GreyNoise Launches Block: Fully configurable, real-time blocklists
Happy New Year! After a refreshing holiday break, we’re back at it (and some of us even remember how to do our jobs). 2025 was big for GreyNoise: faster actor clustering and enrichment, the release of GreyNoise Block, broader sensor coverage, and research on all the latest vulns. Here’s what went down in December + what to look out for this month.
VP of Data Science + Research, Bob Rudis, creatively gives his thoughts, hot-takes, and whatever else he feels like.
The React2Shell campaign remains highly active, with 8.1M+ attack sessions observed since disclosure and daily activity steady at 300K–400K. GreyNoise now tracks 8,163 source IPs across 1,071 ASNs in 101 countries, with cloud providers, especially AWS, dominating exploitation traffic. Ongoing attacker iteration is evident in 70K+ unique payloads and hundreds of distinct JA4H/JA4T fingerprints. Given the scale and diversity of infrastructure, static IP blocklists are insufficient; defenders should rely on GreyNoise Block and continuously updated threat intelligence, and treat this as an ongoing, active campaign.
We’re looking for Active Development Partners who would like to engage in security research by applying Suricata Rules and network packet queries to the GreyNoise historical dataset. If you're interested, please email product@greynoise.io.
.png)
*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>
Happy New Year! After a refreshing holiday break, we’re back at it (and some of us even remember how to do our jobs). 2025 was big for GreyNoise: faster actor clustering and enrichment, the release of GreyNoise Block, broader sensor coverage, and research on all the latest vulns. Here’s what went down in December + what to look out for this month.
VP of Data Science + Research, Bob Rudis, creatively gives his thoughts, hot-takes, and whatever else he feels like.
The React2Shell campaign remains highly active, with 8.1M+ attack sessions observed since disclosure and daily activity steady at 300K–400K. GreyNoise now tracks 8,163 source IPs across 1,071 ASNs in 101 countries, with cloud providers, especially AWS, dominating exploitation traffic. Ongoing attacker iteration is evident in 70K+ unique payloads and hundreds of distinct JA4H/JA4T fingerprints. Given the scale and diversity of infrastructure, static IP blocklists are insufficient; defenders should rely on GreyNoise Block and continuously updated threat intelligence, and treat this as an ongoing, active campaign.
We’re looking for Active Development Partners who would like to engage in security research by applying Suricata Rules and network packet queries to the GreyNoise historical dataset. If you're interested, please email product@greynoise.io.
*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>
