Bulwark Black is a veteran-owned (SDVOSB) cyber threat intelligence and custom software studio. Daily CTI on threat actors, malware, and IOCs, plus custom web and iOS apps, AI setup, and small-business IT and cybersecurity, delivered remotely across the United States.https://bulwarkblack.com/https://bulwarkblack.com/ghost-phishing-browser-decryption-microsoft-365-defense/https://bulwarkblack.com/ghost-phishing-browser-decryption-microsoft-365-defense/Ghost phishing hides the real lure until the browser renders it. Here is what SMBs and government contractors should do to defend Microsoft 365 identities.Thu, 09 Jul 2026 20:03:04 GMTCyber Security Bloghttps://bulwarkblack.com/pakistani-law-enforcement-espionage-public-sector-data-defense/https://bulwarkblack.com/pakistani-law-enforcement-espionage-public-sector-data-defense/SentinelLabs reporting on rival espionage activity against Pakistani law enforcement is a reminder that public-sector portals, case systems, and citizen-data apps are strategic intelligence targets — even when they are not classified systems.Thu, 09 Jul 2026 15:04:16 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/bad-epoll-linux-kernel-cve-2026-46242-defense/https://bulwarkblack.com/bad-epoll-linux-kernel-cve-2026-46242-defense/Bad Epoll CVE-2026-46242 is a Linux kernel epoll race-condition LPE. Here is why SMBs and government contractors should prioritize kernel patching, developer endpoint hardening, and post-compromise controls.Thu, 09 Jul 2026 01:03:56 GMTCyber Security Bloghttps://bulwarkblack.com/fake-payment-sdk-npm-pypi-secret-theft-defense/https://bulwarkblack.com/fake-payment-sdk-npm-pypi-secret-theft-defense/Socket uncovered malicious npm and PyPI packages impersonating Paysafe, Skrill, and Neteller SDKs. Here is what SMBs and government contractors should do now to protect CI secrets, developer machines, and payment integrations.Wed, 08 Jul 2026 20:08:55 GMTCyber Security Bloghttps://bulwarkblack.com/ubiquiti-unifi-critical-flaws-network-control-plane-defense/https://bulwarkblack.com/ubiquiti-unifi-critical-flaws-network-control-plane-defense/Ubiquiti patched critical UniFi Connect, Talk, Access, Protect, and UniFi OS flaws. Here is what SMBs and government contractors should patch, restrict, and review now.Wed, 08 Jul 2026 15:05:03 GMTCyber Security Bloghttps://bulwarkblack.com/vidar-xmrig-malvertising-file-size-code-signing-defense/https://bulwarkblack.com/vidar-xmrig-malvertising-file-size-code-signing-defense/Unit 42 reported a Vidar stealer and XMRig campaign using malvertising, fake cracked-software lures, misleading certificate metadata, oversized binaries, and commodity loader infrastructure. Here is what SMBs and government contractors should take away.Wed, 08 Jul 2026 01:04:27 GMTCyber Security Bloghttps://bulwarkblack.com/adfs-machine-dpapi-golden-saml-federation-defense/https://bulwarkblack.com/adfs-machine-dpapi-golden-saml-federation-defense/Mandiant shows how ADFS certificate drift and Machine DPAPI can expose active signing keys. Here is what SMBs and government contractors should do now.Tue, 07 Jul 2026 20:07:20 GMTCyber Security Bloghttps://bulwarkblack.com/uat-7810-orb-relay-network-edge-device-defense/https://bulwarkblack.com/uat-7810-orb-relay-network-edge-device-defense/Cisco Talos reports UAT-7810 is expanding ORB relay infrastructure using compromised edge and embedded devices. Here is what SMBs and government contractors should do now.Tue, 07 Jul 2026 15:05:20 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/fortibleed-fortigate-credentials-ransomware-defense/https://bulwarkblack.com/fortibleed-fortigate-credentials-ransomware-defense/SOCRadar linked the FortiBleed FortiGate credential-harvesting campaign to INC and Lynx ransomware operations. Here is what SMBs and government contractors should do next.Fri, 03 Jul 2026 01:06:41 GMTCyber Security Bloghttps://bulwarkblack.com/netnut-popa-residential-proxy-botnet-defense/https://bulwarkblack.com/netnut-popa-residential-proxy-botnet-defense/The FBI and industry partners disrupted NetNut and the Popa botnet. Here is why residential proxy abuse matters for SMBs, government contractors, and defenders.Thu, 02 Jul 2026 20:24:31 GMTCyber Security Bloghttps://bulwarkblack.com/vect-teampcp-supply-chain-ransomware-credential-defense/https://bulwarkblack.com/vect-teampcp-supply-chain-ransomware-credential-defense/Sophos CTU reports that Vect and TeamPCP have linked ransomware deployment with supply-chain credential theft. Here is what SMBs and government contractors should harden now.Thu, 02 Jul 2026 15:06:34 GMTCyber Security Bloghttps://bulwarkblack.com/ousaban-banking-trojan-iberian-phishing-defense/https://bulwarkblack.com/ousaban-banking-trojan-iberian-phishing-defense/Ousaban’s Spain and Portugal campaign shows how banking trojans use geofencing, phishing PDFs, steganography, and daily-changing C2 to evade sandbox-heavy defenses.Thu, 02 Jul 2026 01:06:16 GMTCyber Security Bloghttps://bulwarkblack.com/nut-upsmon-cve-2026-54161-command-injection-defense/https://bulwarkblack.com/nut-upsmon-cve-2026-54161-command-injection-defense/CVE-2026-54161 in Network UPS Tools upsmon shows why UPS monitoring, notification scripts, and power-infrastructure control paths need patching, segmentation, and process monitoring.Wed, 01 Jul 2026 20:14:35 GMTCyber Security Bloghttps://bulwarkblack.com/artoken-eviltokens-microsoft-365-bec-token-defense/https://bulwarkblack.com/artoken-eviltokens-microsoft-365-bec-token-defense/Cisco Talos uncovered ARToken, an EvilTokens-linked phishing-as-a-service panel built around Microsoft 365 token theft, device-code phishing, mailbox access, SharePoint operations, and BEC automation. The practical lesson: treat identity tokens, inbox rules, and cloud collaboratiWed, 01 Jul 2026 15:04:19 GMTCyber Security Bloghttps://bulwarkblack.com/citrixbleed-netscaler-cve-2026-8451-saml-idp-defense/https://bulwarkblack.com/citrixbleed-netscaler-cve-2026-8451-saml-idp-defense/Citrix patched CVE-2026-8451, a NetScaler SAML IdP memory overread in the CitrixBleed family. Here is what SMBs and government contractors should do now.Wed, 01 Jul 2026 01:03:37 GMTCyber Security Bloghttps://bulwarkblack.com/simplehelp-cve-2026-48558-taskweaver-djinn-stealer-defense/https://bulwarkblack.com/simplehelp-cve-2026-48558-taskweaver-djinn-stealer-defense/Active exploitation of SimpleHelp CVE-2026-48558 shows why RMM platforms must be treated as privileged credential control planes, not routine support tools.Tue, 30 Jun 2026 20:03:54 GMTCyber Security Bloghttps://bulwarkblack.com/ios-ai-app-api-key-leak-api-gateway-defense/https://bulwarkblack.com/ios-ai-app-api-key-leak-api-gateway-defense/A study of iOS AI chatbot apps found widespread exposure of API keys, open AI proxy access, and replayable tokens. The fix is not another client-side secret workaround; it is real backend authentication, scoped tokens, monitoring, and key isolation.Tue, 30 Jun 2026 15:06:44 GMTAI (General)https://bulwarkblack.com/bing-seo-poisoning-bumblebee-adaptix-akira-ransomware/https://bulwarkblack.com/bing-seo-poisoning-bumblebee-adaptix-akira-ransomware/A DFIR Report case study shows how a fake ManageEngine OpManager download led from BumbleBee and AdaptixC2 to Akira ransomware. The defensive lesson: admin software downloads need control, verification, and monitoring.Tue, 30 Jun 2026 01:08:58 GMTCyber Security Bloghttps://bulwarkblack.com/water-systems-nation-state-ot-defense/https://bulwarkblack.com/water-systems-nation-state-ot-defense/Nation-state targeting of water systems shows why exposed OT, weak credentials, remote access, and poor IT/OT segmentation remain practical business risks—not just utility-sector problems.Mon, 29 Jun 2026 20:05:08 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/fluentd-vulnerabilities-log-pipeline-segmentation-defense/https://bulwarkblack.com/fluentd-vulnerabilities-log-pipeline-segmentation-defense/Multiple Fluentd vulnerabilities show why log collectors need segmentation, least privilege, and hostile-input assumptions—not just patching.Mon, 29 Jun 2026 15:05:17 GMTCyber Security Bloghttps://bulwarkblack.com/shai-hulud-cicd-cloud-identity-redshift-defense/https://bulwarkblack.com/shai-hulud-cicd-cloud-identity-redshift-defense/Fortinet’s Shai Hulud case study shows how poisoned CI/CD dependencies can become cloud identity compromise, IAM escalation, and Redshift data theft. Here is what SMBs and government contractors should harden now.Mon, 29 Jun 2026 01:03:44 GMTCyber Security Bloghttps://bulwarkblack.com/ai-coding-agent-clean-repo-runtime-payload-defense/https://bulwarkblack.com/ai-coding-agent-clean-repo-runtime-payload-defense/A clean-looking repository can still become dangerous when an AI coding agent follows setup instructions and executes runtime-fetched configuration. Here is how teams should defend developer workflows.Sat, 27 Jun 2026 15:10:35 GMTAI (General)https://bulwarkblack.com/splunk-enterprise-cve-2026-20253-siem-tier-zero-defense/https://bulwarkblack.com/splunk-enterprise-cve-2026-20253-siem-tier-zero-defense/CVE-2026-20253 shows why Splunk and other SIEM platforms need tier-zero hardening: patch quickly, restrict management access, review service accounts, and hunt for suspicious file writes.Sat, 27 Jun 2026 01:05:27 GMTCyber Security Bloghttps://bulwarkblack.com/naic-peoplesoft-zero-day-cve-2026-35273/https://bulwarkblack.com/naic-peoplesoft-zero-day-cve-2026-35273/NAIC’s PeopleSoft-linked breach is a practical warning for SMBs and government contractors: patch CVE-2026-35273, restrict administrative endpoints, and hunt for attacker staging before extortion begins.Fri, 26 Jun 2026 20:09:30 GMTCyber Security Bloghttps://bulwarkblack.com/hospitality-photo-zip-nodejs-implant-defense/https://bulwarkblack.com/hospitality-photo-zip-nodejs-implant-defense/Microsoft’s hospitality photo-ZIP campaign shows why front desk, booking, and customer intake workflows need executable-content controls, redirect-chain inspection, and endpoint hunting for unusual Node.js persistence.Fri, 26 Jun 2026 15:09:18 GMTCyber Security Bloghttps://bulwarkblack.com/cl-sta-1062-tinyrct-critical-infrastructure-web-shell-defense/https://bulwarkblack.com/cl-sta-1062-tinyrct-critical-infrastructure-web-shell-defense/Unit 42’s CL-STA-1062 report shows why defenders should focus on exposed web apps, web shells, tunneling tools, scheduled-task persistence, and egress visibility — not just the TinyRCT malware name.Fri, 26 Jun 2026 01:12:24 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/turla-stockstay-backdoor-egress-visibility/https://bulwarkblack.com/turla-stockstay-backdoor-egress-visibility/GTIG’s STOCKSTAY research shows how Turla blends modular .NET malware, WebSocket C2, and diplomatic targeting. Here are the defensive lessons for SMBs and government contractors.Thu, 25 Jun 2026 20:08:35 GMTCyber Security Bloghttps://bulwarkblack.com/strikeshark-sharkloader-cobalt-strike-defense/https://bulwarkblack.com/strikeshark-sharkloader-cobalt-strike-defense/Kaspersky’s StrikeShark research shows how opportunistic exploitation of exposed servers can become a multi-stage SharkLoader and Cobalt Strike intrusion. Here is what SMBs and government contractors should review now.Thu, 25 Jun 2026 15:09:47 GMTCyber Security Bloghttps://bulwarkblack.com/muddywater-chaos-false-flag-ransomware-attribution/https://bulwarkblack.com/muddywater-chaos-false-flag-ransomware-attribution/Iran-linked MuddyWater activity shows why ransomware response needs to examine identity compromise, remote access, and adversary objectives instead of trusting the ransom note at face value.Thu, 25 Jun 2026 01:04:28 GMTCyber Security Bloghttps://bulwarkblack.com/socgholish-operation-endgame-website-trust-defense/https://bulwarkblack.com/socgholish-operation-endgame-website-trust-defense/Operation Endgame disrupted SocGholish infrastructure, but the defensive lesson is bigger: compromised trusted websites are malware delivery infrastructure.Sun, 21 Jun 2026 01:05:10 GMTCyber Security Bloghttps://bulwarkblack.com/operation-escaneo-latin-america-edge-device-defense/https://bulwarkblack.com/operation-escaneo-latin-america-edge-device-defense/Operation Escaneo shows how financially motivated actors are turning exposed edge devices, tunnels, and privileged service accounts into full intrusion chains across Latin American government and critical infrastructure targets.Sat, 20 Jun 2026 20:07:49 GMTCyber Security Bloghttps://bulwarkblack.com/mastra-npm-sapphire-sleet-ai-supply-chain-defense/https://bulwarkblack.com/mastra-npm-sapphire-sleet-ai-supply-chain-defense/Microsoft linked the Mastra AI npm package compromise to North Korean actor Sapphire Sleet. Here is what SMBs and government contractors should do about AI framework supply-chain risk.Sat, 20 Jun 2026 15:20:41 GMTAI (General)https://bulwarkblack.com/showboat-linux-malware-telecom-persistence-defense/https://bulwarkblack.com/showboat-linux-malware-telecom-persistence-defense/Showboat is a China-linked Linux post-exploitation framework aimed at