NoiseLetter - October 2023

Summary

October has certainly lived up to it's spooky reputation with a multitude of vulnerabilities. From Cisco to Citrix to Confluence and more, our dedicated team at GreyNoise has been diligently monitoring these vulnerabilities and providing valuable updates. Be sure to check out this month's NoiseLetter to stay informed and discover what else we've been working on.

Andrew Unfiltered

GreyNoise CEO Andrew Morris gives his thoughts, hot-takes, and whatever else he feels like.

Announcements

CVE-2023-20198: Cisco IOS XE
CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway
CVE-2023-22515: Atlassian's Confluence
CVE-2023-38545: Curl/Libcurl

‍

GreyNoise Smart Search

Introducing Smart Search! Smart Search is a tailored collection of GNQL queries, put together by the GreyNoise Labs team, that allows users to discover and explore emerging threats. Find out what IPs are scanning for compromised Cisco IOS XE CVE-2023-20198 devices or IPs attempting to exploit Zyxel CVE-2017-6884. Check it out in the GreyNoise Visualizer.

‍

Storm Watch - Weekly Livestream and Podcast

Storm Watch is a livestream hosted by the GreyNoise team, where we dive into recent vulnerabilities, emerging threats, and so much more. It all began with a video livestream in May, and now we are thrilled to announce that we have also released it as a podcast. Tune in every Tuesday at 9:30am CT / 10:30am ET to watch or listen. We would absolutely love for you to join us, whether it's to heckle our hosts, share your thoughts, or simply stay up to date with all things cybersecurity. Learn More >>

‍

Where to find us

CYBERWARCON (In-Person | Arlington, VA | Nov. 9th) GreyNoise is excited to be sponsoring this year's CYBERWARCON. If you are attending the event, come by our table or to the networking reception we are sponsoring to say hello!
‍GreyNoise 101 +201 (Virtual | Thursday, November 30th) This 1-hour session is perfect for anyone new to GreyNoise and interested in learning how to use the platform. In the first 30 minutes, we'll cover the basics and give you a solid foundation. Stick around for the last 30 minutes to dive into more advanced use cases. Don't miss this opportunity to level up your GreyNoise skills.
DoDIIs Conference (In-Person | Portland, OR | Dec. 12-14) GreyNoise will be sponsoring DoDIIs again this year! If you are going to be at this event swing by Booth #852 for some awesome swag or schedule 1:1 time to get a demo and chat with the team.

‍

Fresh Content

ATTACKERS WITHOUT BORDERS

In today's interconnected world, understanding the landscape of malicious internet cyber activity is crucial for organizations and nation states to protect their digital assets and maintain a strong security posture.

To that end, researchers from GreyNoise Labs analyzed the volume and type of malicious traffic observed by GreyNoise Intelligence’s planetary scale sensor network and created these reports to help organizations and agencies make more informed decisions about their cybersecurity strategies.

Current country reports include (with more to come):

Additional Content

Blog: Introducing Sift: Automated Threat Hunting
Blog: Precursor: A Quantum Leap in Arbitrary Payload Similarity Analysis
Podcast: Secure Ventures - Andrew Morris on Honeypots and Threat Intelligence
eBook: GreyNoise 2023 Guide to Threat Hunting
OnDemand Webinar: Stay Ahead of Cyber Threats with GreyNoise

Newly Released Tags

GreyNoise Labs released 29 tags during the month of October:

2023-10-26 — Laravel Telescope Scanner
2023-10-24 — Dell EMC CGi Injection Check
2023-10-23 — Citrix ADC Netscaler CVE-2023-4966 Information Disclosure Attempt
2023-10-23 — SCP|SFTP|FTP Sensitive Data Exposure Scanner
2023-10-20 — ZenTao CMS SQL Injection Attempt
2023-10-20 — Cisco IOS XE Privilege Escalation Attempt
2023-10-19 — Atlassian Jira Path Traversal Attempt
2023-10-19 — Cisco IOS XE RCE Attempt
2023-10-18 — V2 Catalog Scanner
2023-10-18 — Zimbra Collaboration Suite Directory Traversal Attempt
2023-10-18 — Oracle WebLogic CVE-2018-2894 File Upload Attempt
2023-10-18 — MLFlow Directory Traversal Attempt
2023-10-18 — Microsoft Exchange Server Scanner
2023-10-17 — Yii Framework Information Disclosure Scanner
2023-10-16 — Cisco IOS XE CVE-2023-20198 Scanner
2023-10-13 — Jira Data Exposure Scanner
2023-10-13 — Fortinet FortiSIEM Command Injection Attempt
2023-10-13 — Fortinet FortiWLM Command Injection Attempt
2023-10-12 — SharePoint CVE-2023-29357 Check
2023-10-11 — Atlassian Confluence Server Scanner
2023-10-11 — cURL/libcurl Heap Buffer Overflow Attempt
2023-10-11 — SOCKS5 Proxy Scanner
2023-10-10 — Atlassian Confluence Server Privilege Escalation Attempt
2023-10-06 — security.txt Scanner
2023-10-05 — robots.txt Scanner
2023-10-04 — CommVault CommCell Authentication Bypass Attempt
2023-10-04 — Lucee Admin Server Scanner
2023-10-02 — Cisco ASA Information Disclosure Attempt
2023-10-02 — Richfaces RCE Scanning

Joke of the Month

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

Community

Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team.
‍Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
‍Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke.
Join the GreyNoise Team - Help develop the next generation of internet intelligence products. GreyNoise culture is rooted in transparency, communication, and community. We believe these core tenets enable diversity, equity, and inclusion. Check out our current openings.

‍

Not subscribed to our NoiseLetter? Subscribe here.

‍