New! Attacker Exploited Citrix Zero-Day Three Days Before the CVE Existed
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: October 5 – 13, 2026
A recurring pool of malicious IPs checked Exchange servers for ProxyNotShell in passes no more than 48 hours apart. Attempts on a known exploited Metabase flaw stepped up more than threefold. Gateway backdoor attempts widened sharply.
About a thousand malicious IPs ran the Exchange ProxyNotShell check on every odd-numbered day from 05 to 13 October, against no more than 24 on even days. IPs from the same pool returned from pass to pass.
Attempts against CVE-2026-72898, an unauthenticated Metabase flaw rated CVSS 10, rose more than threefold from 11 October. Every IP was malicious. Each Metabase instance stores credentials for the databases it queries.
The number of IPs trying factory accounts on Dasan and D-Link gateways grew about 22 times in four days. Over ten days, GreyNoise tagged 1,598 IPs with the Dasan backdoor behavior, all malicious.
RDP Crawler activity rose 74%, and a single host not named in prior briefs sent 36% of it. That activity is likely to fall when the host goes quiet.
.png)
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: October 5 – 13, 2026
A recurring pool of malicious IPs checked Exchange servers for ProxyNotShell in passes no more than 48 hours apart. Attempts on a known exploited Metabase flaw stepped up more than threefold. Gateway backdoor attempts widened sharply.
About a thousand malicious IPs ran the Exchange ProxyNotShell check on every odd-numbered day from 05 to 13 October, against no more than 24 on even days. IPs from the same pool returned from pass to pass.
Attempts against CVE-2026-72898, an unauthenticated Metabase flaw rated CVSS 10, rose more than threefold from 11 October. Every IP was malicious. Each Metabase instance stores credentials for the databases it queries.
The number of IPs trying factory accounts on Dasan and D-Link gateways grew about 22 times in four days. Over ten days, GreyNoise tagged 1,598 IPs with the Dasan backdoor behavior, all malicious.
RDP Crawler activity rose 74%, and a single host not named in prior briefs sent 36% of it. That activity is likely to fall when the host goes quiet.
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