telecom providers. The lesson for defenders: treat Linux server persistence, dynamic linker abuse, and low-noise C2 as first-class monitoring priorities.Sat, 20 Jun 2026 01:03:42 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/autojack-ai-agent-localhost-rce-boundaries/https://bulwarkblack.com/autojack-ai-agent-localhost-rce-boundaries/Microsoft’s AutoJack research shows how a malicious webpage can abuse an AI browsing agent’s access to localhost services. The defensive lesson: treat agent control planes, MCP servers, and local tool runners like privileged admin surfaces.Fri, 19 Jun 2026 20:11:44 GMTAI (General)https://bulwarkblack.com/apache-apisix-auth-bypass-plugin-review/https://bulwarkblack.com/apache-apisix-auth-bypass-plugin-review/Apache disclosed a cluster of APISIX authentication and identity plugin CVEs. The defensive priority is patching, plugin inventory, and validating what backend services trust from the gateway.Fri, 19 Jun 2026 15:12:40 GMTCyber Security Bloghttps://bulwarkblack.com/fortibleed-firewall-patching-compromise-recovery/https://bulwarkblack.com/fortibleed-firewall-patching-compromise-recovery/FortiBleed is a reminder that edge firewall patching is necessary, but it does not prove a previously exposed appliance is clean. Defenders need compromise review, credential rotation, and rebuild plans for perimeter devices.Fri, 19 Jun 2026 01:04:18 GMTCyber Security Bloghttps://bulwarkblack.com/uefi-secure-boot-bypass-dbx-revocation-defense/https://bulwarkblack.com/uefi-secure-boot-bypass-dbx-revocation-defense/CERT/CC warns that multiple vendor-signed UEFI applications can be abused to bypass Secure Boot before the operating system and EDR controls ever load. For SMBs and government contractors, the fix is not just firmware patching; it is verifying DBX revocation coverage across managThu, 18 Jun 2026 20:03:18 GMTCyber Security Bloghttps://bulwarkblack.com/smartapesg-okendo-widget-supply-chain-risk/https://bulwarkblack.com/smartapesg-okendo-widget-supply-chain-risk/Zscaler ThreatLabz reported that SmartApeSG injected malicious JavaScript into the Okendo Reviews widget, creating downstream exposure across e-commerce sites. Here is what SMBs and government contractors should do about third-party browser code risk.Thu, 18 Jun 2026 15:04:18 GMTCyber Security Bloghttps://bulwarkblack.com/tor-crypto-clipper-usb-worm-backdoor-defense/https://bulwarkblack.com/tor-crypto-clipper-usb-worm-backdoor-defense/Microsoft research on a Tor-routed crypto clipper shows why defenders should connect USB shortcut execution, script interpreters, localhost proxy activity, and clipboard theft into one investigation path.Thu, 18 Jun 2026 01:04:13 GMTCyber Security Bloghttps://bulwarkblack.com/outsider-enterprise-ai-phishing-smishing-defense/https://bulwarkblack.com/outsider-enterprise-ai-phishing-smishing-defense/The Outsider Enterprise takedown shows AI-powered phishing is now industrial infrastructure. SMBs and government contractors should prioritize phishing-resistant MFA, identity recovery controls, and rapid session revocation.Sun, 14 Jun 2026 15:04:21 GMTAI (General)https://bulwarkblack.com/handala-cal-water-ot-segmentation-defense/https://bulwarkblack.com/handala-cal-water-ot-segmentation-defense/Handala’s California Water Service claim is a reminder that critical-infrastructure defense starts with proving separation between billing systems, telemetry platforms, and operational technology.Sun, 14 Jun 2026 01:05:54 GMTCyber Security Bloghttps://bulwarkblack.com/fortiportal-cve-2026-49938-network-config-data-defense/https://bulwarkblack.com/fortiportal-cve-2026-49938-network-config-data-defense/Fortinet CVE-2026-49938 is a medium-severity FortiPortal API access-control issue, but sensitive network configuration exposure can still give attackers a valuable map of the environment.Sat, 13 Jun 2026 20:07:37 GMTCyber Security Bloghttps://bulwarkblack.com/velvet-ant-operation-highland-authentication-stack-defense/https://bulwarkblack.com/velvet-ant-operation-highland-authentication-stack-defense/Velvet Ant’s Operation Highland shows why PAM, OpenSSH, jump hosts, and proxy paths deserve the same defensive priority as identity providers and domain controllers.Sat, 13 Jun 2026 15:04:04 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/shai-hulud-ai-scanner-evasion-package-supply-chain-defense/https://bulwarkblack.com/shai-hulud-ai-scanner-evasion-package-supply-chain-defense/Zscaler ThreatLabz says the Shai-Hulud campaign has expanded across package ecosystems and introduced prompt-injection tactics aimed at automated AI security triage. The defense lesson is simple: treat package content as hostile input, even when an LLM is doing the review.Sat, 13 Jun 2026 01:08:24 GMTAI (General)https://bulwarkblack.com/maine-breach-portal-hoax-disclosure-verification-controls/https://bulwarkblack.com/maine-breach-portal-hoax-disclosure-verification-controls/Maine took its public breach notification database offline after fake disclosures were published. The lesson for SMBs and government contractors: public trust workflows need verification, moderation, and correction controls.Fri, 12 Jun 2026 20:04:46 GMTCyber Security Bloghttps://bulwarkblack.com/portainer-cve-2026-33590-container-host-takeover-defense/https://bulwarkblack.com/portainer-cve-2026-33590-container-host-takeover-defense/intWave disclosed CVE-2026-33590 in Portainer, where insecure default Docker security settings could let regular users escalate toward host takeover. Here is what SMBs and government contractors should lock down.Fri, 12 Jun 2026 15:06:48 GMTCyber Security Bloghttps://bulwarkblack.com/maxss-spyder-ai-browser-extensions-endpoint-risk/https://bulwarkblack.com/maxss-spyder-ai-browser-extensions-endpoint-risk/Rebora disclosed MaXSS and Spyder, two critical flaws in AI browser-extension side panels. The lesson for SMBs and government contractors: browser extensions are endpoint software with identity-session reach and need governance.Fri, 12 Jun 2026 01:04:57 GMTAI (General)https://bulwarkblack.com/shinyhunters-peoplesoft-cve-2026-35273-erp-admin-endpoints/https://bulwarkblack.com/shinyhunters-peoplesoft-cve-2026-35273-erp-admin-endpoints/GTIG and Mandiant report active ShinyHunters exploitation of Oracle PeopleSoft CVE-2026-35273. Here is what defenders should lock down, hunt, and segment now.Thu, 11 Jun 2026 20:05:37 GMTCyber Security Bloghttps://bulwarkblack.com/langgraph-checkpointer-sqli-rce-ai-agent-memory-defense/https://bulwarkblack.com/langgraph-checkpointer-sqli-rce-ai-agent-memory-defense/Check Point Research disclosed LangGraph checkpointer flaws that could turn user-controlled state-history filters into SQL injection, unsafe deserialization, and remote code execution. The lesson for SMBs and government contractors: AI agent memory is application infrastructure, Thu, 11 Jun 2026 15:11:42 GMTAI (General)https://bulwarkblack.com/ima-diligence-genesis-ransomware-legacy-server-risk/https://bulwarkblack.com/ima-diligence-genesis-ransomware-legacy-server-risk/A reported IMA Diligence breach affecting more than 525,000 people shows why legacy third-party servers need ownership, monitoring, decommissioning, and data-risk review.Thu, 11 Jun 2026 01:04:12 GMTCyber Security Bloghttps://bulwarkblack.com/c0xmo-dd-wrt-iot-botnet-edge-exposure-defense/https://bulwarkblack.com/c0xmo-dd-wrt-iot-botnet-edge-exposure-defense/Fortinet researchers detailed C0XMO, a Gafgyt variant spreading through DD-WRT and other exposed devices. Here is what SMBs and government contractors should lock down before compromised routers become DDoS infrastructure.Sun, 07 Jun 2026 15:08:38 GMTCyber Security Bloghttps://bulwarkblack.com/solarwinds-servu-cve-2026-28318-file-transfer-availability/https://bulwarkblack.com/solarwinds-servu-cve-2026-28318-file-transfer-availability/CISA added actively exploited SolarWinds Serv-U CVE-2026-28318 to KEV. Here is what SMBs and government contractors should do about file-transfer availability risk.Sun, 07 Jun 2026 01:04:04 GMTCyber Security Bloghttps://bulwarkblack.com/pink-extortion-m365-vishing-cloud-data-defense/https://bulwarkblack.com/pink-extortion-m365-vishing-cloud-data-defense/Unit 42 is tracking Pink / CL-CRI-1147, a Com-affiliated extortion brand using vishing, credential theft, and Microsoft 365 data exfiltration. Here is what SMBs and government contractors should lock down now.Sat, 06 Jun 2026 20:05:25 GMTCyber Security Bloghttps://bulwarkblack.com/chatgpt-lockdown-mode-prompt-injection-egress-control/https://bulwarkblack.com/chatgpt-lockdown-mode-prompt-injection-egress-control/OpenAI’s ChatGPT Lockdown Mode is a useful reminder that prompt-injection defense is not just about model behavior. It is about limiting outbound paths, connector permissions, and tool access around sensitive work.Sat, 06 Jun 2026 15:04:49 GMTAI (General)https://bulwarkblack.com/pan-os-globalprotect-cve-2026-0257-vpn-log-review/https://bulwarkblack.com/pan-os-globalprotect-cve-2026-0257-vpn-log-review/Unit 42 reports active exploitation attempts against PAN-OS GlobalProtect CVE-2026-0257. Defenders should patch, but also review VPN sessions, authentication override cookie behavior, and edge-device telemetry for signs of unauthorized access.Sat, 06 Jun 2026 01:04:43 GMTCyber Security Bloghttps://bulwarkblack.com/unc3753-vishing-rmm-physical-intrusions-law-firms/https://bulwarkblack.com/unc3753-vishing-rmm-physical-intrusions-law-firms/Mandiant reports that UNC3753, also known as Luna Moth / Silent Ransom Group, is targeting U.S. law firms and professional services with vishing, RMM abuse, rapid data theft, and suspected physical office intrusions. Here is what SMBs and government contractors should lock down nFri, 05 Jun 2026 20:06:19 GMTCyber Security Bloghttps://bulwarkblack.com/cisco-sdwan-cve-2026-20245-edge-controller-defense/https://bulwarkblack.com/cisco-sdwan-cve-2026-20245-edge-controller-defense/Cisco says CVE-2026-20245 has been exploited against Catalyst SD-WAN Manager. Defenders should preserve evidence, review controller logs, validate edge-device configuration, and restrict management-plane access.Fri, 05 Jun 2026 15:07:55 GMTCyber Security Bloghttps://bulwarkblack.com/agentic-ai-failure-modes-supply-chain-controls/https://bulwarkblack.com/agentic-ai-failure-modes-supply-chain-controls/Microsoft’s updated agentic AI failure-mode taxonomy turns AI agents into a practical security architecture problem: plugins, prompts, memory, browser use, and human approvals all need controls.Fri, 05 Jun 2026 01:05:21 GMTAI (General)https://bulwarkblack.com/error-524-smishing-fraud-infrastructure-cti-defense/https://bulwarkblack.com/error-524-smishing-fraud-infrastructure-cti-defense/Group-IB documented a global smishing operation using fake error pages, geofencing, and encrypted WebSocket exfiltration. Here is what SMBs and government contractors should take from it.Thu, 04 Jun 2026 20:04:19 GMTCyber Security Bloghttps://bulwarkblack.com/automatic-tank-gauge-cyberattacks-ot-exposure-control/https://bulwarkblack.com/automatic-tank-gauge-cyberattacks-ot-exposure-control/Federal agencies warn that attackers are compromising internet-exposed automatic tank gauge systems. The lesson for SMBs, fuel operators, farms, logistics firms, and gov contractors is simple: small OT is still operational infrastructure.Thu, 04 Jun 2026 15:04:29 GMTCyber Security Bloghttps://bulwarkblack.com/stock-exchange-mailbox-espionage-executive-email-defense/https://bulwarkblack.com/stock-exchange-mailbox-espionage-executive-email-defense/A five-month espionage campaign against a stock exchange executive mailbox shows why senior email accounts need privileged-asset controls, cloud exfiltration monitoring, and scheduled-task hunting.Thu, 04 Jun 2026 01:05:22 GMTCyber Security Bloghttps://bulwarkblack.com/ta4922-global-hr-tax-phishing-rmm-defense/https://bulwarkblack.com/ta4922-global-hr-tax-phishing-rmm-defense/Proofpoint’s TA4922 reporting shows how localized HR, payroll, tax, and invoice lures can become full initial-access infrastructure through DLL sideloading, loaders, RATs, RMM tools, and browser credential theft.Wed, 03 Jun 2026 20:05:18 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/red-hat-miasma-npm-supply-chain-trusted-publishing-defense/https://bulwarkblack.com/red-hat-miasma-npm-supply-chain-trusted-publishing-defense/A Red Hat Cloud Services npm compromise shows why signed releases and trusted publishing must be paired with install-time controls, CI/CD isolation, and fast credential rotation.Wed, 03 Jun 2026 15:04:14 GMTCyber Security Bloghttps://bulwarkblack.com/ai-assisted-ransomware-edr-evasion-iteration-problem/https://bulwarkblack.com/ai-assisted-ransomware-edr-evasion-iteration-problem/Sophos observed ransomware-linked operators using AI-assisted development workflows to accelerate EDR evasion testing and Active Directory discovery. The defensive lesson: validate controls, harden identity, and monitor behavior before attackers iterate around your tooling.Wed, 03 Jun 2026 01:05:01 GMTAI (General)https://bulwarkblack.com/flutterbridge-macos-malvertising-fluttershell-backdoor-defense/https://bulwarkblack.com/flutterbridge-macos-malvertising-fluttershell-backdoor-defense/Unit 42’s FlutterBridge research shows macOS malvertising evolving from adware into FlutterShell backdoor delivery. Here is what SMBs and government contractors should tighten first.Tue, 02 Jun 2026 20:04:00 GMTCyber Security Bloghttps://bulwarkblack.com/mustang-panda-plugx-fake-browser-updater-defense/https://bulwarkblack.com/mustang-panda-plugx-fake-browser-updater-defense/Mustang Panda’s fake browser updater chain shows why defenders still need to hunt LNK-to-PowerShell execution, DLL sideloading, user-context persistence, and suspicious HTTPS beaconing.Tue, 02 Jun 2026 15:04:24 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/forticlient-ems-ekz-infostealer-delivery/https://bulwarkblack.com/forticlient-ems-ekz-infostealer-delivery/Attackers are abusing CVE-2026-35616 in FortiClient EMS to push a credential stealer through trusted endpoint management workflows. Here is what defenders should check first.Tue, 02 Jun 2026 01:05:30 GMTCyber Security Bloghttps://bulwarkblack.com/meta-ai-support-bot-account-recovery-risk/https://bulwarkblack.com/meta-ai-support-bot-account-recovery-risk/Attackers reportedly abused Meta’s AI support assistant during Instagram account recovery. The lesson for SMBs and contractors: recovery workflows are identity infrastructure and need MFA, monitoring, and guardrails.Mon, 01 Jun 2026 20:06:35 GMTAI (General)https://bulwarkblack.com/solyximmortal-python-infostealer-business-risk/https://bulwarkblack.com/solyximmortal-python-infostealer-business-risk/SolyxImmortal combines persistence, browser credential theft, document collection, screenshots, keylogging, and webhook exfiltration. Here is what SMB and government-contractor defenders should do about it.Mon, 01 Jun 2026 15:07:46 GMTCyber Security Bloghttps://bulwarkblack.com/showboat-jfmbackdoor-telecom-intrusion-defense/https://bulwarkblack.com/showboat-jfmbackdoor-telecom-intrusion-defense/Lumen and PwC reporting on Showboat, Red Lamassu, and JFMBackdoor shows how China-linked telecom intrusions combine Linux footholds, proxying, and Windows backdoors. Here is what SMBs and government contractors should harden now.Mon, 01 Jun 2026 01:06:17 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/wp-maps-pro-admin-account-vulnerability-defense/https://bulwarkblack.com/wp-maps-pro-admin-account-vulnerability-defense/Attackers are exploiting CVE-2026-8732 in WP Maps Pro to create rogue WordPress administrator accounts. Here is what SMBs and contractors should patch, audit, and verify.Sun, 31 May 2026 20:05:51 GMTCyber Security Bloghttps://bulwarkblack.com/sidecopy-xenorat-localized-phishing-defense/https://bulwarkblack.com/sidecopy-xenorat-localized-phishing-defense/SideCopy/APT36 targeted Afghanistan finance officials with Pashto-language lures and XenoRAT. Here is what SMBs and government contractors should take from the campaign.Sun, 31 May 2026 15:13:08 GMTCyber Security Bloghttps://bulwarkblack.com/npm-dependency-confusion-recon-supply-chain-defense/https://bulwarkblack.com/npm-dependency-confusion-recon-supply-chain-defense/Microsoft found 33 malicious npm packages abusing dependency confusion to profile developer and build environments. The defender lesson: treat package installation as code execution and lock down internal namespace hygiene before attackers do reconnaissance at scale.Sun, 31 May 2026 01:03:55 GMTCyber Security Bloghttps://bulwarkblack.com/mediainfolib-parser-bugs-file-metadata-execution-boundary/https://bulwarkblack.com/mediainfolib-parser-bugs-file-metadata-execution-boundary/Cisco Talos disclosed four patched MediaInfoLib heap-based buffer overflow vulnerabilities. The bigger lesson: automated media metadata parsing belongs inside a sandboxed, monitored execution boundary.Wed, 27 May 2026 15:04:06 GMTCyber Security Bloghttps://bulwarkblack.com/poisoned-search-ai-screenconnect-cryptojacking-defense/https://bulwarkblack.com/poisoned-search-ai-screenconnect-cryptojacking-defense/Microsoft reported a cryptojacking campaign that uses poisoned search results, AI-surfaced software recommendations, fake utility downloads, and abused ScreenConnect access. Here is what SMBs and government contractors should defend first.Wed, 27 May 2026 01:10:44 GMTAI (General)https://bulwarkblack.com/litespeed-cpanel-kev-shared-hosting-privilege-escalation/https://bulwarkblack.com/litespeed-cpanel-kev-shared-hosting-privilege-escalation/CISA added CVE-2026-48172 to KEV after active exploitation of a LiteSpeed cPanel user-end plugin flaw that can let compromised hosting accounts execute scripts as root.Tue, 26 May 2026 20:08:08 GMTCyber Security Bloghttps://bulwarkblack.com/megalodon-github-actions-cicd-secret-theft-defense/https://bulwarkblack.com/megalodon-github-actions-cicd-secret-theft-defense/The Megalodon GitHub campaign shows why CI/CD pipelines must be treated like production infrastructure: malicious workflow commits can harvest cloud credentials, OIDC tokens, SSH keys, and package secrets at scale.Tue, 26 May 2026 15:12:22 GMTCyber Security Bloghttps://bulwarkblack.com/chinese-phaas-real-time-otp-wallet-defense/https://bulwarkblack.com/chinese-phaas-real-time-otp-wallet-defense/Google’s reporting on Chinese-language phishing-as-a-service shows why MFA bypass, real-time OTP interception, and digital wallet fraud require phishing-resistant authentication and session monitoring.Mon, 25 May 2026 20:05:03 GMTCyber Security Bloghttps://bulwarkblack.com/knowledgedeliver-viewstate-shared-machine-key-defense/https://bulwarkblack.com/knowledgedeliver-viewstate-shared-machine-key-defense/Mandiant’s KnowledgeDeliver CVE-2026-5426 report shows how shared ASP.NET machine keys can turn ViewState into unauthenticated RCE and user-facing malware delivery.Mon, 25 May 2026 15:04:31 GMTCyber Security Bloghttps://bulwarkblack.com/laravel-lang-composer-supply-chain-defense/https://bulwarkblack.com/laravel-lang-composer-supply-chain-defense/A Laravel-Lang package compromise shows why trusted dependency tags, Composer autoload behavior, and runtime secrets need security monitoring—not just engineering review.Mon, 25 May 2026 01:10:09 GMTCyber Security Bloghttps://bulwarkblack.com/clop-south-staffs-water-soc-coverage-defense/https://bulwarkblack.com/clop-south-staffs-water-soc-coverage-defense/The South Staffordshire Water breach shows why outsourced SOC coverage, legacy server risk, and vulnerability management must be proven—not assumed—for SMBs, utilities, and government contractors.Sun, 24 May 2026 20:06:55 GMTCyber Security Bloghttps://bulwarkblack.com/roadtools-cloud-identity-entra-id-defense/https://bulwarkblack.com/roadtools-cloud-identity-entra-id-defense/Unit 42’s ROADtools research shows why Microsoft Entra ID token abuse, rogue device registration, and Graph API enumeration need to be treated as core incident-response signals for SMBs and government contractors.Sun, 24 May 2026 15:12:59 GMTCyber Security Bloghttps://bulwarkblack.com/drupal-cve-2026-9082-web-asset-inventory-response/https://bulwarkblack.com/drupal-cve-2026-9082-web-asset-inventory-response/Drupal CVE-2026-9082 is already being scanned and exploited in the wild. The lesson for SMBs and government contractors: know where your Drupal sites are, verify PostgreSQL exposure, patch fast, and review logs before probing turns into compromise.Sun, 24 May 2026 01:07:26 GMTCyber Security Bloghttps://bulwarkblack.com/void-dokkaebi-invisibleferret-developer-endpoint-risk/https://bulwarkblack.com/void-dokkaebi-invisibleferret-developer-endpoint-risk/Trend Micro reports North Korea-aligned Void Dokkaebi has moved InvisibleFerret into Cython-compiled Python extension modules. For SMBs and government contractors, the real risk is developer endpoint access to CI/CD, cloud, and production secrets.Sat, 23 May 2026 15:08:48 GMTCyber Security Bloghttps://bulwarkblack.com/nimbus-manticore-minifast-iran-apt-defense/https://bulwarkblack.com/nimbus-manticore-minifast-iran-apt-defense/Check Point Research reports that IRGC-affiliated Nimbus Manticore resurfaced with fake Zoom and SQL Developer lures, SEO poisoning, AppDomain hijacking, and a new MiniFast backdoor. Here is what SMBs and government contractors should tighten first.Sat, 23 May 2026 01:04:27 GMTCyber Security Bloghttps://bulwarkblack.com/f5-confluence-edge-identity-attack-path/https://bulwarkblack.com/f5-confluence-edge-identity-attack-path/Microsoft analyzed an intrusion where an F5 BIG-IP edge appliance led to Linux access, Confluence compromise, credential theft, and identity relay attempts. Here is what SMBs and government contractors should tighten first.Fri, 22 May 2026 20:04:38 GMTCyber Security Bloghttps://bulwarkblack.com/screening-serpens-recruiting-espionage-attack-surface/https://bulwarkblack.com/screening-serpens-recruiting-espionage-attack-surface/Iran-nexus Screening Serpens used recruitment and meeting lures, new RAT variants, and .NET AppDomainManager hijacking. Here is what SMBs and government contractors should tighten now.Fri, 22 May 2026 15:06:52 GMTCyber Security Bloghttps://bulwarkblack.com/kimwolf-arrest-iot-ddos-defense/https://bulwarkblack.com/kimwolf-arrest-iot-ddos-defense/The alleged Kimwolf botmaster arrest is a useful reminder for SMBs and government contractors: DDoS resilience starts with asset visibility, upstream protection, and hardening forgotten IoT and edge devices.Fri, 22 May 2026 01:04:33 GMTCyber Security Bloghttps://bulwarkblack.com/tamperedchef-signed-productivity-apps-malware-defense/https://bulwarkblack.com/tamperedchef-signed-productivity-apps-malware-defense/TamperedChef-style malware hides inside convincing signed productivity apps. Here is what SMBs and government contractors should do about it.Thu, 21 May 2026 20:05:34 GMTCyber Security Bloghttps://bulwarkblack.com/patriot-bait-ai-enabled-fraud-trust-attack-surface/https://bulwarkblack.com/patriot-bait-ai-enabled-fraud-trust-attack-surface/Trend Micro’s Patriot Bait research shows how one operator used AI assistance, social trust, WordPress credential attacks, and crypto fraud infrastructure to scale a low-cost cybercrime operation.Thu, 21 May 2026 15:04:56 GMTAI (General)https://bulwarkblack.com/mini-shai-hulud-antv-npm-cicd-secrets-defense/https://bulwarkblack.com/mini-shai-hulud-antv-npm-cicd-secrets-defense/Mini Shai-Hulud’s @antv npm compromise shows why dependency malware should be treated as a CI/CD credential-theft threat, not just a package hygiene problem.Thu, 21 May 2026 01:04:15 GMTCyber Security Bloghttps://bulwarkblack.com/exiftool-cve-2026-3102-image-metadata-threat-model/https://bulwarkblack.com/exiftool-cve-2026-3102-image-metadata-threat-model/CVE-2026-3102 in ExifTool shows why image metadata processing should be patched, isolated, and monitored like any other untrusted file-ingest path.Wed, 20 May 2026 20:05:07 GMTCyber Security Bloghttps://bulwarkblack.com/p2pinfect-kubernetes-redis-botnet-defense/https://bulwarkblack.com/p2pinfect-kubernetes-redis-botnet-defense/Fortinet observed P2Pinfect infections inside GKE clusters where exposed Redis instances became long-lived botnet footholds. For SMBs and government contractors, the lesson is clear: cloud misconfiguration, runtime visibility, and egress monitoring matter as much as patching.Wed, 20 May 2026 15:09:53 GMTCyber Security Bloghttps://bulwarkblack.com/verizon-dbir-2026-vulnerability-exploitation-priority/https://bulwarkblack.com/verizon-dbir-2026-vulnerability-exploitation-priority/Verizon’s 2026 DBIR shows vulnerability exploitation overtaking credential abuse as the top breach access vector. Here is what SMBs and government contractors should fix first.Wed, 20 May 2026 01:03:57 GMTCyber Security Bloghttps://bulwarkblack.com/fox-tempest-code-signing-trust-weaponized/https://bulwarkblack.com/fox-tempest-code-signing-trust-weaponized/Microsoft disrupted Fox Tempest, a malware-signing-as-a-service operation that helped ransomware crews make malicious binaries look trusted. Here is what SMBs and government contractors should review now.Tue, 19 May 2026 20:10:42 GMTCyber Security Bloghttps://bulwarkblack.com/cisa-govcloud-github-secrets-leak/https://bulwarkblack.com/cisa-govcloud-github-secrets-leak/A reported CISA contractor GitHub leak shows why secret scanning, token rotation, and CI/CD hardening need to be enforced controls, not optional developer hygiene.Tue, 19 May 2026 15:07:06 GMTCyber Security Bloghttps://bulwarkblack.com/storm-2949-cloud-identity-breach-defense/https://bulwarkblack.com/storm-2949-cloud-identity-breach-defense/Microsoft’s Storm-2949 case study is a clean warning for SMBs and government contractors: once cloud identity and control-plane access are compromised, attackers can steal data without deploying traditional malware.Tue, 19 May 2026 01:03:14 GMTCyber Security Bloghttps://bulwarkblack.com/ai-agent-governance-security-control/https://bulwarkblack.com/ai-agent-governance-security-control/AI agents now operate