updates, and everything going on in the world of GreyNoise. April’s stacked with in-person events, happy hours, fresh webinars, and a replay you won’t want to miss. Whether you’re joining us in person or tuning in online, there are plenty of ways to make some noise with us this month. Let’s get into it. 🤘

‍

A̶n̶d̶r̶e̶w̶ Bob Unfiltered

GreyNoise Founder Andrew Morris gives his thoughts, hot-takes, and whatever else he feels like, but this month, Bob Rudis, VP of Data Science + Research, takes over and gives his thoughts.

‍

Featured

GreyNoise is crashing RSAC 2025, and we want to see you there! We’ll be posted up at booth #5148 in the North Expo Hall, hosting private briefings nearby, and throwing down at NoiseFest on April 30. Swing by, say hey, and let’s hang out in San Francisco. 🤘

Read More >>

‍

Product Announcements

Make our product team the happiest team in the world by sharing your honest feedback! 

• We're excited to announce our new gift card campaign on Gartner Peer Insights! Share your honest review of GreyNoise and receive a $25 gift card.
• Or go big and grab a $50 VISA gift card by sharing your thoughts on G2!‍
• BUT WAIT — there’s a slight catch...! To score the goods, your review needs to be posted + approved, and they can be kinda particular, so be sure to check out this quick doc with tips to make sure your work gets posted.Thanks for helping us spread the word and showing us love, we seriously appreciate you

Where to find us

• VulnCon (In-Person | Apr 7-10) Join us in Raleigh for VulnCon + hang out with us and our friends Censys + Vulncheck for a fun happy hour nearby at Dram & Draught.
• ‍GreyNoise University LIVE (Virtual | Apr 24) GreyNoise 101, now known as GreyNoise Univeristy LIVE is BACK! We are stoked to bring back this once-a-month webinar.  ‍
• RSA (In-Person | Apr 28 - May 1) We are excited to sponsor RSA this year! Come to booth N-5148 in the North Hall for a demo and some RSA exclusive swag! ‍
• NoiseFest SF (In-Person | Apr 30) If you'll be at RSAC don’t miss NoiseFest—a happy hour with all the GreyNoise flare! After a long day at the conference, unwind with great drinks, even better company, and the kind of cybersecurity chatter that pairs perfectly with a cold 🍻.

‍

Fresh Content

• Webcast: Storm⚡️Watch | Latest Episode
• Webinar: Mass Internet Exploitation in 2025: Real-World Trends, Ransomware, and Attack Techniques
• Blog: Surge in Palo Alto Networks Scanner Activity Indicates Possible Upcoming Threats
• Blog: Amid Reports of Worldwide Reboots, GreyNoise Observes In-the-Wild Activity Against DrayTek Routers
• Blog: GreyNoise Observes Active Exploitation of Critical Apache Tomcat RCE Vulnerability (CVE-2025-24813)
• Blog: Resurgence of In-The-Wild Activity Targeting Critical ServiceNow Vulnerabilities
• Blog: New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One Breach
• Blog: GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign
• Blog: GreyNoise Detects Active Exploitation of Silk Typhoon-Linked CVEs
• Blog: GreyNoise Observes Exploitation of Three Newly Added KEV Vulnerabilities
• White Paper: GreyNoise 2025 Mass Internet Exploitation Report
  

‍

Recent Tags and Vulnerabilities

GreyNoise Labs released 79 tags during the month of March:

