NEW: GreyNoise At The Edge Intel Brief (March 23-30)

187,998,900 sessions from 100 top source IPs observed by GreyNoise sensors between March 23-30, 2026. Daily volumes surged 4x mid-week — from 8.5M to 36.6M in 72 hours.

1. VPSVAULT IoT botnet recruitment across 22 CVEs — 3,347,443 sessions from 4 Brazilian IPs targeting Hikvision, MikroTik, TP-Link, D-Link devices. Includes CVE-2026-24061, now on CISA KEV.

2. VisionHeight fleet of 6 AWS IPs generated 5,892,055 sessions mapping enterprise perimeters across Palo Alto, Sophos, Ivanti, Citrix, F5, and ConnectWise — probing CVE-2024-1709 (CVSS 10.0).

3. React/Next.js exploit chaining (CVE-2025-55182 + CVE-2025-29927) produced 1,338,336 sessions, with attackers spoofing GoogleBot user-agents to bypass detection.

4. At least 4 new scanning operations activated simultaneously mid-week, driving the sharp volume surge across the observation period.

Here's what we found: 🔗 https://www.greynoise.io/resources/at-the-edge-clear-033026

#ThreatIntel #CyberSecurity #InfoSec #GreyNoise

Cisco has suffered a cyberattack after threat actors used stolen credentials from the recent Trivy supply chain attack to breach its internal development environment and steal source code belonging to the company and its customers.

https://www.bleepingcomputer.com/news/security/cisco-source-code-stolen-in-trivy-linked-dev-environment-breach/

Oracle have laid off 30k employees today. They did it to personal email accounts at 6am 🫡 saying they needed the money to spend on GenAI instead. https://thenextweb.com/news/oracle-layoffs-march-2026

Oracle’s share price since they went GenAI nuts:

"Help me," the duke said. "My physicians can't say what ails me, but I've lost all pleasure in what I used to enjoy."

The witch examined him, and paused over his hand.

"Nice ring. It is new?"

"A recent gift from the king. Why? Is it cursed?"

It was made to dampen cruelty.

"No," said the witch.

#MicroFiction #TootFic #SmallStories

"I grant you one wish," the magic fish said.

"To eat my mother's pancakes again, just like when I was a child."

"Are you sure?"

"You think it frivolous?"

"No. But to grant it I must send you back to the child you were, with no adult memories."

"Would my life change?"

"You ask that every time."

#TootFic #MicroFiction #SmallStories

Last week, half of all new scanning IPs observed by GreyNoise geolocated to Hong Kong.

A quarter-million of them never completed a TCP handshake.

The ones that did were scanning MySQL, SSH, SMB, and RDP across 20+ countries.

One of these is the signal. The other is noise.
🔗 https://www.greynoise.io/blog/ghost-fleet-half-new-scanning-ips-geolocated-to-hong-kong

We’re kicking off #runZero Day at 9:45 AM PT!

We’ll be live in San Francisco, next door to #RSAC, with our hosts Tod Beardsley and Rob King.

The schedule includes expert insights from leading voices across the industry.

Don’t miss a minute as we discuss the shifting cybersecurity landscape and the trends defining our industry!

Watch it live: https://www.runzero.com/rsac-live-2026/