GreyNoise Detects Coordinated Surge Exploiting Grafana Path Traversal Flaw (CVE-2021-43798)

GreyNoise detected a sudden, highly coordinated surge of exploitation attempts against Grafana CVE-2021-43798, a path traversal flaw that allows arbitrary file reads. The activity, captured by GreyNoise’s Global Observation Grid (GOG), involved 110 unique malicious IPs in a single day. According to GreyNoise, on 28 September activity spiked sharply, with 110 unique IPs observed in one day, and the attempts targeted endpoints in the United States, Slovakia and Taiwan.

Bangladesh accounted for 107 of the malicious IPs, with 105 focusing almost exclusively on U.S. endpoints; China contributed two IPs and Germany one. The traffic showed a 3:1:1 targeting ratio (U.S.: Slovakia: Taiwan), a pattern that held when isolating activity by source country, suggesting shared tasking or a common target list.

Two China-based IPs, 60.186.152[.]35 and 122.231.163[.]197, linked to CHINANET-BACKBONE, were first observed on 28 September and were active only that day, predominantly focused on Grafana.