• Advantive VeraCore Arbitrary File Upload CVE-2024-57968 Attempt
• Advantive VeraCore SQL Injection CVE-2025-25181 Attempt
• Apache Solr 9.1 enableRemoteStreaming SSRF Attempt
• Apache Tomcat partial PUT CVE-2025-24813 RCE Attempt
• ASUS RT-AX55 CVE-2023-39780 Command Injection Attempt
• ASUSWRT CVE-2018-20334 RCE Attempt
• Aviary Image Editor for Gravity Forms 3.0beta CVE-2015-4455 File Upload Attempt
• Aviary Image Editor for Gravity Forms 3.0beta CVE-2015-4455 File Upload Check
• Calckey and Iceshrimp Tag Search SQL Injection Attempt
• changedetection.io notification_urls CVE-2024-34061 Reflected XSS Check
• Chaosblade exec.CommandContext CVE-2023-47105 OS Command Execution Attempt
• Comodo UTM Firewall CVE-2018-17431 RCE Attempt
• CrushFTP Authentication Bypass CVE-2025-2825 Attempt
• D-Link DAP-1620 Buffer Overflow CVE-2025-2620 Attempt
• Dahua Smart Park Management CVE-2023-3836 Unrestricted File Upload Attempt
• DataLife Engine CVE-2013-1412 catlist PHP RCE Attempt
• Edimax IC-7100 CVE-2025-1316 Command Injection Attempt
• ElasticSearch Local File Include CVE-2015-5531 Attempt
• Ganglia Web Interface CVE-2024-52763 XSS Check
• GenieACS CVE-2021-46704 RCE Attempt
• GLPI CVE-2025-24799 SQL Injection Attempt
• GLPI CVE-2025-24801 RCE Attempt
• Gwyn Imagemap Selector WordPress Plugin 0.3.3 CVE-2022-1221 Reflected XSS Check
• Hanming Video Conferencing Path Traversal Attempt
• Hikvision iVMS File Upload Bypass Check
• HPE Insight Remote Support CVE-2024-53676 Arbitrary File Read Check
• IMO Cloud Office Arbitrary File Download Attempt
• IPTIME Default Login Attempt
• Ivanti Cloud Services Appliance CVE-2024-8963 RCE Attempt
• JAMF Blind XXE SSRF Injection Attempt
• Jolokia 1.3.7 CVE-2018-1000129 XSS Check
• Jolokia Unauthenticated MBeans Search Check
• Joomla jMarket 5.15 XSS Check
• Joomla! Component Percha Gallery Path Traversal CVE-2010-2035 Attempt
• Kubernetes ingress-controller Configuration Injection CVE-2025-1974 RCE Attempt
• Man-Group/DTale CVE-2024-3408 RCE Attempt
• Metinfo 7.0.0beta id CVE-2019-16996 SQL Injection Attempt
• Microsoft SRV2.SYS SMBv2 CVE-2009-3103 RCE Attempt
• Nagios XI 5.11.3 CVE-2023-48084 SQL Injection Attempt
• Netatalk CopyApplFile Stack Buffer Overflow CVE-2022-23125 Attempt
• Next.js Authorization Middleware Bypass CVE-2025-29927 Attempt
• Nginx UI Remote Command Execution CVE-2024-49368 Attempt
• NS-ASG Application Security Gateway CVE-2024-2330 SQL Injection Attempt
• OAS Platform CVE-2022-26833 REST API No Auth Attempt
• OpenPanel 0.3.4 CVE-2025-25872 RCE Attempt
• PuneethReddyHC SQL Injection CVE-2021-41648 Attempt
• pyLoad Arbitrary Code Execution CVE-2023-0297 RCE Attempt
• pyLoad Arbitrary Code Execution CVE-2024-39205 RCE Attempt
• QNAP QTS QuTS hero CVE-2023-39296 Prototype Pollution Attempt
• SAP NetWeaver Local File Inclusion CVE-2017-12637 RCE Attempt
• Seeyon OA M1Server Unsafe Deserialization RCE Attempt
• Selea Targa IP OCR-ANPR Camera SSRF Attempt
• Simple Task Managing System login.php SQL Injection CVE-2022-40032 Attempt
• Sitecore XP CVE-2019-9874 Deserialization Attempt
• Sitecore XP Deserialization RCE CVE-2025-27218 Attempt
• SonarQube Default Login Attempt
• TamronOS CVE-2023-3606 RCE Attempt
• Tenda CVE-2025-29029 Buffer Overflow Attempt
• Totolink CVE-2024-31814 Authentication Bypass Attempt
• Totolink EX200 CVE-2024-31807 RCE Attempt
• Totolink EX200 CVE-2024-31808 RCE Attempt
• Totolink EX200 CVE-2024-31809 RCE Attempt
• Totolink EX5000r CVE-2024-57016 RCE Attempt
• Totolink EX5000r CVE-2024-57017 RCE Attempt
• Totolink EX5000r CVE-2024-57018 RCE Attempt
• Totolink EX5000r CVE-2024-57019 RCE Attempt
• TOTOLINK X18 mtkhnatEnable Command Injection CVE-2025-1829 Attempt
• TVT NVMS9000 Information Disclosure Attempt
• Wazuh Python Object Deserialization RCE CVE-2025-24016 Attempt
• WeGIA Web Manager Path Traversal CVE-2025-26615 Attempt
• Western Digital My Cloud CVE-2016-10108 RCE Attempt
• WordPress Calendar Event Multi View 1.4.01 CVE-2021-24498 Reflected XSS Check
• WSO2 Data Analytics Server Cross-Site Scripting CVE-2017-14651 Check
• YONYOU UFIDA U8-CRM fillbacksetting.php SQL Injection Attempt
• ZCMS cms_channel.php SQL Injection Attempt
• Zivif PR115-204-P-RS V2.3.4.2103 CVE-2017-17106 Credential Leak Attempt
• Zoho ManageEngine CVE-2018-12998 Cross Site Scripting Attempt
• Zyxel dumpztplog.py Log Access Attempt
• Zyxel zld_product_spec.js Version Check

‍

Community

• Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
• ‍Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
• ‍Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 

‍

Meme of the Month

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

‍

Not subscribed to our NoiseLetter? Subscribe here.