Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
Bucklog’s Machine: Inside a Kubernetes Scanning Fleet
Threat Actors
Malware Families
Excerpt
Most scanning infrastructure is boring. A VPS, a cron job, maybe a cheap proxy rotation service if the operator has ambitions. What we’re looking at with AS211590 (Bucklog SARL / FBW Networks SAS) is something else entirely – a purpose-built, Kubernetes-orchestrated scanning cluster running from a single /24 in Paris that generated 13 million sessions over 90 days and barely registered the load. This is the walkthrough. We’ll cover how the fleet is built, what it’s doing, and…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2020-5284 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-21858 | Medium | Score 61/100 | First seen |
| CVE | CVE-2024-44000 | Medium | Score 51/100 | First seen |
| MD5 | 425d29fe50d8e4f5e37efb6e24bcf660 | Medium | Score 53/100 | First seen |
| CVE | CVE-2024-29291 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-68613 | High | Score 63/100 | First seen |
| CVE | CVE-2025-2264 | Medium | Score 51/100 | First seen |
| CVE | CVE-2017-9841 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-48927 | Medium | Score 54/100 | First seen |
IOC Relationship Graph
Building graph…