Storm Watch by GreyNoise Intelligence

In this episode of the Storm Watch podcast, the hosts discuss their recent vacations and the mandatory two-week shutdown at GreyNoise.

The conversation then shifts to the MOVEit software and its increasing number of CVEs. Kimber suggests that the surge in CVEs might be due to researchers taking a closer look at MOVEIt for the first time, as it is a critical software used in government entities. The hosts also discuss the possibility that similar software might become a focus for attackers in the coming months.

Next, the hosts talk about the lack of new tags due to their vacation and a recent bump in Mirai activity. They mention a double-encoded URL tag that has doubled the number of IP addresses, but they don't have any hypotheses about the reasons behind it. They also touch on the ability of GPT to create Python notebooks on the fly and the potential security risks associated with it.

Finally, the hosts discuss NoiseFest, an upcoming event celebrating all things GreyNoise. Kimber shares her excitement about the Capture the Flag (CTF) competition that will take place during the week of Black Hat and DEF CON.

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts discuss a variety of cybersecurity topics, starting with the discovery of an Android mobile botnet. They note that mobile traffic has been trending upward since the end of March, with a significant increase in April. The botnet is attributed to a banking Trojan, and the hosts emphasize the importance of keeping mobile devices updated and being cautious with app installations and link clicks.

The conversation then shifts to recent cyber incidents, including the VMware ARIA vulnerability and the Fortinet and Zyxel pre-auth injection vulnerabilities. The hosts stress the importance of staying on top of updates and considering additional security measures for these devices. They also mention the ongoing "MOVEit" campaign, which has impacted over 100 organizations and exposed over 5 million records.

Next, the hosts touch on the Apache Log4j vulnerability, noting a recent spike in activity that has since returned to its previous baseline. They also discuss an advisory on an ICS monitoring device with a hardcoded password vulnerability, emphasizing the potential high value for attackers targeting industrial control systems.

Finally, the hosts address a recent UPS data disclosure letter, which has been criticized for its lack of clarity. They emphasize the importance of transparency and straightforward communication when it comes to security incidents and data breach notifications.

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts discuss various cybersecurity topics, including a Fortinet vulnerability, a DDoS attack on Microsoft Outlook, the ongoing issues with Log4j, and the "MOVEit" vulnerability.

The hosts first talk about a new Fortinet vulnerability, expressing their snarky comments about the company's security issues. They then move on to discuss a recent DDoS attack on Microsoft Outlook, which caused significant downtime for users. The attack was attributed to Anonymous Sudan, a hacktivist group that uses open proxy services to launch their attacks. The hosts mention that with the current political climate and upcoming presidential election, more DDoS attacks can be expected.

Next, they discuss the "MOVEit" vulnerability, which has been exploited by attackers to target various organizations, including some governments. The hosts emphasize the importance of staying on top of security updates and patches to protect against such attacks. They also mention their community Slack channel, where they encourage users to share information on niche software and research partnerships.

Finally, the hosts touch on the resurgence of Log4j scans, suggesting that attackers may be targeting organizations that have restored backups or deployed old images without the necessary patches in place. They also mention a recent Verizon DBIR report that highlighted Log4j vulnerabilities, possibly contributing to the renewed interest in exploiting them. The hosts conclude by emphasizing the importance of staying vigilant and up-to-date with security measures to protect against these ongoing threats.

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts discuss a variety of cybersecurity topics, including a new CDE (202327997) related to a Fortinet RCE vulnerability in SSL VPNs. The vulnerability was discovered by a French research group and is currently being tracked. Fortinet has already issued patches, so the hosts advise upgrading Fortinet devices as soon as possible.

The hosts also discuss the recent issues with Barracuda appliances, advising users to consider replacing them due to security concerns. They mention that Barracuda devices may be falling out of fashion in favor of alternatives like Proofpoint.