with real credentials inside business systems. Here is how SMBs and government contractors should govern identity, authority, action, and evidence before agentic workflows become unmanaged risk.Mon, 18 May 2026 15:39:13 GMTAI (General)https://bulwarkblack.com/sglang-rce-ai-inference-network-isolation/https://bulwarkblack.com/sglang-rce-ai-inference-network-isolation/CERT/CC disclosed three SGLang vulnerabilities affecting AI inference deployments, including remote code execution and path traversal risks. Here is what SMBs and government contractors should do now.Mon, 18 May 2026 15:36:57 GMTAI (General)https://bulwarkblack.com/grafana-github-token-breach-source-code-defense/https://bulwarkblack.com/grafana-github-token-breach-source-code-defense/Grafana disclosed unauthorized GitHub access tied to a leaked token and codebase download. Here is what SMBs and government contractors should tighten around source-code access, CI/CD tokens, and extortion readiness.Sun, 17 May 2026 20:08:51 GMTCyber Security Bloghttps://bulwarkblack.com/ai-literacy-needs-fundamentals-teaching-technology-real-world/https://bulwarkblack.com/ai-literacy-needs-fundamentals-teaching-technology-real-world/Albert LaScola reflects on teaching database systems, governance, risk management, and AI literacy through a fundamentals-first approach shaped by Navy operations, security work, Bulwark Black, and Rural Tech and Support.Sun, 17 May 2026 17:25:56 GMTAI (General)https://bulwarkblack.com/node-ipc-npm-supply-chain-ci-secrets-defense/https://bulwarkblack.com/node-ipc-npm-supply-chain-ci-secrets-defense/Malicious node-ipc npm releases turned a package update into a credential-exposure event. Here is what SMBs and government contractors should check first.Sun, 17 May 2026 15:43:37 GMTCyber Security Bloghttps://bulwarkblack.com/exchange-owa-zero-day-cisa-kev-mitigation/https://bulwarkblack.com/exchange-owa-zero-day-cisa-kev-mitigation/CISA added Microsoft Exchange Server CVE-2026-42897 to KEV after evidence of active exploitation. For SMBs and government contractors, the lesson is simple: internet-facing email infrastructure needs emergency mitigation playbooks before the patch lands.Sun, 17 May 2026 01:04:06 GMTCyber Security Bloghttps://bulwarkblack.com/device-code-phishing-oauth-token-theft-defense/https://bulwarkblack.com/device-code-phishing-oauth-token-theft-defense/Device code phishing is scaling because it abuses legitimate OAuth flows instead of simply stealing passwords. Here is what SMBs and government contractors should review now.Sat, 16 May 2026 20:08:18 GMTCyber Security Bloghttps://bulwarkblack.com/linux-kernel-ipsec-attack-surface-reduction/https://bulwarkblack.com/linux-kernel-ipsec-attack-surface-reduction/Recent Linux kernel exploit discussions show why SMBs and government contractors should reduce unused modules and services, not just wait for patches.Sat, 16 May 2026 15:06:44 GMTCyber Security Bloghttps://bulwarkblack.com/pawsrunner-steganography-purelogs-infostealer-defense/https://bulwarkblack.com/pawsrunner-steganography-purelogs-infostealer-defense/FortiGuard Labs reports PureLogs is being delivered through PawsRunner steganography. Here is what SMBs and government contractors should watch for defensively.Sat, 16 May 2026 01:03:47 GMTCyber Security Bloghttps://bulwarkblack.com/blackfile-vishing-extortion-identity-defense/https://bulwarkblack.com/blackfile-vishing-extortion-identity-defense/GTIG reports UNC6671 / BlackFile is using vishing, AiTM phishing, and SaaS data theft to extort organizations. Here is what SMBs and government contractors should harden now.Fri, 15 May 2026 20:06:06 GMTCyber Security Bloghttps://bulwarkblack.com/gremlin-stealer-browser-session-resource-obfuscation/https://bulwarkblack.com/gremlin-stealer-browser-session-resource-obfuscation/Unit 42 reports Gremlin Stealer has evolved with resource-file obfuscation, session hijacking, Discord token theft, and crypto clipboard fraud. Here is what SMBs and government contractors should do defensively.Fri, 15 May 2026 15:07:52 GMTCyber Security Bloghttps://bulwarkblack.com/cisco-sdwan-active-exploitation-edge-controller-review/https://bulwarkblack.com/cisco-sdwan-active-exploitation-edge-controller-review/Cisco Talos reports active exploitation of Catalyst SD-WAN authentication bypass and related vulnerabilities. Here is what SMBs and government contractors should prioritize now.Fri, 15 May 2026 01:04:46 GMTCyber Security Bloghttps://bulwarkblack.com/kazuar-p2p-botnet-russian-espionage-defense/https://bulwarkblack.com/kazuar-p2p-botnet-russian-espionage-defense/Microsoft reports that Kazuar, attributed to Russian state actor Secret Blizzard, has evolved into a modular P2P botnet. Here is what SMBs and government contractors should take from it defensively.Thu, 14 May 2026 20:04:19 GMTCyber Security Bloghttps://bulwarkblack.com/exposed-ai-apps-misconfiguration-rce-risk/https://bulwarkblack.com/exposed-ai-apps-misconfiguration-rce-risk/Microsoft warns that publicly exposed AI apps, MCP servers, and Kubernetes-hosted agent tooling can turn weak defaults into practical paths for RCE, credential theft, and data exposure.Thu, 14 May 2026 15:14:25 GMTAI (General)https://bulwarkblack.com/may-2026-patch-tuesday-smb-prioritization/https://bulwarkblack.com/may-2026-patch-tuesday-smb-prioritization/Microsoft’s May 2026 Patch Tuesday shipped 132 CVEs. Here is how SMBs and government contractors should prioritize identity, server, and Office risks first.Thu, 14 May 2026 01:04:43 GMTCyber Security Bloghttps://bulwarkblack.com/gentlemen-raas-leak-edge-device-ransomware-risk/https://bulwarkblack.com/gentlemen-raas-leak-edge-device-ransomware-risk/Check Point’s look inside The Gentlemen ransomware operation is a useful reminder for SMBs and government contractors: exposed edge appliances, weak identity controls, and unmanaged remote access paths still drive real ransomware risk.Wed, 13 May 2026 20:08:11 GMTCyber Security Bloghttps://bulwarkblack.com/jdownloader-site-compromise-trusted-download-verification/https://bulwarkblack.com/jdownloader-site-compromise-trusted-download-verification/Attackers swapped selected JDownloader website download links with malicious installers. Here is what SMB and government-contractor defenders should do about trusted-download risk.Sat, 09 May 2026 20:06:43 GMTCyber Security Bloghttps://bulwarkblack.com/fake-openai-hugging-face-infostealer-ai-supply-chain-risk/https://bulwarkblack.com/fake-openai-hugging-face-infostealer-ai-supply-chain-risk/A fake OpenAI Privacy Filter repository on Hugging Face delivered Windows infostealer malware. Here is what SMB and gov-contractor defenders should take from it.Sat, 09 May 2026 15:09:27 GMTAI (General)https://bulwarkblack.com/mcp-server-command-injection-ai-tool-isolation/https://bulwarkblack.com/mcp-server-command-injection-ai-tool-isolation/A critical GitHub advisory for @profullstack/mcp-server shows how unsafe AI tool endpoints can turn domain lookup functionality into unauthenticated remote code execution.Sat, 09 May 2026 01:06:51 GMTAI (General)https://bulwarkblack.com/dirty-frag-linux-privilege-escalation-defender-guide/https://bulwarkblack.com/dirty-frag-linux-privilege-escalation-defender-guide/Microsoft is tracking active Dirty Frag Linux privilege escalation activity. Here is what SMB and gov-contractor defenders should prioritize now.Fri, 08 May 2026 20:06:13 GMTCyber Security Bloghttps://bulwarkblack.com/prompt-injection-rce-ai-agent-frameworks/https://bulwarkblack.com/prompt-injection-rce-ai-agent-frameworks/Microsoft disclosed Semantic Kernel vulnerabilities showing how prompt injection can cross into code execution when AI agents are connected to unsafe tools. Here is what defenders should review now.Fri, 08 May 2026 15:10:01 GMTAI (General)https://bulwarkblack.com/nasa-prithvi-geospatial-ai-orbit/https://bulwarkblack.com/nasa-prithvi-geospatial-ai-orbit/NASA and IBM’s open-source Prithvi geospatial AI model has now been demonstrated in orbit. The milestone points toward a future where satellites analyze data before sending it home — and where security has to follow AI into operational environments.Fri, 08 May 2026 05:35:44 GMTMakes you Thinkhttps://bulwarkblack.com/pan-os-captive-portal-zero-day-edge-device-review/https://bulwarkblack.com/pan-os-captive-portal-zero-day-edge-device-review/Unit 42 reports limited exploitation of CVE-2026-0300, a PAN-OS Captive Portal zero-day. Here is what SMB and government-contractor defenders should check now.Fri, 08 May 2026 01:06:24 GMTCyber Security Bloghttps://bulwarkblack.com/pcpjack-cloud-worm-credential-theft/https://bulwarkblack.com/pcpjack-cloud-worm-credential-theft/SentinelLabs reported PCPJack, a cloud-focused worm that evicts TeamPCP artifacts, steals credentials from exposed infrastructure, and spreads across cloud systems.Thu, 07 May 2026 18:38:54 GMTCyber Security Bloghttps://bulwarkblack.com/2174-2/https://bulwarkblack.com/2174-2/2026 Hormuz Crisis — Investment Strategy Report BRENT CRUDE $101.91 ▲3.47% WTI CRUDE $98.50 ▲3.12% GOLD $4,750 ▼0.72% XLE +25% YTD XOP +30% YTD BWET +411% Q1 2026 S&P 500 -4.4% YTD 10-YR YIELD 4.46% HORMUZ STATUS BLOCKADE ACTIVE IEA: LARGEST SUPPLY DISRUPTION IN HISTORY BRENT CRUMon, 27 Apr 2026 18:34:26 GMTBusinesshttps://bulwarkblack.com/critical-cisco-imc-authentication-bypass-enables-unauthenticated-admin-access/https://bulwarkblack.com/critical-cisco-imc-authentication-bypass-enables-unauthenticated-admin-access/Cisco has released urgent security patches addressing multiple critical and high-severity vulnerabilities, including a maximum-severity authentication bypass in the Integrated Management Controller (IMC) that allows unauthenticated attackers to gain administrative access to affecSat, 04 Apr 2026 20:09:21 GMTThreat Intelligencehttps://bulwarkblack.com/critical-cisco-imc-authentication-bypass-grants-remote-attackers-admin-privileges/https://bulwarkblack.com/critical-cisco-imc-authentication-bypass-grants-remote-attackers-admin-privileges/Cisco has released emergency security updates to patch a critical authentication bypass vulnerability in its Integrated Management Controller (IMC), a critical component embedded on the motherboard of Cisco UCS C-Series and E-Series servers that provides out-of-band management caSat, 04 Apr 2026 15:09:34 GMTGeneral CTIhttps://bulwarkblack.com/crystalx-rat-new-malware-as-a-service-combines-spyware-stealer-and-prankware-capabilities/https://bulwarkblack.com/crystalx-rat-new-malware-as-a-service-combines-spyware-stealer-and-prankware-capabilities/Kaspersky researchers have uncovered CrystalX RAT, a sophisticated new malware-as-a-service (MaaS) platform that combines remote access trojan capabilities with data theft, keylogging, and uniquely disturbing prankware features designed to psychologically torment victims. From WeSat, 04 Apr 2026 01:05:41 GMTMalwarehttps://bulwarkblack.com/cl-sta-1087-chinese-apt-targets-southeast-asian-militaries-with-applechris-and-memfun-backdoors/https://bulwarkblack.com/cl-sta-1087-chinese-apt-targets-southeast-asian-militaries-with-applechris-and-memfun-backdoors/Unit 42 researchers have uncovered a sophisticated Chinese espionage campaign, designated CL-STA-1087, that has been systematically targeting military organizations across Southeast Asia since at least 2020. The state-sponsored operation demonstrates exceptional operational patieFri, 03 Apr 2026 20:06:25 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/uat-10608-nexus-listener-framework-compromises-766-next-js-hosts-in-24-hour-credential-harvesting-blitz/https://bulwarkblack.com/uat-10608-nexus-listener-framework-compromises-766-next-js-hosts-in-24-hour-credential-harvesting-blitz/Cisco Talos has disclosed a large-scale automated credential harvesting campaign carried out by a threat cluster they are tracking as “UAT-10608.” The systematic exploitation campaign leverages a custom framework called “NEXUS Listener” to target Next.js applications vulnerable tFri, 03 Apr 2026 15:05:56 GMTGeneral CTIhttps://bulwarkblack.com/dprk-threat-actors-leverage-github-as-command-and-control-infrastructure-in-multi-stage-lnk-attacks/https://bulwarkblack.com/dprk-threat-actors-leverage-github-as-command-and-control-infrastructure-in-multi-stage-lnk-attacks/North Korean state-sponsored threat actors have been observed targeting South Korean organizations with a sophisticated multi-stage attack chain that abuses GitHub as command and control (C2) infrastructure. Fortinet FortiGuard Labs published research on April 2, 2026 detailing tThu, 02 Apr 2026 20:06:07 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/litellm-supply-chain-attack-teampcp-deploys-multi-stage-credential-stealer-to-95m-monthly-downloads/https://bulwarkblack.com/litellm-supply-chain-attack-teampcp-deploys-multi-stage-credential-stealer-to-95m-monthly-downloads/A sophisticated supply chain attack has compromised LiteLLM, the widely-used Python library for interfacing with large language models, delivering multi-stage credential-stealing malware to systems downloading