Glenn
LightNews LightNews
banner
ntkramer.bsky.social
Glenn
@ntkramer.bsky.social
2.6K followers 260 following 140 posts
Experienced InfoSec | Elder Millennial | 💼 @GreyNoiseIO | I ask 'why?' a lot | Pro Oxford Comma | Fix it! | He/Him | #BLM | Views are my own.

https://linktr.ee/glennthorpe
Posts Replies Media Videos
ntkramer.bsky.social
☕ & #threatintel: CISA has moved the due date for mitigating CVE-2025-55182 (Meta React Server Components Remote Code Execution Vulnerability) up by two weeks. It was initially set for December 26, but it is now due on December 12.
1/2
December 10, 2025 at 2:04 PM
ntkramer.bsky.social
Ron & my talk from SuriCon 2025 | Abusing HTTP Quirks to Evade Detection
I think it turned out pretty well; pardon the disco effect where a stage light was failing :)

www.youtube.com/watc...

CC: @iagox86.bsky.social @greynoise.io
SuriCon 2025 | Abusing HTTP Quirks to Evade Detection
Presented at SuriCon 2025 by Ron Bowes and Glenn Thorpe Network protocols are messy! Sure, there are standards — RFCs, IEEEs, you name it — but there are also multiple ways to do basically everything. If you’re relying on network IDS/IPS tools like Suricata, I have bad news — a sufficiently cl
www.youtube.com
December 9, 2025 at 10:41 PM
ntkramer.bsky.social
I hate everything.

http://www.texastrib...
Noise from crypto mine pushes Texas neighbors to start a town
Leaders of the effort say they moved to rural Hood County for its quiet country charm, which was shattered by what locals call “that roar” from the facility.
www.texastribune.org
October 23, 2025 at 10:49 PM
ntkramer.bsky.social
Ron (@iagox86.bsky.social) and I are presenting at #Suricon (Montreal) next month! If you're around, you'll definitely want to find us for some sweet swag (oh, and our talk is pretty cool too!).

suricon.net/agenda-m...
Network protocols are messy! Sure, there are standards — RFCs, IEEEs, you name it — but there are also multiple ways to do basically everything. If you’re relying on network IDS/IPS tools like Suricata, I have bad news — a sufficiently clever attacker can bypass *a lot* of your signatures, leaving you completely blind. The cool part about HTTP is that, at every level of the stack, your software tries to make sense of the user’s (aka: the attacker’s) requests. From the web server (Apache, IIS, etc) to the language parser (PHP, .NET, etc) — everything just wants your requests to work, often at the expense of security! That’s great for ensuring the internet keeps working, but creates makes it *really* hard to write signatures! This talk will start with the basics: we’ll look at HTTP requests and learn the in-depth quirks of how the protocol works. Then we’ll look at a variety of different HTTP-based exploits (path traversal, SQL injection, shell command injection, and more!). We’ll exam
October 21, 2025 at 2:37 PM
ntkramer.bsky.social
It’s time for many folks’ annual cultural learning session. 🤣
October 3, 2025 at 12:22 PM
Reposted by Glenn
greynoise.io
On 28 September, GreyNoise observed a sharp one-day surge in attempts to exploit Grafana CVE-2021-43798. Full analysis & malicious IPs ⬇️
#Grafana #GreyNoise #ThreatIntel
Coordinated Grafana Exploitation Attempts on 28 September
GreyNoise observed a sharp one-day surge of exploitation attempts targeting CVE-2021-43798 — a Grafana path traversal vulnerability that enables arbitrary file reads. All observed IPs are classified a...
www.greynoise.io
October 2, 2025 at 9:32 PM
ntkramer.bsky.social
We all know that @hrbrmstr.dev is a mad scientist, and when you give him the amazing telemetry our new fleet has been collecting lately, you get knowledge drops like this! Super proud of our @greynoise.io team’s work on the deception capabilities we now have! hashtag#threatintel
greynoise.io GreyNoise @greynoise.io · Jul 31
🚨 New Research: GreyNoise identifies an early warning signal, spikes in attacker activity tend to precede new CVE disclosures within six weeks. Which vendors show the strongest signal and more, all in our latest report ⬇️
Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities
GreyNoise’s new research reveals a recurring pattern: spikes in malicious activity often precede the disclosure of new CVEs — especially in enterprise edge technologies like VPNs and firewalls.
www.greynoise.io
August 1, 2025 at 3:24 PM
Reposted by Glenn
greynoise.io
An unexpected cluster of malicious IPs in a remote U.S. town led GreyNoise researchers to uncover a 500+ device botnet. Full analysis ⬇️
#Cybersecurity #ThreatIntel #Botnet #VoIP #GreyNoise #Cyber #Tech
A Spike in the Desert: How GreyNoise Uncovered a Global Pattern of VOIP-Based Telnet Attacks
A spike in botnet traffic from a single utility in a rural part of New Mexico led to the discovery of a global botnet. Explore how human-led, AI-powered analysis exposed compromised devices, uncovered...
www.greynoise.io
July 24, 2025 at 1:05 PM
ntkramer.bsky.social
🫖 & #threatintel - noticing a few other spikes orgs should be mindful of:
🔥 CVE-2025-49132 (Pterodactyl Panel RCE) (10/10 RCE)
⚡ CVE-2024-20439 (Cisco Smart Licensing Utility) (9.8/10, KEV)
📝 CVE-2017-18370 (Zyxel P660HN)
1/4
July 16, 2025 at 9:45 PM
ntkramer.bsky.social
🩸& #threatintel | We (GreyNoise) just published a quick note (www.greynoise.io/blo...) regarding CVE-2025-5777 - CitrixBleed 2
1/2
Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public
GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.
www.greynoise.io
July 16, 2025 at 9:05 PM
ntkramer.bsky.social
🥜 & #threatintel - Thanks to @horizon3ai.bsky.social, we pushed a tag out today for CitrixBleed 2 CVE-2025-5777 and are backfilling. Currently, we see 233 hits starting on July 1 from:
64.176.50[.]109
38.154.237[.]100
102.129.235[.]108
121.237.80[.]241
45.135.232[.]2
Follow along...

