Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Vive La Vulnérabilité: French Kubernetes Cluster Hunts Your Webhook Endpoints
Excerpt
Most webhook scanning campaigns run from throwaway VPS instances. This one came from a full Kubernetes cluster with Envoy service mesh. Censys data showed consistent infrastructure across all source IPs—container orchestration, not opportunistic scanning. Between January 27 and February 3, 2026, the GreyNoise Global Observation Grid tracked 33,270 HTTP requests targeting webhook endpoints. The traffic originated almost entirely from AS211590 (Bucklog SARL), a French hosting…
Read the original report →Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-21858 | Medium | Score 61/100 | First seen |
IOC Relationship Graph
Building graph…