NoiseLetter May 2025

Summary

This month was wild, our sensors picked up major threats, including a stealthy backdoor campaign targeting ASUS routers and a coordinated scan blitz hitting 75 exposure points in a single day. While part of the GreyNoise Labs team gathered offsite, the rest stayed locked in to catch it all. Get the full breakdown in this month’s NoiseLetter.

Bob Unfiltered

VP of Data Science + Research, Bob Rudis, creatively gives his thoughts, hot-takes, and whatever else he feels like.

Featured

Join GreyNoise Founder & Chief Architect Andrew Morris and VP of Data Science Bob Rudis on June 3rd as they unpack critical findings from our 2025 report, A Blindspot in Cyber Defense: How Resurgent Vulnerabilities Jeopardize Organizational Security.

>> Register Today! 

GreyNoise uncovers a stealthy backdoor campaign affecting thousands of ASUS routers. Attackers gained persistent access — surviving reboots and firmware updates — by abusing legitimate configuration features.First observed March 18, 2025.

>>Read the Full Analysis 

Product Announcements

New Experiment:  WatchGOG!

A peek behind the curtain at more detailed statistics from the Global Observation Grid.
>> Check it out

JA4 now available for Threat Hunt customers

JA4 has been a top request from our community as it helps correlate scanning and exploitation activity across IPs with similar TLS behavior.  We're pleased to add it to our Threat Hunt data module.

SSO for Enterprise Customers

We've added the ability to support multiple SSO providers for customers interested in stronger authentication for their GreyNoise accounts. If you would like to set up SSO for your account please reach out to your Customer Success Manager for assistance.

Make our product team the happiest team in the world by sharing your honest feedback! 
  • We're excited to announce our new gift card campaign on Gartner Peer Insights! Share your honest review of GreyNoise and receive a $25 gift card.
  • Or go big and grab a $50 VISA gift card by sharing your thoughts on G2!
  • BUT WAIT — there’s a slight catch...! To score the goods, your review needs to be posted + approved, and they can be kinda particular, so be sure to check out this quick doc with tips to make sure your work gets posted.Thanks for helping us spread the word and showing us love, we seriously appreciate you.

Where to find us

  • GreyNoise University LIVE (Virtual | May 29, TODAY!) GreyNoise 101, now known as GreyNoise Univeristy LIVE is BACK! We are stoked to bring back this once-a-month webinar.  
  • Resurgent Vulnerabilities Webinar (Webinar | June 3) Join GreyNoise Founder & Chief Architect Andrew Morris and VP of Data Science Bob Rudis as they break down key insights from our latest 2025 report, A Blindspot in Cyber Defense: How Resurgent Vulnerabilities Jeopardize Organizational Security. 

Fresh Content

Recent Tags and Vulnerabilities

GreyNoise Labs released 34 tags during the month of April:

Community

  • Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
  • Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
  • Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 

Meme of the Month

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

Life @ GreyNoise

GN Labs team at latest offsite, Ahoy!

Not subscribed to our NoiseLetter? Subscribe here.

This month was wild, our sensors picked up major threats, including a stealthy backdoor campaign targeting ASUS routers and a coordinated scan blitz hitting 75 exposure points in a single day. While part of the GreyNoise Labs team gathered offsite, the rest stayed locked in to catch it all. Get the full breakdown in this month’s NoiseLetter.

Bob Unfiltered

VP of Data Science + Research, Bob Rudis, creatively gives his thoughts, hot-takes, and whatever else he feels like.

Featured

Join GreyNoise Founder & Chief Architect Andrew Morris and VP of Data Science Bob Rudis on June 3rd as they unpack critical findings from our 2025 report, A Blindspot in Cyber Defense: How Resurgent Vulnerabilities Jeopardize Organizational Security.

>> Register Today! 

GreyNoise uncovers a stealthy backdoor campaign affecting thousands of ASUS routers. Attackers gained persistent access — surviving reboots and firmware updates — by abusing legitimate configuration features.First observed March 18, 2025.

>>Read the Full Analysis 

Product Announcements

New Experiment:  WatchGOG!

A peek behind the curtain at more detailed statistics from the Global Observation Grid.
>> Check it out

JA4 now available for Threat Hunt customers

JA4 has been a top request from our community as it helps correlate scanning and exploitation activity across IPs with similar TLS behavior.  We're pleased to add it to our Threat Hunt data module.

SSO for Enterprise Customers

We've added the ability to support multiple SSO providers for customers interested in stronger authentication for their GreyNoise accounts. If you would like to set up SSO for your account please reach out to your Customer Success Manager for assistance.

Make our product team the happiest team in the world by sharing your honest feedback! 
  • We're excited to announce our new gift card campaign on Gartner Peer Insights! Share your honest review of GreyNoise and receive a $25 gift card.
  • Or go big and grab a $50 VISA gift card by sharing your thoughts on G2!
  • BUT WAIT — there’s a slight catch...! To score the goods, your review needs to be posted + approved, and they can be kinda particular, so be sure to check out this quick doc with tips to make sure your work gets posted.Thanks for helping us spread the word and showing us love, we seriously appreciate you.

Where to find us

  • GreyNoise University LIVE (Virtual | May 29, TODAY!) GreyNoise 101, now known as GreyNoise Univeristy LIVE is BACK! We are stoked to bring back this once-a-month webinar.  
  • Resurgent Vulnerabilities Webinar (Webinar | June 3) Join GreyNoise Founder & Chief Architect Andrew Morris and VP of Data Science Bob Rudis as they break down key insights from our latest 2025 report, A Blindspot in Cyber Defense: How Resurgent Vulnerabilities Jeopardize Organizational Security. 

Fresh Content

Recent Tags and Vulnerabilities

GreyNoise Labs released 34 tags during the month of April:

Community

  • Request a New GreyNoise Tag - We've just published a new page to allow our amazing community to submit tag requests to the GreyNoise team. 
  • Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
  • Join our Community Slack and Discord- We share intel, give real time updates, and the occasional Dad joke. 

Meme of the Month

*Have a joke you want included in the next NoiseLetter? Submit Your Joke >>

Life @ GreyNoise

GN Labs team at latest offsite, Ahoy!

Not subscribed to our NoiseLetter? Subscribe here.

Read the transcript