Threat Intel
GreyNoise Launches Project Swarm to Open Deception Network for Edge Defense
GreyNoise has introduced Project Swarm, a collaborative research initiative that opens its proprietary deception platform to the global security community. Designed to counter advanced threat actors targeting network perimeters, the project aims to improve visibility into blind spots across edge devices like firewalls and VPN gateways.
What Happened
GreyNoise has launched Project Swarm, transitioning its deception network from a proprietary sensor array into a collective intelligence platform. Operating via a Global Observation Grid comprising over 5,000 sensors across 80 countries, the platform processes more than 500 million sessions daily to detect internet-scale attack traffic, reconnaissance, and scanning waves.
The Edge Visibility Gap
Sophisticated threat groups—such as state-sponsored actors and well-funded ransomware syndicates—increasingly target network perimeters because edge devices lack traditional endpoint detection and response (EDR) agents. Attackers focus on firewalls, VPN gateways, routers, and load balancers to secure initial access, utilizing built-in tools for persistence while avoiding standard telemetry collection.
What Defenders Should Do
SecOps teams and system administrators managing perimeter infrastructure should incorporate collaborative threat intelligence sources to detect targeted probes against edge devices. Recommendations include:
- Review logging configurations on all VPN gateways, firewalls, and edge routing equipment.
- Monitor for anomalous administrative logins and unexpected outbound traffic from perimeter devices.
- Leverage community-driven intelligence feeds to identify stealthy reconnaissance and residential proxy traffic targeting network boundaries.
Related articles
GreyNoise Launches Threat Brief Library in Visualizer for Real‑Time Threat Insights
GreyNoise has added a Threat Brief Library to its Visualizer, giving users ready access to weekly At The Edge briefs, Executive Situation Reports, and public At The Edge Clear editions. The library lets defenders search, filter, and download PDFs built from primary sensor data, enabling faster analysis and response. Security teams should explore the library, integrate IOCs into blocklists, and use the recommended actions to harden defenses.
Read briefing
Proxyjacking Campaign Hijacks Edge Devices to Serve Residential Proxies – 143 Devices in 34 Countries
A proxyjacking operation was uncovered by GreyNoise during a live demo, affecting 143 edge devices across 34 countries. The attackers used compromised devices to route traffic through residential IPs, masking malicious activity. Defenders should audit edge device integrity, block identified malicious IPs, and monitor Entra ID sign‑in logs for anomalous residential sources.
Read briefing
CrowdStrike Launches SafeMind: A Closed‑Loop Offense‑Defense System for SecOps
CrowdStrike has introduced SafeMind, a closed‑loop platform that blends offensive testing with defensive analytics to create a continuously evolving threat model. The solution is built on the Falcon platform and is designed for SecOps teams looking to validate and harden their detection rules in real time. Defenders should integrate SafeMind into their existing workflows, review generated playbooks, and adjust response playbooks accordingly.
Read briefing
CrowdStrike Enhances Falcon with Real‑Time Supply‑Chain Defense
CrowdStrike has rolled out a new supply‑chain protection layer inside its Falcon endpoint sensor, blocking malicious open‑source packages as they download. The update expands Falcon’s threat‑intelligence reach, allowing defenders to stop supply‑chain attacks before code ever executes on the host. RootPwn breaks down how the feature works, its impact on the attack surface, and what it means for organizations still hunting for zero‑day supply‑chain exploits.
Read briefing