Detection engineering is drowning in manual work. Agentic workflows can change that. In this RSAC webcast, GreyNoise’s Mark Mager walks through how to: ➡️ Identify where agentic workflows remove friction ➡️ Prioritize R&D investment across an agentic analysis pipeline ➡️ Apply frontier LLM outputs to craft more effective detection logic for critical threats Register here: rsaconference.com/Library/we…

I got to catch up with @Andrew___Morris of @GreyNoiseIO to poke and play with their "Project Swarm": easy honeypots at scale and really neat network insights. Video here: piped.video/NQJco54_Zq4

We’re bringing NoiseFest to Barcelona! 🎉 If you’re in town for Fal.Con or BCC’26, we’d love for you to join GreyNoise, @Vega_Threat, and @NomaSecurity for an evening of cocktails, Nobu’s signature canapés, and great conversation with fellow security leaders. 📅 Tuesday, November 3 | 20:00–23:00 📍 Nobu Restaurant Barcelona Take a break from the conference floor, connect with peers, and swap stories about what’s really happening on the threat landscape. ➡️ Request your invite: info.greynoise.io/events/noi…

In GreyNoise data this week, a recurring pool of malicious IPs checked Microsoft Exchange servers for ProxyNotShell in passes no more than two days apart. About a thousand malicious IPs ran the check on every odd-numbered day. Separately, attempts on a known exploited Metabase flaw stepped up more than threefold from 11 October. GreyNoise customers get the full weekly brief, our public At The Edge Clear one-pager is below + 🔗 greynoise.io/resources/at-th… #ThreatIntelligence #CyberSecurity #GreyNoise #InfoSec

Findings during a live GreyNoise demo led to follow-up research into commercial residential proxy abuse by malicious actors. What we found: a proxyjacking campaign that successfully compromised devices across 34 countries. Read the full analysis, including IOCs and what defenders should be watching for: greynoise.io/blog/proxyjacki… #GreyNoise #ThreatIntel #CyberSecurity

A GreyNoise product demonstration led to the initiation of a intrusion investigation and some follow-up research into a malicious cyber actor conducting proxyjacking operations against network edge devices turning them into commercially available residential proxies. greynoise.io/blog/proxyjacki…

Last week, GreyNoise reported Hikvision CVE-2021-36260 exploitation attempts against Ukraine that ran for nine days, then stopped. Near zero for months. A surge from Sep 23 to Oct 1, almost all from four IPs. Then nothing from those four since. 🔗 Full analysis: greynoise.io/blog/hikvision-… #ThreatIntelligence #Cybersecurity #Ukraine #Hikvision #CVE202136260

We're proud to be a data partner of Ardence, @trmlabs new AI investigation platform. Learn more: trmlink.info/4jIMe4c

We're proud to sponsor the FS-ISAC 2026 Americas Fall Summit in Austin! Stop by booth #82 to connect with our team and hear how GreyNoise is helping financial institutions cut through internet noise to focus on threats that are actually targeting them. #FSISAC #financialservices #cybersecurity #AISecurity

For months, GreyNoise recorded almost no Hikvision camera exploit attempts against Ukraine. On Sept 21 activity surged for nine days during Russian strikes, almost all from four IPs, then stopped. We can't say if the two are linked. 🔗greynoise.io/blog/hikvision-… #ThreatIntel #Ukraine

CVE volume nearly tripled between 2018 and 2025. By 2027, it could reach hundreds of thousands per year. The old detection engineering playbook can't keep up. GreyNoise's Mark Mager breaks down what has to change and how agentic AI workflows are the answer in this article featured in the October issue of Cyber Defense Magazine (pages 188-191): cyberdefensemagazine.tradepu…

An adversary tried Citrix NetScaler CVE-2026-88771 against a GreyNoise Swarm participant sensor more than three days before public disclosure, and GreyNoise labeled it malicious within seconds, before any CVE-specific detection existed. New sources followed within a day. Elsewhere, sources checked F5 BIG-IP for a newly listed KEV flaw in the week CISA set a three-day federal deadline, and adversaries attempted two CrushFTP flaws in back-to-back single-day bursts. Next.js bypass sources ran at least four times their late August daily level on a flaw outside KEV. Build the control on the request behavior. Customers get the full weekly brief. Our public At The Edge one-pager is attached + greynoise.io/resources/at-th…

On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78\.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. This is now known as CVE-2026-88771. greynoise.io/blog/swarming-a…

A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24. 🔗 Full analysis: greynoise.io/blog/swarming-a… #GreyNoise #Citrix #Netscaler #CVE202688771 #Cybersecurity #0day #Vuln

On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed. The attacker's post-exploitation payload and IOCs: greynoise.io/blog/swarming-a… #GreyNoise #Citrix #Netscaler #CVE202688771 #Cybersecurity #0day #Vuln

Our founder @Andrew___Morris joined Detection Dispatch (Alex's Version) to talk Project Swarm, deception-based detection, why real attack data matters more than ever in the age of AI-driven threats, and more. Watch/listen to the episode Youtube: piped.video/watch?v=q2ML-1RN… Spotify: open.spotify.com/episode/2Yj…

This week adversaries escalated attempts against flaws whose patches have been available for years. Adversaries escalated attempts against a known exploited Spring Cloud Function code execution flaw and an Elastic Kibana file inclusion flaw from single digits to several hundred daily sources on one day, and neither had come back down when collection closed. A Sophos Firewall authentication bypass this series recorded as subsided in April came back at roughly sixty times the prior period's daily rate. Rented hosting rotates between periods, so build the control on the behavior rather than on the address. Customers get the full weekly brief. Our public At The Edge one-pager is attached + 🔗greynoise.io/resources/at-th…

Welcome to the team 💪 "With the addition of these new leaders to GreyNoise, we are deepening our commitment to protecting the national security missions of the United States and our allies." Read the full announcement: greynoise.io/press/greynoise…

A single threat actor. One IP address. GreyNoise tracked a suspected Chinese-speaking actor across months of activity, from UniFi to WordPress to ZyXEL, including a novel CVE exploit. Here's what we saw: greynoise.io/blog/open-seaso…