GreyNoise
@greynoise.io
3.9K followers 24 following 330 posts
GreyNoise analyzes Internet background noise. Use GreyNoise to remove pointless security alerts, find compromised devices, or identify emerging threats.
Posts Media Videos Starter Packs
greynoise.io
GreyNoise has linked three concurrent campaigns targeting remote-access technologies — Palo Alto login attempts, Fortinet SSL VPN brute-forcing, and Cisco ASA scanning — all partially driven by the same threat actor(s) [High Confidence]. Full analysis 👇 #Palo #Cisco #Fortinet #ThreatIntel
Palo Alto Scanning Surges ~500% in 48 Hours, Marking 90-Day High
On October 3, 2025, GreyNoise observed a ~500% increase in IPs scanning Palo Alto Networks login portals, the highest level recorded in the past 90 days. The activity was highly targeted and involved ...
www.greynoise.io
greynoise.io
Palo login attempts are escalating, potentially driven by iteration through a large credential dataset. GreyNoise is sharing observed usernames/passwords for defender review.

🔗 Latest: www.greynoise.io/blog/palo-al...

#PaloAltoNetworks #ThreatIntel
greynoise.io
NoiseLetter, but make it fashionably late... 💅 We were at our company offsite, but we're back with our new GreyNoise MCP Server launch, Cisco ASA zero-day and VPN brute force insights, plus upcoming events, let's get into it!
NoiseLetter September 2025
Get GreyNoise updates! Read the September 2025 NoiseLetter for product news, key resources, the latest tags and vulnerabilities, and more.
www.greynoise.io
greynoise.io
GreyNoise observed a ~500% surge in IPs scanning Palo Alto Networks login portals on October 3, 2025 — the highest level we’ve seen in 90 days. Read our full analysis here 👇 #PaloAltoNetworks #PaloAlto #GreyNoise #ThreatIntel #PANOS
Palo Alto Scanning Surges ~500% in 48 Hours, Marking 90-Day High
On October 3, 2025, GreyNoise observed a ~500% increase in IPs scanning Palo Alto Networks login portals, the highest level recorded in the past 90 days. The activity was highly targeted and involved ...
www.greynoise.io
greynoise.io
We got (most of) the team together last week and it was magical, so grateful for each + every one of these GreyNoids ✨
greynoise.io
GreyNoise now has coverage for Cisco zero-days CVE-2025-20333 and CVE-2025-20362. Watch for exploit attempts in real-time:

CVE-2025-20333 (Net new): viz.greynoise.io/tags/cisco-a...

CVE-2025-20362 (Updated tag): viz.greynoise.io/tags/cisco-a...

#CiscoASA #ZeroDay #CVE202520333 #CVE202520362
greynoise.io
🚨GreyNoise has published a new Situation Report on Cisco ASA reconnaissance activity we observed before the new zero-days were disclosed.

Read the full report: info.greynoise.io/hubfs/Situat...

#Cisco #ASA #CiscoASA #GreyNoise #ThreatIntel #CVE202520333 #CVE202520362
greynoise.io
🗣️ Catch Dio9sys' talk this weekend at #PancakesCon!
⏰ Sunday, 9/21 from 12:20–1:00 PM CT
🎤 One-liners and One Needle: Bash and Needlebinding
📺 www.youtube.com/live/P4Shsxw...
ComfyCon x PancakesCon 2025
YouTube video by ComfyCon AU
www.youtube.com
greynoise.io
LIVE in 15 ⏲️
greynoise.io
GreyNoise University LIVE is back from a little summer break and ready to dive into demos, events, updates + dad jokes. Catch up with us TOMORROW at 12 ET! 📺
GreyNoise University LIVE
www.greynoise.io
greynoise.io
GreyNoise Intel is now accessible via MCP! AI agents and SOCs can triage, respond, and monitor threats with real-time IP reputation + behavior tags. Automate remediation, reduce false positives, + prioritize active threats.

Learn more ⬇️
GreyNoise Intel Now Available Through MCP
GreyNoise MCP Server is now available, enabling AI agents compatible with the Model Context Protocol (MCP) to efficiently consume GreyNoise intelligence, enhancing data-driven security insights.
www.greynoise.io
greynoise.io
GreyNoise University LIVE is back from a little summer break and ready to dive into demos, events, updates + dad jokes. Catch up with us TOMORROW at 12 ET! 📺
GreyNoise University LIVE
www.greynoise.io
greynoise.io
We're looking for some awesome folks to join our team!
If one of these roles catches your eye, we'd love to hear from you.

👩‍💻 greynoise.io/careers
We are hiring

Senior Software Engineer 
Head of US Federal Sales
RSM - US DoD + IC
RSM - US Enterprise
Sales Engineer - US DoD + IC

Apply now at greynoise.io/careers
greynoise.io
Hey London 👋🇬🇧 Join us Sept 11 at the Crowne Plaza Docklands during #DSEI for a GreyNoise Threat Brief! Insights, drinks, light fare, networking, limited swag + CPE credits all waiting for you!🍻
⏰ 16:30–18:30
👇 Save your spot today!
GreyNoise - Exclusive Threat Briefing at DSEI
Join our exlusive Threat Briefing at the Crowne Plaza London Dockside during DSEI. Our team will share timely insights into the latest threat intelligence trends, attacker behaviours, and how GreyNois...
info.greynoise.io
greynoise.io
GreyNoise observed two scanning surges against Cisco ASA devices in late August, both representing significant elevations above baseline. This activity led to the discovery of a botnet cluster solely scanning for Cisco ASA on August 26.
#CiscoASA #Cisco #GreyNoise #Cybersecurity #ThreatIntel
25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming
GreyNoise observed two scanning surges against Cisco Adaptive Security Appliance (ASA) devices in late August including more than 25,000 unique IPs in a single burst. This activity represents a signif...
www.greynoise.io
greynoise.io
We survived August in the desert, with fresh insights on early warning signals, 73 new threat tags, + lots of upcoming events. Check out August's NoiseLetter for everything you need to know this month. ☀️
NoiseLetter August 2025
Get GreyNoise updates! Read the August 2025 NoiseLetter for product news, key resources, the latest tags and vulnerabilities, and more.
www.greynoise.io
greynoise.io
We’re honored that GreyNoise Intelligence was acknowledged in the latest joint cyber advisory from the NSA Cybersecurity Collaboration Center and partner agencies. Read the full advisory here: media.defense.gov/2025/Aug/22/...
#GreyNoise #Cybersecurity #ThreatIntelligence
greynoise.io
30,000+ IPs hit Microsoft Remote Desktop on Aug 24, a significant escalation from our original reporting of nearly 2,000 IPs on August 21. Full analysis: www.greynoise.io/blog/surge-m...
#ThreatIntel #RDP #Cybersecurity #IncidentResponse #GreyNoise #SOC #VulnerabilityManagement #MicrosoftRDP
greynoise.io
On August 21, GreyNoise observed nearly 2,000 malicious IPs probing Microsoft Remote Desktop (RDP) services in a single day — a sharp deviation from baseline activity. Full blog: www.greynoise.io/blog/surge-m...

#ThreatIntel #RDP #Cybersecurity #GreyNoise #Analysis #RemoteDesktop
Nearly 2,000 Malicious IPs Probe Microsoft Remote Desktop in Single-Day Surge
On August 21, GreyNoise observed a sharp surge in scanning against Microsoft Remote Desktop (RDP) services.
www.greynoise.io