Andrew Morris

posting my ass off on linkedin is sick but there's like mad gay dudes coming out woodwork. sick but, you know, dawg

We had the good fortune of having @andrewmorr.is in the SOC for most of the day learning up the kids!

I am absolutely POSTING on linkedin now btw. It's like bluesky but nobody is funny and I can write like five million characters per post.

React bug (CVE-2025-55182) just keeps buggin

We're aware of the regrettably easy-to-exploit telnetd auth bypass and are preparing a tag for it in @greynoise.io

wiring my house up with fiber and I'm insanely humbled by my complete lack of even the most basic concepts. LC??? OM3???? multi mode???

asked claude to fix a VM that doesn't have internet or network access and its screenshotting and reading the terminal and using qm sendkeys to the proxmox host via SSH to fix it. that goes kinda hard.

waking up at 4am and hitting Bitchat #dj (all of america) with a "gm" text. three users active. no response.

gm. open face sausage egg and cheese sandwich on brioche

All internet traffic from Iran ceased in @greynoise.io one hour ago. Tier 1 dropped off two hours ago.

am I gonna get in trouble for shoplifting spotify

unbelieveable

www.labs.greynoise.io/grimoire/202...

between the ~1,400 networks we've seen exploiting React2Shell (CVE-2025-55182) we've captured about 100 different distinct malware payloads. Lots of vibe coded slop, coin miners, chinese comments, mirai variants, etc. hit us up if you're tracking this and want deets research@greynoise.io

TL;DR a couple hundred IPs suddenly started exploiting Cisco devices today - Entire exploitation cluster is originating from OVH (@ovhcloudus.bsky.social). - Payloads are interesting- attacker is even checking hardware temperatures most likely to ensure they are not honeypots

Also please be aware if your org runs a lot of Cisco gear we're seeing a very large spike in exploitation against Cisco devices right now.

my step brother calls gemini "jimmy"

The @hrbrmstr.dev himself has an entire web page of these stats he's keeping up to date if you want to keep an eye on them btw: rud.is/r2s/r2s.html

React2Shell exploitation frequency in GreyNoise dec 5-dec 6

Remember folks- it's only a crypto miner until it isn't

one thing about me is that I love windows. the building fixture. not the operating system.

Shamlessly reposting from elsewhere- you can easily communicate between Linux VMs and guests using VSOCK (man7.org/linux/man-pa...). Here's some silly examples of bidirectional chat btwn host & guest using Socat. Or connecting via SSH to my home router from the VM without TCP/IP. No code required.

on the surface this appears to be a massive credential stuffing campaign against Palo Alto's. please audit your successful logins and enable MFA. good catch @remyhax.bsky.social www.greynoise.io/blog/palo-al...

People always make fun of me for being polite to LLMs and I like to joke that I want to be on the good side of the robots when they take over the world. But really it just feels like a nasty habit to reinforce being an asshole on the computer. Unless we're playing Modern Warfare and you're 12.

POV you're my new 42U server rack in the garage and I just turned the lights off and saw your lights blinking in the dark for the first time

did you know you can quickly figure out if an ethernet port/cable supports PoE by putting it on your lips and feeling whether it electrocutes you or not

We've hired Colonel Shawn Smagh to up our @greynoise.io intel reporting game and we've started producing weekly intelligence briefs. This week's is a banger.

Happy Halloween from your fave GreyNerds 🍬🍫

Annual candy bracket is done. I'm gonna need some time to reflect.

we did a pew pew map btw threat-map.greynoise.io

I've just received word that we're preparing for this years annual @greynoise.io halloween candy bracket. Twix won years 1-2. 100 Grand won last year on a complete fluke. I might write a blog post about how last year's candy bracket undermined my faith in the democratic process.

excuse me for talking to you like a human ass being

when it comes to a head it will have been obvious in hindsight

big week in the morris household. we've started tracking ORBs at @greynoise.io and I'm shitposting again btw (h/t @hrbrmstr.dev)

Played Broken Arrow last night on Steam and its sick

full moon AND full lunar eclipse tomorrow btw

doing some ground floor reporting (celebrating my uncles 80th birthday)

just accidentally spilled some water on my shorts which dried instantly. This is how I realized I've been wearing a swimsuit as shorts.

psychic.labs.greynoise.io - Offline, in-memory bitmaps of GreyNoise data. Available now.