Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
GreyNoise Labs Weekly OAST (Well-known Out-of-band Interaction Domains) Report • Week Ending 2026-02-20
Malware Families
Excerpt
Overview Between February 14 and February 20, 2026, GreyNoise sensors recorded 5,695 OAST domain occurrences across 3,882 distinct sessions originating from 24 unique source IPs. All 5,695 rows decoded successfully (100% decode rate) using the Interactsh encoding scheme, yielding 33 distinct campaign identifiers and 5,560 unique callback domains. OAST domains appeared across multiple HTTP fields: request bodies (1,724 occurrences, 30.3%), request header values (1,389, 24.4%),…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2021-26855 | Medium | Score 59/100 | First seen |
| CVE | CVE-2026-23760 | Medium | Score 57/100 | First seen |
| CVE | CVE-2021-44228 | High | Score 80/100 | First seen |
| CVE | CVE-2026-0770 | Medium | Score 59/100 | First seen |
| CVE | CVE-2025-4123 | Medium | Score 54/100 | First seen |
| CVE | CVE-2026-1281 | High | Score 63/100 | First seen |
| CVE | CVE-2026-1731 | High | Score 66/100 | First seen |
| CVE | CVE-2025-61882 | High | Score 62/100 | First seen |
| CVE | CVE-2025-2775 | Medium | Score 54/100 | First seen |
IOC Relationship Graph
Building graph…