Reddit's recent API changes and the potential impact on public internet communities are also discussed. The hosts express concern about the loss of open information sharing, especially in the cybersecurity industry, as private communities become more prevalent. They encourage listeners to join GreyNoise's community Slack for information sharing and collaboration.

Lastly, the hosts touch on new tags added to GreyNoise, including one related to an older internet scanner that has recently become open source. They also mention the Telerik platform, which has a history of vulnerabilities and is frequently targeted. The hosts emphasize the importance of staying vigilant and keeping an eye on emerging threats.

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, the hosts discuss the recent Moveit vulnerability and its impact on various organizations. Kimber, a GreyNoise product manager, shares her background and role at the company. She started on the research team, now known as GreyNoise Labs, and transitioned to product management, where she focuses on packaging GreyNoise data to help users in their environments.

The Moveit vulnerability, which allows for unauthorized access to the database, was first reported in an advisory from Progress, the software vendor. The Grey Noise community quickly raised awareness of the issue, and the company published a blog post with their findings. They discovered scanning activity related to the vulnerability dating back to March, suggesting that organizations should review their systems for signs of compromise since then. Some victims, such as British Airways and Boots, have already disclosed their involvement.

The hosts also discuss the collaboration and information sharing among the cybersecurity community in response to the Moveit vulnerability. They highlight the importance of sharing remediation information and the quick response from various groups, including state governments. The GreyNoise community and other information sharing groups have played a crucial role in disseminating information and helping organizations stay safe.

Finally, Kimber teases an upcoming feature for GreyNoise users: the Labs Beta API platform. This platform will allow users to query the GreyNoise Labs dataset, including command and control (C2) IP addresses, popular IP address queries, and HTTP requests. While the dataset provided will be less than 10% of the full data, it still offers a significant amount of information for users to explore. The feature is expected to be released within the next two weeks.

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm Watch, hosts Bob and Glenn discuss recent cybersecurity events and the ongoing activity of the Mirai botnet. They mention a significant spike in Mirai botnet activity starting around May 10th, which continued to increase throughout the following weeks. The hosts note that Mirai is one of the primary botnets on the internet, with thousands of IP addresses attempting to find new members daily.

The hosts also discuss the geographical distribution of Mirai-infected devices, which are spread across the globe, mostly in residential networks. They highlight that Amazon's network has compromised servers that are part of the Mirai botnet. The top 15 autonomous systems account for about 75% of the traffic observed during the spike in Mirai activity.

Remy, a researcher, analyzed the binaries of the Mirai botnet and found that it was targeting Tenda, NetLog, LB link, and Zyxel devices. The hosts mention that they have updated their coverage for these devices and will be monitoring the situation closely. They also briefly discuss the recent vulnerability in Barracuda ESG appliances, urging users to keep their devices updated.

Join GreyNoise Community Slack >>

Learn More About GreyNoise >>

In our 1st episode of Storm Watch, the hosts discuss GreyNoise, a cybersecurity company that operates a large honeypot network to collect data on unsolicited internet traffic. By analyzing this data, GreyNoise can identify attackers, network scanners, and other malicious activities, helping users prioritize and make actionable decisions based on the findings.

The hosts also talk about CISA KEV, a known exploited vulnerabilities list that helps organizations prioritize remediation and mitigation efforts. CISA KEV updates are not on a scheduled basis but are added as new information becomes available. GreyNoise partners with SysiCav to provide valuable data for the list. The hosts emphasize the importance of prioritizing older vulnerabilities, as some of the recent additions to CISA KEV date back to 2004.

For those new to GreyNoise, the hosts recommend starting with the visualizer at viz.greynoise.io. Users can explore trends, view tags, and see the most recent malicious IPs detected. The hosts emphasize that even a small number of malicious IPs can be significant, given that GreyNoise sensors are unsolicited and the IPs are actively seeking out these assets.

Join our Community Slack >>

Learn more about GreyNoise >>