Mastodawn

GreyNoise is proud to be sponsoring the CrowdStrike CrowdTour across 8 cities! We’re excited to highlight how our integration with Falcon Next-Gen SIEM helps SOC teams stop chasing ghosts and start catching real threats.

If you’re attending a tour stop or local to the area, let’s connect to chat about:
- Validating your perimeter in real time.
- Protecting the identity layer from brute-force scanners.
- Filtering out background noise to focus on high-fidelity alerts.

👇Book a meeting with us here:
https://info.greynoise.io/crowdtour-2026-meet

GreyNoise 1d ago

Last week, half of all new scanning IPs observed by GreyNoise geolocated to Hong Kong.

A quarter-million of them never completed a TCP handshake.

The ones that did were scanning MySQL, SSH, SMB, and RDP across 20+ countries.

One of these is the signal. The other is noise.
🔗 https://www.greynoise.io/blog/ghost-fleet-half-new-scanning-ips-geolocated-to-hong-kong

GreyNoise 2d ago

200,886,675 sessions. 101 unique source IPs. March 16–23, 2026.

GreyNoise At The Edge intelligence brief highlights:

1. The MEVSPACE RDP brute-force operator returned after a 99.8% infrastructure collapse — single IP generated 7,975,241 sessions before deliberately withdrawing after 4 days. GreyNoise has tracked a surge-withdraw-reconstitute cycle since January 2026, reinforcing that well-resourced operators can reconstitute capacity within days.

2. Two coordinated campaigns emerged: VPSVAULT.HOST (IoT worm weaponizing 21+ CVEs against 12+ manufacturers) and Omegatech (TLS fingerprint randomization with 5,854 unique JA3s per node).

3. Sophos CVE-2022-1040 exploitation stabilized at 638,654 sessions in its fifth consecutive week. Enterprise VPN credential pressure reached week 9 across five vendors with 2.9M+ combined sessions.

4. n8n CVE-2026-21858 (CVSS 10.0) reached 118,086 sessions with links to MuddyWater and ZeroBot. ICS/SCADA reconnaissance expanded with new HMI and PLC vulnerabilities trending.

🔗 https://www.greynoise.io/resources/at-the-edge-clear-032326

#ThreatIntel #CyberSecurity #InfoSec #GreyNoise

GreyNoise Mar 19

New GreyNoise At The Edge brief: The internet's scanning infrastructure is reorganizing.

UCLOUD (HK) surged +578% to become the #1 scanning ASN — now 15.6% of all observed traffic. Western providers declining simultaneously.

301.8M sessions. 439K IPs. Here's what we found.

🔗 https://www.greynoise.io/resources/at-the-edge-clear-031626

GreyNoise Mar 17

Starting at the top of the hour! 🚨

Hope to see you there to break down all things State of the Edge with @morris @hrbrmstr + Nishawn!

There's still time to register 👉 https://info.greynoise.io/webinar/state-of-the-edge-2026

GreyNoise Mar 16

TOMORROW! 🚨 Join us for a fast-paced dive into the 2026 GreyNoise State of the Edge Report...from rogue residential botnets to 26-year-old CVEs still getting hammered. Save your spot and see what’s actually hitting the edge.
🔗 https://info.greynoise.io/webinar/state-of-the-edge-2026

GreyNoise Mar 11

🚀 New GreyNoise + Google SecOps integrations are live. See which IPs scan everyone vs just you, now directly inside Google SecOps.

🧩 SIEM: Standardized ingestion, dashboards, YARA-L rules, and saved searches
⚡️ SOAR: v7.0 actions, webhooks, and playbooks to automate triage

https://www.greynoise.io/blog/greynoise-google-secops-integration

New GreyNoise Integrations Enhance Detection and Response Capabilities in Google SecOps

GreyNoise's new and improved integration with Google SecOps delivers standardized indicator ingestion, pre-built dashboards, YARA-L detection rules, saved searches, SOAR response actions, webhook support, and ready-to-deploy playbooks.‍

so I work at @greynoise which I'm sure has a more fancy and corporate description but, in a nutshell, I take data from honeypots. I identify exploits being sent to these honeypots. I write suricata signatures to match the exploits and add metadata describing what it is, when it was made, etc. That data is then sent as a data feed to SIEMs to give soc analysts another data point to hopefully make alert triage faster and sent to TIPs for intel teams. It's also put on the website to give a historical graph, geoip info, IPs to add to your firewall, things of that sort. I also conduct research in our logs to find things that are either not being talked about or things that are more niche and blog about them (I wrote this https://www.labs.greynoise.io/grimoire/2026-02-24-whats-that-string/ ).

What’s That String? That Time a Weird String Revealed a Whole Operation – GreyNoise Labs

One weird payload turned out to be a loose thread on an active hacking operation.

GreyNoise Labs

GreyNoise Mar 11

Hey London! We are closing down day 1 at #ecrimecongress today + cant wait to see you tomorrow! If you're around, say hi to the team, watch a demo, and grab some great swag! 🔥

GreyNoise Mar 10

Edge attacks are evolving faster than your playbook. Join @morris, @hrbrmstr + Shawn Smagh next Tuesday for a live breakdown of where edge targeting is concentrating, where defenses are failing, + what 162 days of internet-scale data says about your real exposure.

https://info.greynoise.io/webinar/state-of-the-edge-2026

Webinar - State of the Edge: Where Edge Targeting Concentrated — And Where Defenses Have Measurable Gaps

Join GreyNoise's Founder, VP of Data Science + Research, and Director of Intelligence as they break down key findings from the 2026 GreyNoise State of the Edge Report.