GreyNoise Launches Block: Fully configurable, real-time blocklists
.png){kind=spacer}
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: February 9-16, 2026
Three attack surfaces accelerated simultaneously: IoT botnet recruitment surged up to 91%, Fortinet VPN brute-forcing nearly doubled, and credential harvesting more than doubled to 8.28 million sessions. Meanwhile, a coordinated Iranian scanner cluster deployed custom tooling unknown to any public database, and an 84-day C2 operation was uncovered hiding behind cryptocurrency exchange API traffic.
Five IoT-related tag categories surged 53–91% WoW — Telnet Protocol, IoT Default Password, and ADB Check all rose in lockstep, consistent with centralized botnet orchestration.
Fortinet SSL VPN brute-forcing nearly doubled. A brand-new SonicWall scanning campaign emerged from zero to 199,743 sessions. Cisco and Palo Alto pressure steady.
ENV Crawler surged 112% to 4.29 million sessions. WordPress Enumeration up 273%. AWS credentials, Git repos, and Spring Boot actuators all targeted.
A Japanese-hosted server impersonated BitMart, KuCoin, and Bitget APIs across four parallel channels — sending identical static trading payloads to disguise C2 callbacks as legitimate financial API traffic.
.png)
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: February 9-16, 2026
Three attack surfaces accelerated simultaneously: IoT botnet recruitment surged up to 91%, Fortinet VPN brute-forcing nearly doubled, and credential harvesting more than doubled to 8.28 million sessions. Meanwhile, a coordinated Iranian scanner cluster deployed custom tooling unknown to any public database, and an 84-day C2 operation was uncovered hiding behind cryptocurrency exchange API traffic.
Five IoT-related tag categories surged 53–91% WoW — Telnet Protocol, IoT Default Password, and ADB Check all rose in lockstep, consistent with centralized botnet orchestration.
Fortinet SSL VPN brute-forcing nearly doubled. A brand-new SonicWall scanning campaign emerged from zero to 199,743 sessions. Cisco and Palo Alto pressure steady.
ENV Crawler surged 112% to 4.29 million sessions. WordPress Enumeration up 273%. AWS credentials, Git repos, and Spring Boot actuators all targeted.
A Japanese-hosted server impersonated BitMart, KuCoin, and Bitget APIs across four parallel channels — sending identical static trading payloads to disguise C2 callbacks as legitimate financial API traffic.
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