over 95 million packages per month. The attack, attributed to TeamPCP—Thu, 02 Apr 2026 01:04:53 GMTAI (General)https://bulwarkblack.com/operation-truechaos-chinese-apt-exploits-trueconf-zero-day-cve-2026-3502-to-target-southeast-asian-governments/https://bulwarkblack.com/operation-truechaos-chinese-apt-exploits-trueconf-zero-day-cve-2026-3502-to-target-southeast-asian-governments/A critical zero-day vulnerability in the TrueConf video conferencing platform is being actively exploited in a sophisticated espionage campaign targeting government entities across Southeast Asia. Check Point Research has uncovered Operation TrueChaos, a targeted attack campaign Wed, 01 Apr 2026 15:02:52 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/axios-npm-supply-chain-attack-deploys-cross-platform-rat-to-83-million-weekly-users/https://bulwarkblack.com/axios-npm-supply-chain-attack-deploys-cross-platform-rat-to-83-million-weekly-users/On March 31, 2026, the cybersecurity landscape was shaken by a significant supply chain attack targeting Axios, one of the most widely used HTTP client libraries in the JavaScript ecosystem with over 83 million weekly downloads. Attackers compromised a maintainer account to injecWed, 01 Apr 2026 01:02:39 GMTMalwarehttps://bulwarkblack.com/deepload-malware-ai-generated-evasion-meets-clickfix-delivery-in-enterprise-credential-theft-campaign/https://bulwarkblack.com/deepload-malware-ai-generated-evasion-meets-clickfix-delivery-in-enterprise-credential-theft-campaign/A sophisticated new malware campaign dubbed “DeepLoad” has emerged targeting enterprise environments, combining ClickFix social engineering delivery with AI-generated obfuscation techniques that defeat traditional security controls. ReliaQuest researchers discovered the threat afTue, 31 Mar 2026 15:03:25 GMTAI (General)https://bulwarkblack.com/shinyhunters-breaches-european-commission-350gb-of-sensitive-data-exfiltrated-from-aws-cloud/https://bulwarkblack.com/shinyhunters-breaches-european-commission-350gb-of-sensitive-data-exfiltrated-from-aws-cloud/The European Commission has confirmed a significant data breach after its Europa.eu web platform was compromised in a cyberattack claimed by the notorious ShinyHunters extortion gang. The attackers allegedly exfiltrated over 350GB of sensitive data from the Commission’s Amazon WeTue, 31 Mar 2026 01:02:59 GMTGeneral CTIhttps://bulwarkblack.com/cve-2026-3055-critical-citrix-netscaler-memory-flaw-actively-exploited-in-the-wild/https://bulwarkblack.com/cve-2026-3055-critical-citrix-netscaler-memory-flaw-actively-exploited-in-the-wild/Threat actors are actively exploiting CVE-2026-3055, a critical severity memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances. Security researchers at watchTowr have confirmed in-the-wild exploitation began at least March 27, 2026, with attackersMon, 30 Mar 2026 20:02:32 GMTThreat Intelligencehttps://bulwarkblack.com/fbi-alert-iranian-mois-hackers-weaponize-telegram-as-c2-channel-to-target-dissidents-worldwide/https://bulwarkblack.com/fbi-alert-iranian-mois-hackers-weaponize-telegram-as-c2-channel-to-target-dissidents-worldwide/The FBI has issued a critical alert warning that Iranian government hackers are weaponizing Telegram as a command and control (C2) channel to steal data from dissidents, opposition groups, and journalists who oppose the regime around the world. According to the FBI alert publisheMon, 30 Mar 2026 15:01:44 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/fbi-confirms-handala-hackers-breached-director-patels-personal-email-account/https://bulwarkblack.com/fbi-confirms-handala-hackers-breached-director-patels-personal-email-account/Iran-linked hackers have successfully breached the personal email account of FBI Director Kash Patel, publishing photos, documents, and email correspondence in a significant escalation of cyber operations targeting senior U.S. government officials. The Handala Hack Team, a hacktiMon, 30 Mar 2026 01:03:51 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/infinity-stealer-new-macos-infostealer-combines-clickfix-social-engineering-with-nuitka-compilation/https://bulwarkblack.com/infinity-stealer-new-macos-infostealer-combines-clickfix-social-engineering-with-nuitka-compilation/A sophisticated new info-stealing malware named Infinity Stealer is targeting macOS systems using an innovative attack chain that combines ClickFix social engineering with Python payloads compiled using the open-source Nuitka compiler. Attack Overview According to Malwarebytes reSun, 29 Mar 2026 20:01:29 GMTMalwarehttps://bulwarkblack.com/infinity-stealer-new-macos-infostealer-uses-clickfix-and-nuitka-compilation-to-evade-detection/https://bulwarkblack.com/infinity-stealer-new-macos-infostealer-uses-clickfix-and-nuitka-compilation-to-evade-detection/A sophisticated new information-stealing malware named Infinity Stealer has emerged targeting macOS systems, combining the increasingly popular ClickFix social engineering technique with advanced evasion capabilities through Nuitka compilation. According to Malwarebytes research,Sun, 29 Mar 2026 15:02:30 GMTMalwarehttps://bulwarkblack.com/iranian-handala-hackers-breach-fbi-director-kash-patels-personal-email-leak-photos-and-documents/https://bulwarkblack.com/iranian-handala-hackers-breach-fbi-director-kash-patels-personal-email-leak-photos-and-documents/Iran-linked hacking group Handala Hack Team has successfully breached the personal email account of FBI Director Kash Patel, publishing photographs and documents stolen from his inbox, according to The Guardian and confirmed by the FBI. Attack Details The breach was announced by Sun, 29 Mar 2026 01:03:00 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/shinyhunters-claims-350gb-data-theft-from-european-commissions-aws-cloud-infrastructure/https://bulwarkblack.com/shinyhunters-claims-350gb-data-theft-from-european-commissions-aws-cloud-infrastructure/The European Commission, the executive branch of the European Union, has confirmed a significant cyberattack after the notorious ShinyHunters extortion group claimed responsibility for breaching its Amazon Web Services cloud infrastructure and stealing over 350GB of sensitive datSat, 28 Mar 2026 20:04:01 GMTThreat Intelligencehttps://bulwarkblack.com/infinity-stealer-new-macos-malware-uses-clickfix-lures-and-nuitka-compiled-python-payload/https://bulwarkblack.com/infinity-stealer-new-macos-malware-uses-clickfix-lures-and-nuitka-compiled-python-payload/Security researchers at Malwarebytes have uncovered a new macOS infostealer called Infinity Stealer that combines the ClickFix social engineering technique with a Python payload compiled using the open-source Nuitka compiler — a first for documented macOS malware campaigns. Why NSat, 28 Mar 2026 15:05:33 GMTThreat Intelligencehttps://bulwarkblack.com/fbi-alert-iranian-mois-hackers-weaponize-telegram-for-global-espionage-against-dissidents/https://bulwarkblack.com/fbi-alert-iranian-mois-hackers-weaponize-telegram-for-global-espionage-against-dissidents/The FBI has issued a public alert warning that Iranian government hackers affiliated with the Ministry of Intelligence and Security (MOIS) are actively weaponizing Telegram as a command-and-control (C2) platform to conduct espionage operations against dissidents, opposition groupSat, 28 Mar 2026 01:02:39 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/iranian-handala-hackers-breach-fbi-director-kash-patels-personal-email-account/https://bulwarkblack.com/iranian-handala-hackers-breach-fbi-director-kash-patels-personal-email-account/In a significant escalation of Iranian cyber operations against U.S. government officials, the Iran-linked hacktivist group Handala has successfully compromised the personal email account of FBI Director Kash Patel. The breach, confirmed by the FBI on March 27, 2026, resulted in Fri, 27 Mar 2026 20:03:40 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/pro-ukraine-bearlyfy-group-deploys-custom-genielocker-ransomware-against-70-russian-companies/https://bulwarkblack.com/pro-ukraine-bearlyfy-group-deploys-custom-genielocker-ransomware-against-70-russian-companies/A pro-Ukrainian hacking group called Bearlyfy has been attributed to more than 70 cyber attacks targeting Russian companies since January 2025, with recent operations deploying a proprietary Windows ransomware strain called GenieLocker, according to research from Russian securityFri, 27 Mar 2026 15:07:03 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/chinese-apt-red-menshen-plants-stealthy-bpfdoor-backdoors-in-global-telecom-networks/https://bulwarkblack.com/chinese-apt-red-menshen-plants-stealthy-bpfdoor-backdoors-in-global-telecom-networks/A months-long investigation by Rapid7 Labs has exposed a sophisticated state-sponsored espionage campaign by the China-nexus threat actor Red Menshen, which has embedded some of the most covert digital sleeper cells ever documented inside global telecommunications infrastructure.Fri, 27 Mar 2026 01:03:11 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/red-menshen-plants-bpfdoor-backdoors-in-global-telecom-networks-for-long-term-espionage/https://bulwarkblack.com/red-menshen-plants-bpfdoor-backdoors-in-global-telecom-networks-for-long-term-espionage/A comprehensive investigation by Rapid7 Labs has exposed a sophisticated, state-sponsored espionage campaign by the China-nexus threat actor Red Menshen, revealing one of the most covert digital sleeper cell operations ever documented within global telecommunications infrastructuThu, 26 Mar 2026 20:01:34 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/pawn-storm-deploys-prismex-malware-suite-against-ukrainian-defense-supply-chain-and-nato-allies/https://bulwarkblack.com/pawn-storm-deploys-prismex-malware-suite-against-ukrainian-defense-supply-chain-and-nato-allies/Russia-aligned APT group Pawn Storm (APT28/Fancy Bear) has launched an aggressive campaign deploying a sophisticated new malware suite dubbed PRISMEX against Ukrainian defense infrastructure and NATO logistics partners across Central and Eastern Europe. Campaign Overview The campThu, 26 Mar 2026 15:02:31 GMTResearch Papershttps://bulwarkblack.com/identity-security-becomes-critical-attack-vector-as-organizations-battle-fragmented-access-controls/https://bulwarkblack.com/identity-security-becomes-critical-attack-vector-as-organizations-battle-fragmented-access-controls/Identity attacks have evolved beyond simply compromising individual accounts—modern threat actors now focus on what those identities can access across an organization’s sprawling digital ecosystem. As enterprises manage an explosive growth in human, non-human, and agentic identitThu, 26 Mar 2026 01:06:42 GMTBusinesshttps://bulwarkblack.com/oracle-issues-rare-out-of-band-patch-for-critical-cve-2026-21992-rce-in-identity-manager/https://bulwarkblack.com/oracle-issues-rare-out-of-band-patch-for-critical-cve-2026-21992-rce-in-identity-manager/Oracle has released an emergency out-of-band security patch for a critical unauthenticated remote code execution vulnerability affecting Oracle Identity Manager and Oracle Web Services Manager. Tracked as CVE-2026-21992 with a CVSS v3.1 score of 9.8, this flaw allows attackers toWed, 25 Mar 2026 20:04:43 GMTGeneral CTIhttps://bulwarkblack.com/canisterworm-wiper-weaponizes-trivy-supply-chain-to-target-iran/https://bulwarkblack.com/canisterworm-wiper-weaponizes-trivy-supply-chain-to-target-iran/A cybercrime group is attempting to leverage the ongoing US-Iran conflict by deploying a destructive wiper malware that specifically targets systems configured for Iranian users, according to new research from Krebs on Security and Aikido. TeamPCP Launches Iran-Targeting Wiper ThTue, 24 Mar 2026 20:03:06 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/teampcp-deploys-canisterworm-wiper-to-target-iranian-systems/https://bulwarkblack.com/teampcp-deploys-canisterworm-wiper-to-target-iranian-systems/The cybercrime group TeamPCP has added a destructive wiper component to their cloud-native attack infrastructure, specifically targeting systems in Iran based on timezone and language settings. From Data Theft to Destruction Security researcher Charlie Eriksen at Aikido discovereTue, 24 Mar 2026 15:03:54 GMTThreat Intelligencehttps://bulwarkblack.com/hackers-exploit-cve-2025-32975-cvss-10-0-to-hijack-unpatched-quest-kace-sma-systems/https://bulwarkblack.com/hackers-exploit-cve-2025-32975-cvss-10-0-to-hijack-unpatched-quest-kace-sma-systems/Threat actors are actively exploiting a maximum-severity security flaw in Quest KACE Systems Management Appliance (SMA), according to Arctic Wolf research. The vulnerability, tracked as CVE-2025-32975 with a CVSS score of 10.0, allows attackers to completely bypass authenticationTue, 24 Mar 2026 01:01:36 GMTThreat Intelligencehttps://bulwarkblack.com/teampcp-spreads-trivy-supply-chain-attack-to-docker-hub-and-kubernetes-with-devastating-wiper-payload/https://bulwarkblack.com/teampcp-spreads-trivy-supply-chain-attack-to-docker-hub-and-kubernetes-with-devastating-wiper-payload/The