Now Available! GreyNoise Tactics: See What Adversaries Do After They’re Inside.
.png){kind=spacer}
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: September 14 – September 21, 2026
Adversaries escalated attempts against a Spring Cloud Function code execution flaw and an Elastic Kibana file inclusion flaw from single digits to several hundred daily sources on one day. Neither had come back down when collection closed. A Sophos Firewall authentication bypass this series recorded as subsided in April returned at roughly sixty times the prior period's daily rate. Requests built to confirm whether a blind injection executed ran every day.
Adversaries attempted CVE-2022-22963 in Spring Cloud Function and CVE-2018-17246 in the Elastic Kibana console on the same day. The Spring flaw is rated CVSS 9.8 and sits in CISA's Known Exploited Vulnerabilities catalog. Daily source counts on both had run in the single digits for the first six days of the period. Neither returned to that level afterward, and public exploit code exists for both.
This series tracked the spring campaign against the CVE-2022-1040 behavior and recorded it as subsided in April. Attempts came back at roughly sixty times the prior period's daily rate, and the flaw reaches code execution on the appliance that enforces the perimeter, with no credential. Patch verification is worth more here than volume alerting. GreyNoise recorded 67 malicious sources on the flaw in the final 24 hours.
A single address on a rented hosting range ran all three in the same hours. That is one tool doing all three in a single pass. That same host supplied most of the Docker Scanner activity GreyNoise observed. Corpus-wide, scanning of the manager interface outran the credential attack behavior by better than an order of magnitude. A detection keyed to failed logins therefore sees a sliver of the real pressure.
Operators send these to confirm that an injected payload executed where the response itself reveals nothing. The callback behavior registered between twenty-five and sixty-four unique sources every day, with no day at zero, against eleven to twenty a day six weeks ago. The detection that matters sits outbound, in whether a server inside the estate then resolved that name.
.png)
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: September 14 – September 21, 2026
Adversaries escalated attempts against a Spring Cloud Function code execution flaw and an Elastic Kibana file inclusion flaw from single digits to several hundred daily sources on one day. Neither had come back down when collection closed. A Sophos Firewall authentication bypass this series recorded as subsided in April returned at roughly sixty times the prior period's daily rate. Requests built to confirm whether a blind injection executed ran every day.
Adversaries attempted CVE-2022-22963 in Spring Cloud Function and CVE-2018-17246 in the Elastic Kibana console on the same day. The Spring flaw is rated CVSS 9.8 and sits in CISA's Known Exploited Vulnerabilities catalog. Daily source counts on both had run in the single digits for the first six days of the period. Neither returned to that level afterward, and public exploit code exists for both.
This series tracked the spring campaign against the CVE-2022-1040 behavior and recorded it as subsided in April. Attempts came back at roughly sixty times the prior period's daily rate, and the flaw reaches code execution on the appliance that enforces the perimeter, with no credential. Patch verification is worth more here than volume alerting. GreyNoise recorded 67 malicious sources on the flaw in the final 24 hours.
A single address on a rented hosting range ran all three in the same hours. That is one tool doing all three in a single pass. That same host supplied most of the Docker Scanner activity GreyNoise observed. Corpus-wide, scanning of the manager interface outran the credential attack behavior by better than an order of magnitude. A detection keyed to failed logins therefore sees a sliver of the real pressure.
Operators send these to confirm that an injected payload executed where the response itself reveals nothing. The callback behavior registered between twenty-five and sixty-four unique sources every day, with no day at zero, against eleven to twenty a day six weeks ago. The detection that matters sits outbound, in whether a server inside the estate then resolved that name.
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
