GreyNoise Discovers Surge in Attacker Activity Before Vulnerability Disclosures

Post Views: 1

Network Device Vulnerability Disclosures: A Proactive Approach

Major network device vulnerability disclosures are often preceded by surges in attacker activity targeting the same vendor, allowing defenders to take proactive measures to mitigate potential threats.

Surge Analysis and Mitigation Strategies

Surge Characteristics: The research identified that approximately half of all activity spikes preceded a Common Vulnerabilities and Exposures (CVE) disclosure within three weeks – 36% more than would normally occur by chance.
Media Lead Time: The average media lead time, defined as the time between the last known activity surge and the subsequent CVE disclosure, was 11 days.
Activity Types: Scanning accounted for 42 of the 104 observed activity spikes, followed by brute forcing (18 surges), and remote code execution (RCE) attempts (12 surges).

According to GreyNoise, the compressed escalation pattern, characterized by a series of increasingly intense activity surges culminating in a final spike before disclosure, was observed in major vendors, including Ivanti, HPE/Dell, MikroTik, TP-Link, Fortinet, and D-Link/DrayTek.

Defender Response Strategies

Patch Staging: Defenders can restrict access to targeted interfaces, stage patches, and enhance monitoring priorities to address vulnerabilities proactively.
Sustained Surges: Sustained surges over eight or more days may indicate a potential incident requiring investigation.
Vigilance: Staying vigilant and prepared is key to mitigating the risks associated with network device vulnerabilities.

The findings provided by GreyNoise can help organizations improve their response times and prepare for potential zero-day revelations by paying attention to surges in scanning or exploitation activity targeting their network devices.