NoiseLetter September 2024

This year is flying by, and spooky season is already upon us! 👻  In this month's NoiseLetter, we’re diving into exciting highlights from LabsCon, BSides, and fresh blogs on election security, state-sponsored actors, and a mysterious internet noise storm. Plus, don’t miss key upcoming events like our Quarterly Roadmap Showcase + DoDIIS!

‍

Andrew Unfiltered

GreyNoise Founder Andrew Morris gives his thoughts, hot-takes, and whatever else he feels like.

‍

Featured

Vuln Prioritization, Project Plasma + Platform Updates!  

We've been hard at work driving innovation, with recent launches such as our Vulnerability Prioritization solution to improve remediation strategies, Project Plasma for researchers focused on honeypot deployment and traffic analysis, and major platform updates that enhance data collection and visualization. To explore these exciting developments and get a sneak peek at what's ahead for GreyNoise, be sure to register for our upcoming product roadmap webinar, where we'll dive deeper into these advancements and share what's next. Register Here >>

Where to find us

• DoDIIS Worldwide  (In-Person | Oct 27-30) We are proud to sponsor DoDIIS again this year! Come to booth #1924 for a demo and some swag!
• Censys Threat Hunting Workshop (In-Person | Oct 29) Join Michael Schwartz from Censys + Andrew Morris from GreyNoise, on a guided exploration through the Censys + GreyNoise data sets.‍
• API Cybersecurity Conference  (In-Person | Nov 12-13) Join us in Texas for the Annual API Cybersecurity Conference for the Oil and Natural Gas Industry + stop by booth #202. 

Fresh Content

• Webcast: Storm⚡️Watch | Latest Episode
  
• Blog: The Role of State-Sponsored Actors in Election Interference
• Blog: GreyNoise Reveals New Internet Noise Storm
• Blog: Enhancing the Understanding of Securing Internet-Exposed ICS‍
• Blog:  Phishing and Social Engineering: The Human Factor in Election Security‍
• Grimoire Blog: What Are Hackers Searching for in SolarWinds Serv-U? 

Recent Tags and Vulnerabilities

GreyNoise Labs released 55 tags during the month of September:

• NET Remoting Scanner
• ‍AVTECH IP Camera RCE CVE-2024-7029 Attempt
• ‍Apache Struts OGNL Injection CVE-2012-0394 Attempt
• ‍Atlassian JIRA Service Desk Misconfiguration Attempt
• ‍Atlassian JIRA Service Desk Misconfiguration Scanner
• ‍Atlassian Jira XSS CVE-2018-5230 Attempt
• ‍BerriAI LiteLLM CVE-2024-6587 SSRF Attempt
• ‍Caucho Resin Information Disclosure Attempt
• ‍Chamilo SQL Injection Attempt
• ‍Cisco Smart Licensing CVE-2024-20439 Hardcoded Credentials Attempt
• ‍CouchDB Erlang Ephemeral Server Connection Scanner
• ‍D-Link DAP-1620 LFI CVE-2021-46381 Attempt
• ‍D-Link soap.cgi CVE-2018-6530 Command Injection Attempt
• ‍DrayTek VigorConnect Path Traversal CVE-2021-20124 Attempt
• ‍ElasticSearch Information Disclosure Attempt
• ‍ElasticSearch Information Disclosure Scanner
• ‍Employee Management System SQL Injection Attempt
• ‍Fortra FileCatalyst Workflow SQL Injection CVE-2024-5276 Attempt
• ‍Fortra FileCatalyst Workflow SQL Injection CVE-2024-5276 Scanner
• ‍Geovision Login Attempt
• ‍Google Cloud Default Configuration Scanner
• ‍Hikvision Login Attempt
• ‍Huawei Router Credential Disclosure Scanner
• ‍Ivanti Cloud Services Appliance OS Injection CVE-2024-8190 Attempt
• ‍Jellyfin Login Attempt
• ‍Joomla! Core Content History SQL Injection CVE-2015-7297 Attempt
• ‍MasterStudy LMS WordPress Plugin SQL Injection CVE-2024-1512 Attempt
• ‍Microsoft RD Web Access Anonymous Authentication Timing Attack Attempt
• ‍Microsoft RD Web Access Anonymous Authentication Timing Attack Scanner
• ‍MikroTik RouterOS Privilege Escalation CVE-2023-30799 Attempt
• ‍Netwrix Auditor Remote Connection Scanner
• ‍Oracle ADF CVE-2022-21445 Deserialization RCE Attempt
• ‍Oracle ADF CVE-2022-21445 Deserialization RCE Scanner
• ‍Progress WhatsUp Gold CVE-2024-6670 RCE Attempt
• ‍R-HUB TurboMeeting CVE-2024-38289 SQL Injection Attempt
• ‍Raisecom list_base_config.php CVE-2024-7120 Command Injection Attempt
• ‍Raisecom list_base_config.php CVE-2024-7120 Command Injection Scanner
• ‍SPIP BigUp Plugin Command Injection CVE-2024-8517 RCE Attempt
• ‍SPIP Scanner
• ‍SensioLabs Symfony FragmentListener Authentication Bypass CVE-2015-4050 Attempt
• ‍Solara Local File Inclusion CVE-2024-39903 Attempt
• ‍Squid Cache Manager Access Attempt
• ‍Svn Config Crawler
• ‍Tongda OA Authentication Bypass Attempt
• ‍UFIDA NC uapjs RCE Attempt
• ‍VENGD Arbitrary File Upload Attempt
• ‍Veeam Backup and Replication CVE-2024-40711 Unsafe Deserialization RCE Attempt
• ‍Veeam Backup and Replication Version Scanner
• ‍WannaCry Variant SMB Connection Attempt
• ‍Weaver E-cology FileDownloadForOutDocSQL SQL Injection Attempt
• ‍Weaver E-mobile client.do SQLi Attempt
• ‍WeiPHP SQL Injection CVE-2020-20300 Attempt
• ‍WordPress Author Enumeration Attempt
• ‍Xiongmai NVR URI CVE-2022-45460 Scanner
• ‍Zyxel NAS Firmware Backdoor CVE-2024-29972 Attempt

Community

• Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
• ‍Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
• ‍Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 

Meme of the Month

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

‍

Not subscribed to our NoiseLetter? Subscribe here.