cybersecurity community is reeling from an escalating supply chain attack targeting Trivy, Aqua Security’s popular open-source vulnerability scanner with over 33,800 GitHub stars. The threat actor known as TeamPCP has expanded their campaign from compromised GitHub Actions toMon, 23 Mar 2026 20:02:17 GMTGeneral CTIhttps://bulwarkblack.com/fbi-flash-alert-iranian-handala-hackers-weaponize-telegram-for-malware-c2-operations/https://bulwarkblack.com/fbi-flash-alert-iranian-handala-hackers-weaponize-telegram-for-malware-c2-operations/The FBI has issued a flash alert warning network defenders that Iranian hackers linked to the Ministry of Intelligence and Security (MOIS) are actively using Telegram as command-and-control (C2) infrastructure in malware attacks targeting journalists, dissidents, and opposition gMon, 23 Mar 2026 15:05:03 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/unit-42-warns-ai-agents-could-enable-gift-card-theft-and-returns-fraud-at-scale/https://bulwarkblack.com/unit-42-warns-ai-agents-could-enable-gift-card-theft-and-returns-fraud-at-scale/Palo Alto Networks’ Unit 42 has published new research examining how the rise of “agentic commerce” – AI agents that autonomously browse, shop, and transact on behalf of users – could be exploited by cybercriminals to conduct retail fraud at unprecedented scale. Read the full resMon, 23 Mar 2026 01:04:32 GMTAI (General)https://bulwarkblack.com/cve-2026-33017-critical-langflow-ai-framework-vulnerability-exploited-within-20-hours-of-disclosure/https://bulwarkblack.com/cve-2026-33017-critical-langflow-ai-framework-vulnerability-exploited-within-20-hours-of-disclosure/A critical vulnerability in Langflow, the popular open-source visual framework for building AI agents and RAG pipelines, was weaponized by threat actors within just 20 hours of public disclosure—before any proof-of-concept code was publicly available. The Vulnerability Tracked asSun, 22 Mar 2026 20:02:16 GMTAI (General)https://bulwarkblack.com/doj-disrupts-four-massive-iot-botnets-behind-record-breaking-31-4-tbps-ddos-attacks/https://bulwarkblack.com/doj-disrupts-four-massive-iot-botnets-behind-record-breaking-31-4-tbps-ddos-attacks/The U.S. Department of Justice announced a major law enforcement operation to disrupt four IoT botnets — AISURU, Kimwolf, JackSkid, and Mossad — responsible for record-breaking distributed denial-of-service (DDoS) attacks reaching 31.4 terabits per second. The court-authorized taSun, 22 Mar 2026 15:04:46 GMTGeneral CTIhttps://bulwarkblack.com/interlock-ransomware-exploited-cisco-firewall-zero-day-weeks-before-public-disclosure/https://bulwarkblack.com/interlock-ransomware-exploited-cisco-firewall-zero-day-weeks-before-public-disclosure/Amazon’s security team has revealed that the Interlock ransomware gang exploited a critical Cisco firewall vulnerability as a zero-day for five weeks before it was publicly disclosed, giving attackers a significant head start against defenders. Zero-Day Exploitation Timeline AccoSun, 22 Mar 2026 01:02:21 GMTMalwarehttps://bulwarkblack.com/darksword-ios-exploit-kit-russian-hackers-weaponize-six-vulnerabilities-for-full-iphone-takeover/https://bulwarkblack.com/darksword-ios-exploit-kit-russian-hackers-weaponize-six-vulnerabilities-for-full-iphone-takeover/Google Threat Intelligence Group (GTIG), iVerify, and Lookout have jointly uncovered DarkSword, a sophisticated iOS exploit kit that enables complete device compromise with minimal user interaction. The kit, operational since at least November 2025, has been deployed by suspectedSat, 21 Mar 2026 20:03:54 GMTMalwarehttps://bulwarkblack.com/cve-2026-33017-critical-langflow-ai-platform-flaw-exploited-within-20-hours-of-disclosure/https://bulwarkblack.com/cve-2026-33017-critical-langflow-ai-platform-flaw-exploited-within-20-hours-of-disclosure/A critical vulnerability in Langflow, a popular open-source AI workflow automation platform, has been actively exploited in the wild within just 20 hours of public disclosure—before any proof-of-concept code was even available. The Vulnerability Tracked as CVE-2026-33017 with a CSat, 21 Mar 2026 15:03:42 GMTGeneral CTIhttps://bulwarkblack.com/critical-langflow-ai-platform-flaw-cve-2026-33017-exploited-within-20-hours-of-disclosure/https://bulwarkblack.com/critical-langflow-ai-platform-flaw-cve-2026-33017-exploited-within-20-hours-of-disclosure/A critical vulnerability in Langflow, the popular open-source AI workflow platform, has been actively exploited within just 20 hours of its public disclosure—before any proof-of-concept code was even available. The rapid weaponization highlights the shrinking window defenders havSat, 21 Mar 2026 01:04:06 GMTAI (General)https://bulwarkblack.com/cve-2026-3564-critical-screenconnect-flaw-enables-session-hijacking-through-asp-net-machine-key-abuse/https://bulwarkblack.com/cve-2026-3564-critical-screenconnect-flaw-enables-session-hijacking-through-asp-net-machine-key-abuse/ConnectWise has released an emergency patch for a critical vulnerability (CVE-2026-3564) in its ScreenConnect remote access platform that could allow unauthenticated attackers to hijack legitimate sessions by forging authentication credentials using extracted ASP.NET machine keysFri, 20 Mar 2026 20:02:25 GMTGeneral CTIhttps://bulwarkblack.com/interlock-ransomware-exploited-cisco-fmc-zero-day-for-six-weeks-before-patch-amazon-reveals-full-attack-chain/https://bulwarkblack.com/interlock-ransomware-exploited-cisco-fmc-zero-day-for-six-weeks-before-patch-amazon-reveals-full-attack-chain/Amazon Threat Intelligence has revealed that the Interlock ransomware group exploited CVE-2026-20131—a critical CVSS 10.0 vulnerability in Cisco Secure Firewall Management Center—as a zero-day since January 26, 2026, more than five weeks before Cisco publicly disclosed the flaw oFri, 20 Mar 2026 15:02:54 GMTGeneral CTIhttps://bulwarkblack.com/9-critical-ip-kvm-flaws-enable-unauthenticated-root-access-across-four-vendors/https://bulwarkblack.com/9-critical-ip-kvm-flaws-enable-unauthenticated-root-access-across-four-vendors/Low-cost IP KVM devices—designed to provide remote keyboard, video, and mouse access to physical systems—are introducing catastrophic security risks into enterprise environments. New research from Eclypsium reveals nine vulnerabilities affecting products from GL-iNet, Angeet/YeesFri, 20 Mar 2026 01:03:12 GMTGeneral CTIhttps://bulwarkblack.com/54-edr-killers-exploit-34-vulnerable-signed-drivers-to-disable-security-before-ransomware-deployment/https://bulwarkblack.com/54-edr-killers-exploit-34-vulnerable-signed-drivers-to-disable-security-before-ransomware-deployment/A comprehensive analysis by ESET has uncovered a thriving ecosystem of endpoint detection and response (EDR) killer tools, revealing that 54 of these specialized programs abuse 34 vulnerable signed drivers to neutralize security software before ransomware attacks. The BYOVD ThreaThu, 19 Mar 2026 20:02:34 GMTGeneral CTIhttps://bulwarkblack.com/leaknet-ransomware-scales-operations-with-clickfix-lures-and-stealthy-deno-based-fileless-loader/https://bulwarkblack.com/leaknet-ransomware-scales-operations-with-clickfix-lures-and-stealthy-deno-based-fileless-loader/The LeakNet ransomware group is rapidly scaling its operations with two dangerous innovations: a social engineering technique called ClickFix and a previously unreported fileless loader built on the legitimate Deno JavaScript runtime. According to ReliaQuest research, LeakNet hasThu, 19 Mar 2026 15:02:41 GMTMalwarehttps://bulwarkblack.com/rapid7-2026-global-threat-landscape-report-exploited-vulnerabilities-surge-105-as-attack-timelines-collapse/https://bulwarkblack.com/rapid7-2026-global-threat-landscape-report-exploited-vulnerabilities-surge-105-as-attack-timelines-collapse/Rapid7 has released its 2026 Global Threat Landscape Report, revealing a dramatic acceleration in cyber attack patterns that leaves organizations with shrinking windows to respond to emerging threats. The research demonstrates that the predictive lead time defenders once relied uThu, 19 Mar 2026 01:03:01 GMTGeneral CTIhttps://bulwarkblack.com/cisa-adds-wing-ftp-server-information-disclosure-flaw-to-kev-catalog-amid-active-exploitation/https://bulwarkblack.com/cisa-adds-wing-ftp-server-information-disclosure-flaw-to-kev-catalog-amid-active-exploitation/The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a medium-severity vulnerability in Wing FTP Server to its Known Exploited Vulnerabilities (KEV) catalog on March 16, 2026, confirming that attackers are actively exploiting the flaw in real-world attacks. Wed, 18 Mar 2026 20:03:10 GMTGeneral CTIhttps://bulwarkblack.com/iranian-cyber-threat-evolution-from-mbr-wipers-to-identity-weaponization/https://bulwarkblack.com/iranian-cyber-threat-evolution-from-mbr-wipers-to-identity-weaponization/A comprehensive analysis by Unit 42 reveals a fundamental shift in Iranian cyber operations: state-aligned threat actors are abandoning custom malware in favor of weaponizing enterprise administrative tools to achieve unprecedented scale and stealth. The Strategic Shift During reWed, 18 Mar 2026 01:04:49 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/glassworm-supply-chain-campaign-hijacks-72-open-vsx-extensions-to-target-developers/https://bulwarkblack.com/glassworm-supply-chain-campaign-hijacks-72-open-vsx-extensions-to-target-developers/Threat actors are abusing Visual Studio Code extension dependencies in the Open VSX registry to distribute the GlassWorm malware loader through 72 malicious extensions targeting developers.Tue, 17 Mar 2026 20:03:14 GMTMalwarehttps://bulwarkblack.com/glassworm-forcememo-campaign-stolen-github-tokens-used-to-inject-malware-into-hundreds-of-python-repositories/https://bulwarkblack.com/glassworm-forcememo-campaign-stolen-github-tokens-used-to-inject-malware-into-hundreds-of-python-repositories/A sophisticated supply chain attack dubbed ForceMemo is leveraging stolen GitHub tokens to inject malware into hundreds of Python repositories, marking a dangerous escalation in the ongoing GlassWorm campaign targeting software developers. The Attack Chain According to StepSecuriTue, 17 Mar 2026 01:02:21 GMTMalwarehttps://bulwarkblack.com/iranian-threat-actors-target-hikvision-and-dahua-ip-cameras-for-kinetic-strike-coordination/https://bulwarkblack.com/iranian-threat-actors-target-hikvision-and-dahua-ip-cameras-for-kinetic-strike-coordination/As Iran-Israel-US military operations escalate in the Middle East, Check Point Research and Tenable have identified a significant surge in Iranian threat actors targeting IP cameras manufactured by Hikvision and Dahua. The activity, which began spiking on February 28, 2026, coincMon, 16 Mar 2026 20:02:50 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/critical-veeam-backup-vulnerabilities-draw-ransomware-group-attention-seven-cvss-9-9-flaws-patched/https://bulwarkblack.com/critical-veeam-backup-vulnerabilities-draw-ransomware-group-attention-seven-cvss-9-9-flaws-patched/Veeam has released emergency patches for seven severe vulnerabilities in its flagship Backup & Replication platform, several scoring CVSS 9.9 — the highest possible criticality rating. The flaws enable remote code execution (RCE), privilege escalation, and credential theft by autMon, 16 Mar 2026 15:02:56 GMTGeneral CTIhttps://bulwarkblack.com/the-promptware-kill-chain-a-new-framework-for-understanding-ai-malware-attacks/https://bulwarkblack.com/the-promptware-kill-chain-a-new-framework-for-understanding-ai-malware-attacks/A groundbreaking research paper by Bruce Schneier and collaborators introduces the concept of “promptware”—a distinct class of malware targeting large language models (LLMs). Moving beyond the myopic focus on prompt injection, the researchers propose a structured seven-step kill Mon, 16 Mar 2026 01:02:15 GMTAI (General)https://bulwarkblack.com/operation-lightning-global-takedown-of-socksescort-botnet-that-enslaved-369000-routers-in-163-countries/https://bulwarkblack.com/operation-lightning-global-takedown-of-socksescort-botnet-that-enslaved-369000-routers-in-163-countries/A coordinated international law enforcement operation has dismantled SocksEscort, a criminal proxy service that infected hundreds of thousands of residential routers worldwide to enable large-scale fraud, ransomware distribution, and other cybercrimes. The Scope of the Threat AccSun, 15 Mar 2026 20:02:26 GMTGeneral CTIhttps://bulwarkblack.com/google-patches-two-chrome-zero-days-under-active-exploitation-cve-2026-3909-and-cve-2026-3910/https://bulwarkblack.com/google-patches-two-chrome-zero-days-under-active-exploitation-cve-2026-3909-and-cve-2026-3910/Google has released emergency security updates to patch two high-severity Chrome vulnerabilities being actively exploited in zero-day attacks, affecting an estimated 3.5 billion users worldwide. “Google is aware that exploits for both CVE-2026-3909 & CVE-2026-3910 exist in the wiSun, 15 Mar 2026 15:01:59 GMTGeneral