Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE9 IOCs
Bucklog’s Machine: Inside a Kubernetes Scanning Fleet
Threat Actors
Malware Families
Diamond Model
Adversary(1)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Indicators of Compromise9
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2020-5284 exfiltrationexploitintel-blog | Medium | 51 | Oct 9, 26 |
| CVE | CVE-2026-21858 exploitintel-blogmalware | Medium | 61 | Jul 11, 26 |
| CVE | CVE-2024-44000 exfiltrationexploitintel-blog | Medium | 51 | Oct 9, 26 |
| MD5 | 425d29fe50d8e4f5e37efb6e24bcf660 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2024-29291 exfiltrationexploitintel-blog | Medium | 51 | Oct 9, 26 |
| CVE | CVE-2025-68613 aptc2espionage | Medium | 59 | Jun 3, 26 |
| CVE | CVE-2025-2264 exfiltrationexploitintel-blog | Medium | 51 | Oct 9, 26 |
| CVE | CVE-2017-9841 exfiltrationexploitintel-blog | Medium | 51 | Oct 9, 26 |
| CVE | CVE-2025-48927 exploitintel-blogmalware | Medium | 54 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph9 total IOCs
CVEMD5