1/2
July 7, 2025 at 9:56 PM
ntkramer.bsky.social
Just a totally normal trip home from the airport last night… passing the national guard rolling down the highway as they prepare for NO KINGS DAY protests. F this administration. About 3 more months before they start trying to censor social media via tech controls.

June 12, 2025 at 2:37 PM
ntkramer.bsky.social
Seems like a lot of work when you could have found 200 year old brain proteins in the US Congress rn.

phys.org/news/2025-0...
Paleoproteomic profiling recovers diverse proteins from 200-year-old human brains
A new method developed by researchers at the Nuffield Department of Medicine, University of Oxford, could soon unlock the vast repository of biological information held in the proteins of ancient soft ...
phys.org
May 29, 2025 at 11:45 AM
ntkramer.bsky.social
It's hard to beat good deception. :)
May 28, 2025 at 3:38 PM
ntkramer.bsky.social
If you're ever feeling lonely, just close Zoom.
This works because a funny thing always happens: a random last-minute Zoom will appear if you close it completely.
May 27, 2025 at 9:21 PM
ntkramer.bsky.social
🥤& #threat-intel: CISA added Langflow Code Injection CVE-2025-3248 to the KEV on May 5. Recently, it has garnered considerable attention, with South Korea leading the pack. This vuln enables unauthenticated attackers to execute arbitrary code via /api/v1/validate/code

viz.greynoise.io/tag...
May 15, 2025 at 10:06 PM
ntkramer.bsky.social
This change legitimately pisses me off.

TL;DR—They appear to be removing RSS for KEV alerts and moving them to email or X.
They gave orgs 0 days to prepare. RSS is already a thing. The emails arrive many hours later. X is NOT a gov website(!); it even warns you when you click their link!
1/2
May 12, 2025 at 9:04 PM
ntkramer.bsky.social
Join us live! Or later? Looking forward to chatting with Tracy!
April 15, 2025 at 1:37 PM
ntkramer.bsky.social
Hi yes. Help your local cybersecurity researchers. If you blog a thing, please date the blog. kthx.
April 7, 2025 at 3:26 PM
Reposted by Glenn
greynoise.io
🚨 New GreyNoise Tag Alert: We've added a fresh tag tracking CrushFTP Authentication Bypass (CVE-2025-2825) exploitation attempts. Thanks to @horizon3ai.bsky.social for the intel! Dive into the details: viz.greynoise.io/tags/crushft...
March 27, 2025 at 9:31 PM
ntkramer.bsky.social
Today is Opening Day for baseball season in the US. At least now I have my fav sport to put on when I want to watch something but avoid TV news.
March 27, 2025 at 11:30 AM
ntkramer.bsky.social
Dammit
supriyam.bsky.social Supriya @supriyam.bsky.social · Mar 26
if you’re reading this, relax your jaw
March 27, 2025 at 2:40 AM
Reposted by Glenn
greynoise.io
Headed to RSAC next month? 👀 NoiseFest will be just a few blocks away...no nonsense (well maybe a little 😈), just drinks, good people, and real security talk.

House of Shields | April 30 | 7–10PM

Spots are limited. RSVP now.
info.greynoise.io/events/noise...
GreyNoise - NoiseFest at RSAC 2025
Join us for NoiseFest at RSAC 2025 on April 30th, At the House of Shields. Enjoy drinks, snacks, and engaging conversations with your peers. RSVP now!
info.greynoise.io
March 26, 2025 at 7:08 PM
ntkramer.bsky.social
Absolutely disgusting. The Trump admin (DHS) has repurposed opt-in email signups to spread their propaganda.

Years ago (4+) I signed up for Homeland Security emails; I don't recall doing this but based on the ones in my email it was related to something cyber -- not surprising.
1/4
March 21, 2025 at 8:04 PM
ntkramer.bsky.social
Happy ~Fat~ Tariff Tuesday to all that celebrate stupidity.
March 4, 2025 at 1:33 PM