CTIhttps://bulwarkblack.com/operation-synergia-iii-global-crackdown-takes-down-45000-malicious-ips-and-arrests-94-cybercriminals/https://bulwarkblack.com/operation-synergia-iii-global-crackdown-takes-down-45000-malicious-ips-and-arrests-94-cybercriminals/In one of the most significant international cybercrime operations to date, INTERPOL has announced the successful conclusion of Operation Synergia III—a coordinated global effort that dismantled critical infrastructure supporting phishing, malware, and ransomware campaigns worldwSun, 15 Mar 2026 01:01:59 GMTGeneral CTIhttps://bulwarkblack.com/shinyhunters-claims-1-petabyte-data-theft-from-telus-digital-in-multi-month-bpo-breach/https://bulwarkblack.com/shinyhunters-claims-1-petabyte-data-theft-from-telus-digital-in-multi-month-bpo-breach/Business process outsourcing (BPO) giant Telus Digital has confirmed a major cybersecurity incident after the notorious ShinyHunters extortion group claimed to have stolen nearly one petabyte of data from the company and its customers. The breach, which involved unauthorized acceSat, 14 Mar 2026 20:02:10 GMTGeneral CTIhttps://bulwarkblack.com/google-patches-two-chrome-zero-days-actively-exploited-in-the-wild-cisa-adds-to-kev-catalog/https://bulwarkblack.com/google-patches-two-chrome-zero-days-actively-exploited-in-the-wild-cisa-adds-to-kev-catalog/Google has released emergency security updates to address two high-severity vulnerabilities in Chrome that are being actively exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both flaws to its Known Exploited Vulnerabilities (KEV) Sat, 14 Mar 2026 15:03:09 GMTGeneral CTIhttps://bulwarkblack.com/pro-iranian-hackers-expand-targeting-of-us-critical-infrastructure-as-cyber-chaos-escalates/https://bulwarkblack.com/pro-iranian-hackers-expand-targeting-of-us-critical-infrastructure-as-cyber-chaos-escalates/Pro-Iranian hackers are expanding their operations beyond the Middle East and increasingly targeting critical infrastructure in the United States, according to cybersecurity experts and recent incidents. The attacks represent a significant escalation in Iran’s cyber warfare capabSat, 14 Mar 2026 01:04:19 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/google-patches-two-actively-exploited-chrome-zero-days-cve-2026-3909-and-cve-2026-3910/https://bulwarkblack.com/google-patches-two-actively-exploited-chrome-zero-days-cve-2026-3909-and-cve-2026-3910/Google has released emergency security updates to fix two high-severity vulnerabilities in Chrome that are being actively exploited in the wild. These are the second and third Chrome zero-days patched in 2026, highlighting the continued targeting of browser vulnerabilities by thrFri, 13 Mar 2026 20:02:10 GMTBusinesshttps://bulwarkblack.com/storm-2561-weaponizes-seo-poisoning-to-deploy-trojanized-vpn-clients-and-steal-enterprise-credentials/https://bulwarkblack.com/storm-2561-weaponizes-seo-poisoning-to-deploy-trojanized-vpn-clients-and-steal-enterprise-credentials/Microsoft Defender Experts have uncovered a sophisticated credential theft campaign orchestrated by the financially motivated threat actor Storm-2561. The campaign exploits search engine optimization (SEO) poisoning to redirect enterprise users searching for legitimate VPN softwaFri, 13 Mar 2026 15:03:49 GMTThreat Intelligencehttps://bulwarkblack.com/infostealer-infection-unmasks-dprk-operative-behind-polyfill-io-supply-chain-attack-and-us-crypto-exchange-infiltration/https://bulwarkblack.com/infostealer-infection-unmasks-dprk-operative-behind-polyfill-io-supply-chain-attack-and-us-crypto-exchange-infiltration/In a stunning example of operational security failure, a North Korean cyber operative was unmasked after infecting their own machine with a LummaC2 infostealer—revealing definitive evidence linking them to both the catastrophic Polyfill.io supply chain attack and deep infiltratioThu, 12 Mar 2026 15:06:48 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/kadnap-botnet-hijacks-14000-asus-routers-using-novel-kademlia-dht-protocol-for-stealth-c2/https://bulwarkblack.com/kadnap-botnet-hijacks-14000-asus-routers-using-novel-kademlia-dht-protocol-for-stealth-c2/A newly discovered botnet called KadNap is turning ASUS routers and edge networking devices into covert proxies for cybercriminal operations. Since August 2025, the malware has infected over 14,000 devices across the globe, with researchers from Black Lotus Labs (Lumen TechnologiThu, 12 Mar 2026 01:03:24 GMTMalwarehttps://bulwarkblack.com/iranian-handala-hacktivists-deploy-wiper-malware-against-medical-device-giant-stryker/https://bulwarkblack.com/iranian-handala-hacktivists-deploy-wiper-malware-against-medical-device-giant-stryker/Iran-linked hacktivist group Handala has claimed responsibility for a devastating wiper malware attack against Stryker Corporation, a Fortune 500 medical technology company with over 53,000 employees and $22.6 billion in annual sales. Attack Scale and Impact According to Handala’Wed, 11 Mar 2026 20:04:02 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/fortigate-devices-exploited-as-network-entry-points-for-service-account-credential-theft/https://bulwarkblack.com/fortigate-devices-exploited-as-network-entry-points-for-service-account-credential-theft/Cybersecurity researchers have uncovered a sophisticated campaign where threat actors are weaponizing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks. The activity, documented by SentinelOne, targets healthcare, government, and managWed, 11 Mar 2026 15:03:04 GMTGeneral CTIhttps://bulwarkblack.com/iranian-mois-cyber-actors-embrace-criminal-ecosystem-from-rhadamanthys-to-ransomware-affiliates/https://bulwarkblack.com/iranian-mois-cyber-actors-embrace-criminal-ecosystem-from-rhadamanthys-to-ransomware-affiliates/A new Check Point Research report reveals that Iranian Ministry of Intelligence and Security (MOIS)-linked threat actors are increasingly engaging with the cybercrime ecosystem, moving beyond mere imitation to directly leveraging criminal tools, services, and affiliate-style relaWed, 11 Mar 2026 01:03:08 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/blacksanta-edr-killer-campaign-targets-hr-departments-through-weaponized-resume-files/https://bulwarkblack.com/blacksanta-edr-killer-campaign-targets-hr-departments-through-weaponized-resume-files/A year-long malware campaign targets HR departments through weaponized resume files, deploying the previously undocumented BlackSanta EDR killer that disables endpoint security tools at the kernel level.Tue, 10 Mar 2026 20:03:51 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/seedworm-apt-deploys-dindoor-and-fakeset-backdoors-inside-us-critical-infrastructure-networks/https://bulwarkblack.com/seedworm-apt-deploys-dindoor-and-fakeset-backdoors-inside-us-critical-infrastructure-networks/Iran’s Seedworm APT group (also known as MuddyWater) has established persistent access inside the networks of multiple US organizations since early February 2026, deploying two previously unknown malware implants as geopolitical tensions between the US and Iran escalate. New BackTue, 10 Mar 2026 15:04:00 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/60-pro-iranian-hacktivist-groups-activate-ai-enabled-ics-attacks-following-us-israel-strikes/https://bulwarkblack.com/60-pro-iranian-hacktivist-groups-activate-ai-enabled-ics-attacks-following-us-israel-strikes/In the largest single-event activation of Iranian-aligned cyber actors ever documented, more than 60 pro-Iranian hacktivist groups became active on Telegram within hours of the February 28 US-Israel military strikes on Iran. Armed with AI tools and targeting over 40,000 internet-Tue, 10 Mar 2026 01:03:06 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/iranian-cyber-threats-intensify-apt-groups-and-hacktivists-target-u-s-and-allied-infrastructure/https://bulwarkblack.com/iranian-cyber-threats-intensify-apt-groups-and-hacktivists-target-u-s-and-allied-infrastructure/Executive Summary As hostilities between Iran and the U.S./Israeli-led coalition escalate, threat intelligence indicates Iranian-aligned cyber actors pose an elevated near-term risk to organizations across North America and allied nations. These actors have a well-documented histMon, 09 Mar 2026 20:04:18 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/seedworm-apt-targets-us-banks-and-airports-with-new-dindoor-and-fakeset-backdoors/https://bulwarkblack.com/seedworm-apt-targets-us-banks-and-airports-with-new-dindoor-and-fakeset-backdoors/Iranian state-sponsored hackers have maintained persistent access inside multiple US critical infrastructure networks since early February 2026, establishing footholds that security researchers warn could enable devastating attacks amid escalating geopolitical tensions in the MidMon, 09 Mar 2026 15:03:33 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/boryptgrab-stealer-spreads-through-100-fake-github-repositories-in-massive-malware-campaign/https://bulwarkblack.com/boryptgrab-stealer-spreads-through-100-fake-github-repositories-in-massive-malware-campaign/Trend Micro researchers have uncovered a large-scale malware distribution campaign using over 100 GitHub repositories to spread BoryptGrab, an information stealer that targets browser credentials, cryptocurrency wallets, and sensitive files while deploying reverse SSH backdoors fMon, 09 Mar 2026 01:03:51 GMTMalwarehttps://bulwarkblack.com/boryptgrab-stealer-spreads-through-100-malicious-github-repositories/https://bulwarkblack.com/boryptgrab-stealer-spreads-through-100-malicious-github-repositories/A massive malware distribution campaign has been discovered leveraging more than 100 GitHub repositories to spread the BoryptGrab information stealer. According to Trend Micro research, the campaign targets Windows users through deceptive downloads masquerading as legitimate softSun, 08 Mar 2026 20:03:35 GMTMalwarehttps://bulwarkblack.com/russian-apt-deploys-cat-themed-badpaw-and-meowmeow-malware-to-target-ukraine/https://bulwarkblack.com/russian-apt-deploys-cat-themed-badpaw-and-meowmeow-malware-to-target-ukraine/Security researchers from ClearSky have uncovered a sophisticated Russian cyber campaign targeting Ukrainian organizations using two previously unknown malware strains with distinctly playful names: BadPaw and MeowMeow. Despite their whimsical naming, these tools represent a seriSun, 08 Mar 2026 15:04:29 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/velvet-tempest-ransomware-group-deploys-castlerat-via-clickfix-attacks-linked-to-termite-operations/https://bulwarkblack.com/velvet-tempest-ransomware-group-deploys-castlerat-via-clickfix-attacks-linked-to-termite-operations/Five-Year Ransomware Affiliate Uses Malvertising and Legitimate Windows Tools in Sophisticated Intrusion Security researchers at MalBeacon have exposed a 12-day intrusion campaign by Velvet Tempest (also tracked as DEV-0504), a prolific ransomware affiliate group now deploying thSun, 08 Mar 2026 02:05:29 GMTProjectshttps://bulwarkblack.com/apt36-vibeware-campaign-pakistans-transparent-tribe-weaponizes-ai-to-mass-produce-malware-targeting-india/https://bulwarkblack.com/apt36-vibeware-campaign-pakistans-transparent-tribe-weaponizes-ai-to-mass-produce-malware-targeting-india/Pakistan-aligned threat actor Transparent Tribe (APT36) has embraced AI-assisted malware development to flood Indian government networks with disposable, polyglot implants—a technique security researchers are calling “vibeware” or Distributed Denial of Detection (DDoD). AI-PowereSat, 07 Mar 2026 21:06:54 GMTGlobal Cyber Threat Intelligencehttps://bulwarkblack.com/sap-netweaver-critical-zero-day-cve-2025-31324-under-active-exploitation-by-initial-access-brokers/https://bulwarkblack.com/sap-netweaver-critical-zero-day-cve-2025-31324-under-active-exploitation-by-initial-access-brokers/SAP customers are being urged to immediately patch a critical zero-day vulnerability in the Visual Composer component of SAP NetWeaver application server that threat actors are actively exploiting to deploy web shell backdoors. The Vulnerability Tracked as CVE-2025-31324, this unSat, 07 Mar 2026 16:02:17 GMTGeneral CTIhttps://bulwarkblack.com/voidgeist-multi-stage-malware-campaign-uses-python-loaders-and-apc-injection-to-deploy-xworm-asyncrat-and-xeno-rat/https://bulwarkblack.com/voidgeist-multi-stage-malware-campaign-uses-python-loaders-and-apc-injection-to-deploy-xworm-asyncrat-and-xeno-rat/Security researchers at Securonix have uncovered a sophisticated multi-stage malware campaign dubbed VOID#GEIST that delivers three separate remote access trojans (RATs) through an elaborate infection chain designed to evade detection. A Modular Attack Framework Unlike traditionaSat, 07 Mar 2026 02:03:33 GMTMalwarehttps://bulwarkblack.com/google-disrupts-chinese-apt-unc2814s-gridtide-backdoor-campaign-targeting-42-countries/https://bulwarkblack.com/google-disrupts-chinese-apt-unc2814s-gridtide-backdoor-campaign-targeting-42-countries/Google Threat Intelligence Group (GTIG) has disrupted a massive global cyber espionage campaign targeting telecommunications and