NoiseLetter October 2024

👻 Boo! It’s Ghostie’s favorite time of year, so of course, we’re celebrating with a Halloween-day highlight reel. From our company offsite and Quarterly Roadmap Showcase (recording included!) to a candy bracket showdown, spooky blogs on cyber threats, and two MAJOR drops you won’t want to miss—this lineup is scarier (+ sweeter) than ever!

‍

Andrew Unfiltered

GreyNoise Founder Andrew Morris gives his thoughts, hot-takes, and whatever else he feels like.

Featured

The Persistent Perimeter Threat: Strategic Insights from a Multi-Year APT Campaign Targeting Edge Devices

This blog explores a multi-year APT campaign that exploited network perimeter devices to infiltrate high-value targets. Learn key insights and practical steps to help organizations strengthen defenses and manage exposure to evolving perimeter threats. Learn More >>

‍

Zero-Day Vulnerability Discovered in Live Streaming Cameras with the Help of AI 

GreyNoise has discovered previously undisclosed zero-day vulnerabilities in IoT-connected live streaming cameras, leveraging AI to catch an attack before it could escalate. This marks one of the first instances where threat detection has been augmented by AI to discover zero-day vulnerabilities. Learn More >>

‍

Where to find us

• API Cybersecurity Conference (In-Person | Nov 12-13) Join us in Texas for the Annual API Cybersecurity Conference for the Oil and Natural Gas Industry + stop by booth #202. 
• How GreyNoise Discovered Zero-Day Vulnerabilities Using AI Webinar (Virtual | Nov 19th) Join Andrew Morris + Daniel Grant for an exclusive webinar on how we intercepted a zero-day IoT exploit with AI and human expertise. Register Today >>

‍

Fresh Content

• Webcast: Storm⚡️Watch | Latest Episode
• Webinar: Quarterly Roadmap Showcase
  
• Blog: Protecting Democracy From The Growing Threat of Deepfakes + Disinformation
• Blog: U.S. and UK Warn of Russian Cyber Threats: 9 of 12 GreyNoise-Tracked Vulnerabilities in the Advisory Are Being Probed Right Now 
• Press Release: How GreyNoise Discovered Zero-Day Vulnerabilities Using AI

‍

Recent Tags and Vulnerabilities

GreyNoise Labs released 49 tags during the month of October:

• ABB ASPECT CVE-2023-0636 Command Injection Attempt
• ABB ASPECT Enterprise CVE-2024-6209 Credential Leak Attempt
• Adobe ColdFusion CVE-2023-38205 Security Feature Bypass Attempt
• Anyscale Ray CVE-2023-48022 SSRF Attempt
• Anyscale Ray cpu_profile CVE-2023-6019 Command Injection Attempt
• Apache OFBiz CVE-2024-45195 Data File Validation RCE Attempt
• Apache OFBiz Stats Screen CVE-2024-45507 SSRF Attempt
• Apache Struts CVE-2016-3081 OGNL Injection Attempt
• Apache Struts CVE-2016-3087 OGNL Injection Attempt
• D-Link DIR-860L Buffer Overflow CVE-2024-42812 RCE Attempt
• D-link DIR-820 CVE-2023-25280 RCE Attempt
• DrayTek Vigor Routers CVE-2020-15415 RCE Attempt
• Exim SPA CVE-2020-12783 Authentication Bypass Attempt
• Fonoster VoiceServer CVE-2024-43035 LFI Attempt
• Four-Faith CVE-2024-9643 Backdoor Attempt
• Four-Faith CVE-2024-9644 Authentication Bypass Attempt
• Four-Faith Wireless Mobile Router CVE-2019-12168 RCE Attempt
• HotExBilling Manager Cross Site Scripting CVE-2015-2781 Check
• Jorani CVE-2023-26469 Log Poison RCE Attempt
• Kubelet Stats Scanner
• Laravel APP_DEBUG Verbose Error Scanner
• Linear eMerge CVE-2024-9441 OS Command Injection Attempt
• Mirai Bruteforcer Attempt
• Mirai TCP Scanner
• NocoDB CVE-2023-35843 Path Traversal Attempt
• POP3 Login Attempt
• Palo Alto Expedition OS Command Injection CVE-2024-9463 Attempt
• Palo Alto Networks CVE-2024-5910 Account Takeover Attempt
• Palo Alto Networks CVE-2024-9465 Unauth SQLi Attempt
• RocketMQ NameServer Code Injection CVE-2023-37582 Attempt
• SPIP porte_plume plugin CVE-2024-7954 Unauthenticated RCE Attempt
• SolarWinds Web Help Desk CVE-2024-28987 Hard-Coded Credentials Attempt
• SpiderFlow CVE-2024-0196 Command Injection Attempt
• Spring Cloud Data Flow Skipper server CVE-2024-22263 Arbitrary File Write Attempt
• TOTOLINK A3700R CVE-2023-46574 RCE Attempt
• TOTOLINK EX1800T CVE-2024-34257 RCE Attempt
• Teltonika RUT9XX OS Command Injection CVE-2018-17532 RCE Attempt
• Tenda G3 Router OS Command Injection CVE-2024-46628 Attempt
• Traccar CVE-2024-24809 Unrestricted Upload Attempt
• Traccar CVE-2024-31214 Unrestricted File Upload Attempt
• VICIdial CVE-2024-8503 SQL Injection Attempt
• VNC Bruteforce Attempt
• VNC Login Attempt
• WooCommerce Authentication Bypass CVE-2023-28121 Attempt
• WordPress GiveWP Plugin CVE-2024-5932 Object Injection Attempt
• WordPress Hash Form Plugin CVE-2024-5084 RCE Attempt
• Zimbra Collaboration Suite CVE-2024-45519 RCE Attempt
• Zyxel CVE-2024-6342 Command Injection NAS Attempt
• Zyxel nebula_ap_redirect CVE-2024-7261 Overflow Attempt

‍

Community

• Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
• ‍Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
• ‍Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 

‍

Meme of the Month

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

‍

Not subscribed to our NoiseLetter? Subscribe here.