Do Son New Kapibala WordPress exploitation attacks steal records. GreyNoise warns that Kapibala WordPress exploitation hits governments.
GreyNoise
GreyNoise detects a coordinated surge in SonicWall reconnaissance. With over 84,000 scans, attackers are mapping VPNs for Akira and Fog ransomware strikes.
Critical React flaw CVE-2025-55182 (CVSS 10.0) under mass exploitation. Two IPs drive 56% of attacks deploying miners & shells. Upgrade to v19.0.1+ now.
GreyNoise reveals a massive Japan-based holiday campaign: 2.5 million attacks targeting 767 CVEs to harvest access for ransomware gangs.
GreyNoise detected a coordinated mass scanning campaign where 7,000+ IPs (from 3xK GmbH) probed Palo Alto GlobalProtect portals and SonicWall SonicOS API endpoints using identical client fingerprints.
GreyNoise tracked a coordinated cryptojacking blitz exploiting PHP RCE flaws (CVE-2024-4577, ThinkPHP) to deploy miners on cloud infrastructure. The spike is driven by high Bitcoin prices.
GreyNoise warns of a massive, synchronized RDP botnet using 100,000+ IPs from over 100 countries for RDP scanning and enumeration, with US infrastructure as the primary target.
GreyNoise observed a sudden, coordinated surge of 110 unique IPs exploiting the Grafana path traversal flaw (CVE-2021-43798), targeting only the US, Slovakia, and Taiwan.
A new GreyNoise report warns of two massive scanning spikes targeting Cisco ASA devices, raising concerns that attackers may be preparing to exploit a new vulnerability.
GreyNoise reports a massive, coordinated scanning campaign targeting Microsoft RDP services. Attackers are probing tens of thousands of IPs to prepare for future attacks.
Zyxel firewalls are under a coordinated attack exploiting critical RCE flaw CVE-2023-28771 (CVSS 9.8) via UDP port 500, likely by Mirai botnets. Patch immediately
GreyNoise reports a massive brute-force campaign targeting Apache Tomcat Manager interfaces, with hundreds of malicious IPs attempting to compromise services.
AyySSHush is a new stealthy botnet backdooring ASUS routers via SSH keys, abusing legitimate features to persist across firmware updates and targeting residential networks globally.
A stealthy campaign is persistently hacking ASUS routers via undocumented bypasses and CVE-2023-39780, building a backdoor network without malware.