Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE9 IOCs
GreyNoise Labs Weekly OAST (Well-known Out-of-band Interaction Domains) Report • Week Ending 2026-02-20
Malware Families
Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Indicators of Compromise9
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2021-26855 anonymizationaptespionage | Medium | 59 | Jun 25, 26 |
| CVE | CVE-2026-23760 exploitintel-blogmalware | Medium | 57 | Jun 2, 26 |
| CVE | CVE-2021-44228 aptespionageexfiltration | High | 80 | Jun 5, 26 |
| CVE | CVE-2026-0770 exploitintel-blogmalware | Medium | 59 | Jun 11, 26 |
| CVE | CVE-2025-4123 exploitintel-blogmalware | Medium | 54 | Oct 9, 26 |
| CVE | CVE-2026-1281 exploitintel-blogmalware | High | 63 | Jun 3, 26 |
| CVE | CVE-2026-1731 exploitintel-blogmalware | High | 63 | Jun 2, 26 |
| CVE | CVE-2025-61882 exploitintel-blogmalware | High | 59 | Oct 9, 26 |
| CVE | CVE-2025-2775 exploitintel-blogmalware | Medium | 54 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph9 total IOCs
CVE