government organizations across 42 countries. The threat actor, tracked as UNC2814, is a suspected People’s Republic of China (PRC)-nexus cyber espionaFri, 06 Mar 2026 21:04:07 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/pakistans-apt36-floods-indian-government-networks-with-ai-generated-vibeware-malware/https://bulwarkblack.com/pakistans-apt36-floods-indian-government-networks-with-ai-generated-vibeware-malware/A Pakistan-linked threat group is overwhelming Indian government networks with a new breed of disposable, AI-generated malware in a campaign that marks a concerning shift in the digital conflict between the two nations. According to research from Bitdefender, the threat actor APTFri, 06 Mar 2026 16:02:33 GMTGlobal Cyber Threat Intelligencehttps://bulwarkblack.com/google-and-mandiant-disrupt-gridtide-chinese-apt-espionage-campaign-compromises-53-victims-in-42-countries/https://bulwarkblack.com/google-and-mandiant-disrupt-gridtide-chinese-apt-espionage-campaign-compromises-53-victims-in-42-countries/Google Threat Intelligence Group (GTIG) and Mandiant have executed a coordinated takedown of one of the most expansive cyber espionage campaigns in recent memory. The operation targeted UNC2814, a suspected People’s Republic of China (PRC)-nexus threat actor that has operated gloFri, 06 Mar 2026 02:03:44 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/coruna-ios-exploit-kit-nation-state-spyware-tools-now-targeting-crypto-wallet-users/https://bulwarkblack.com/coruna-ios-exploit-kit-nation-state-spyware-tools-now-targeting-crypto-wallet-users/A powerful iOS exploit kit named “Coruna” has transitioned from elite surveillance operations to financially motivated cryptocurrency theft, signaling a dangerous shift in the mobile threat landscape. From Spyware Vendor to Cybercriminal Hands Google Threat Intelligence Group (GTThu, 05 Mar 2026 21:03:49 GMTGeneral CTIhttps://bulwarkblack.com/uat-9244-china-nexus-apt-deploys-three-new-malware-implants-against-south-american-telecom-providers/https://bulwarkblack.com/uat-9244-china-nexus-apt-deploys-three-new-malware-implants-against-south-american-telecom-providers/Cisco Talos has disclosed a new threat activity cluster, UAT-9244, assessed with high confidence to be a China-nexus advanced persistent threat (APT) actor closely associated with FamousSparrow and Tropic Trooper. Since 2024, the group has targeted critical telecommunications infThu, 05 Mar 2026 16:02:33 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/global-coalition-dismantles-tycoon-2fa-phishing-platform-87-million-emails-330-domains-seized/https://bulwarkblack.com/global-coalition-dismantles-tycoon-2fa-phishing-platform-87-million-emails-330-domains-seized/Microsoft, Europol, and a coalition of cybersecurity partners have dismantled Tycoon 2FA, one of the most prolific phishing-as-a-service (PhaaS) platforms ever documented, seizing 330 domains used for credential theft and multi-factor authentication bypass. The coordinated takedoThu, 05 Mar 2026 02:03:33 GMTGeneral CTIhttps://bulwarkblack.com/cisco-patches-two-max-severity-secure-fmc-flaws-enabling-root-access/https://bulwarkblack.com/cisco-patches-two-max-severity-secure-fmc-flaws-enabling-root-access/Cisco has released critical security updates to address two maximum-severity vulnerabilities in its Secure Firewall Management Center (FMC) software that could allow unauthenticated remote attackers to gain complete root access to affected systems. Critical Vulnerabilities OverviWed, 04 Mar 2026 21:03:05 GMTGeneral CTIhttps://bulwarkblack.com/open-source-cyberstrikeai-tool-weaponized-in-ai-driven-fortigate-attacks-across-55-countries/https://bulwarkblack.com/open-source-cyberstrikeai-tool-weaponized-in-ai-driven-fortigate-attacks-across-55-countries/Team Cymru has revealed that threat actors behind the recent AI-assisted campaign targeting Fortinet FortiGate appliances leveraged an open-source, AI-native security testing platform called CyberStrikeAI to execute mass automated attacks, compromising over 600 devices across 55 Wed, 04 Mar 2026 16:03:59 GMTThreat Intelligencehttps://bulwarkblack.com/zerobot-malware-targets-n8n-automation-platform-first-active-exploitation-of-cve-2025-68613/https://bulwarkblack.com/zerobot-malware-targets-n8n-automation-platform-first-active-exploitation-of-cve-2025-68613/Akamai SIRT discovers Zerobot botnet actively exploiting CVE-2025-68613 in n8n workflow automation platform, marking a shift from traditional IoT targeting to enterprise infrastructure.Wed, 04 Mar 2026 02:04:39 GMTMalwarehttps://bulwarkblack.com/silver-dragon-apt-targets-southeast-asia-and-europe-using-geardoor-backdoor-with-google-drive-c2/https://bulwarkblack.com/silver-dragon-apt-targets-southeast-asia-and-europe-using-geardoor-backdoor-with-google-drive-c2/Check Point Research has unveiled a sophisticated Chinese APT campaign dubbed Silver Dragon that has been actively targeting government entities and organizations across Southeast Asia and Europe since mid-2024. The threat actor operates within the umbrella of Chinese-nexus APT41Tue, 03 Mar 2026 21:03:12 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/apt28-exploited-cve-2026-21513-mshtml-zero-day-as-attack-vector-before-february-patch-tuesday/https://bulwarkblack.com/apt28-exploited-cve-2026-21513-mshtml-zero-day-as-attack-vector-before-february-patch-tuesday/Russia’s state-sponsored threat actor APT28 (also known as Fancy Bear) has been linked to active exploitation of CVE-2026-21513, a high-severity MSHTML zero-day vulnerability, before Microsoft released its patch in February 2026. This finding comes from new research published by Tue, 03 Mar 2026 16:03:32 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/malicious-go-crypto-module-steals-passwords-and-deploys-rekoobe-backdoor/https://bulwarkblack.com/malicious-go-crypto-module-steals-passwords-and-deploys-rekoobe-backdoor/A sophisticated supply chain attack has been uncovered targeting Go developers through a malicious module that impersonates the legitimate golang.org/x/crypto library. The attack demonstrates how threat actors are increasingly exploiting namespace confusion to compromise developeTue, 03 Mar 2026 02:03:31 GMTMalwarehttps://bulwarkblack.com/fake-google-security-check-transforms-browser-into-surveillance-toolkit-via-pwa-installation/https://bulwarkblack.com/fake-google-security-check-transforms-browser-into-surveillance-toolkit-via-pwa-installation/A sophisticated phishing campaign has been discovered that transforms web browsers into comprehensive surveillance platforms by masquerading as a Google Account security page. According to Malwarebytes researchers, this attack represents one of the most fully-featured browser-basMon, 02 Mar 2026 21:04:42 GMTGeneral CTIhttps://bulwarkblack.com/russian-cyberattacks-shift-to-intelligence-gathering-for-missile-strike-guidance-on-ukraine-power-grid/https://bulwarkblack.com/russian-cyberattacks-shift-to-intelligence-gathering-for-missile-strike-guidance-on-ukraine-power-grid/Russian cyberattacks targeting Ukraine’s energy infrastructure have shifted focus from immediate disruption to intelligence gathering for guiding missile strikes, Ukrainian cybersecurity officials revealed at the Kyiv International Cyber Resilience Forum. Strategic Shift in AttacMon, 02 Mar 2026 02:03:27 GMTOperational Technology (OT)https://bulwarkblack.com/hackers-weaponize-claude-code-ai-to-steal-150gb-from-mexican-government-in-month-long-campaign/https://bulwarkblack.com/hackers-weaponize-claude-code-ai-to-steal-150gb-from-mexican-government-in-month-long-campaign/In a disturbing escalation of AI-enabled cyber operations, hackers have weaponized Anthropic’s Claude Code AI assistant to develop exploits, create custom attack tools, and systematically exfiltrate more than 150GB of data from Mexican government systems, according to Israeli cybSun, 01 Mar 2026 16:03:56 GMTGeneral CTIhttps://bulwarkblack.com/google-disrupts-unc2814-gridtide-campaign-chinese-apt-breaches-53-organizations-across-42-countries/https://bulwarkblack.com/google-disrupts-unc2814-gridtide-campaign-chinese-apt-breaches-53-organizations-across-42-countries/Google has disclosed details of a massive disruption operation against UNC2814, a suspected China-nexus cyber espionage group that breached at least 53 organizations across 42 countries. The campaign, tracked as GRIDTIDE, represents one of the most far-reaching espionage operatioSun, 01 Mar 2026 02:03:39 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/openai-confirms-chatgpt-exploited-by-chinese-and-russian-threat-actors-for-cyberattacks/https://bulwarkblack.com/openai-confirms-chatgpt-exploited-by-chinese-and-russian-threat-actors-for-cyberattacks/OpenAI has confirmed that Chinese and Russian state-affiliated threat actors have been exploiting ChatGPT to support malicious cyber and influence operations, marking one of the first documented cases of adversaries weaponizing generative AI for tactical offensive cyber activitieSat, 28 Feb 2026 21:04:02 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/operation-roar-of-the-lion-israel-executes-largest-cyberattack-in-history-against-iran/https://bulwarkblack.com/operation-roar-of-the-lion-israel-executes-largest-cyberattack-in-history-against-iran/In an unprecedented display of cyber warfare capability, Israel has executed what is being described as the largest cyberattack in history, plunging Iran into near-total digital darkness during a coordinated military operation on Saturday, February 28, 2026. Near-Total Internet BSat, 28 Feb 2026 16:01:55 GMTGeneral CTIhttps://bulwarkblack.com/steaelite-rat-bundles-ransomware-and-data-theft-in-single-web-panel-for-double-extortion-attacks/https://bulwarkblack.com/steaelite-rat-bundles-ransomware-and-data-theft-in-single-web-panel-for-double-extortion-attacks/A dangerous new remote access trojan called Steaelite RAT has emerged on cybercrime forums, offering attackers a unified platform for executing double extortion attacks with unprecedented efficiency. Unlike traditional attack chains that require separate tools for data theft and Sat, 28 Feb 2026 02:03:05 GMTThreat Intelligencehttps://bulwarkblack.com/apt37-ruby-jumper-campaign-north-korean-hackers-deploy-malware-arsenal-to-bridge-air-gapped-networks/https://bulwarkblack.com/apt37-ruby-jumper-campaign-north-korean-hackers-deploy-malware-arsenal-to-bridge-air-gapped-networks/Zscaler ThreatLabz has uncovered a sophisticated campaign by North Korean threat group APT37, introducing five new malware tools designed specifically to infiltrate and exfiltrate data from air-gapped systems through weaponized USB drives. Campaign Overview In December 2025, secuFri, 27 Feb 2026 21:03:11 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/uac-0050-targets-european-financial-institution-in-strategic-phishing-campaign/https://bulwarkblack.com/uac-0050-targets-european-financial-institution-in-strategic-phishing-campaign/Russia-aligned threat actor UAC-0050 has expanded operations beyond Ukraine, targeting a European financial institution involved in reconstruction efforts with a sophisticated multi-stage spear-phishing attack. Campaign Overview Security researchers at BlueVoyant have uncovered aFri, 27 Feb 2026 16:03:13 GMTThreat Intelligencehttps://bulwarkblack.com/chinese-apt-campaign-delivers-plugx-rat-via-g-data-antivirus-dll-side-loading/https://bulwarkblack.com/chinese-apt-campaign-delivers-plugx-rat-via-g-data-antivirus-dll-side-loading/A sophisticated Chinese-aligned threat campaign has been observed delivering the PlugX Remote Access Trojan (RAT) through a clever abuse of legitimate G DATA antivirus components, according to new research from LAB52. The Attack Chain The infection begins with a spear-phishing emFri, 27 Feb 2026 02:05:17 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/apt37-deploys-ruby-jumper-campaign-to-breach-air-gapped-networks/https://bulwarkblack.com/apt37-deploys-ruby-jumper-campaign-to-breach-air-gapped-networks/North Korean threat actor APT37 (Reaper) has expanded its arsenal with sophisticated new malware designed to compromise air-gapped networks — systems physically isolated from the internet that organizations use to protect their most sensitive data. Researchers at Zscaler ThreatLaThu, 26 Feb 2026 21:01:38 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/darkcloud-infostealer-emerges-as-major-enterprise-threat-30-malware-delivers-scalable-credential-theft/https://bulwarkblack.com/darkcloud-infostealer-emerges-as-major-enterprise-threat-30-malware-delivers-scalable-credential-theft/The cybersecurity threat landscape is facing a growing challenge as infostealers continue to dominate the initial access ecosystem in 2026. Among the latest threats drawing serious attention is DarkCloud, a commercially available credential-harvesting malware that proves even lowThu, 26 Feb 2026 16:02:42 GMTMalwarehttps://bulwarkblack.com/diesel-vortex-russian-cybercrime-group-steals-1600-credentials-from-global-logistics-sector/https://bulwarkblack.com/diesel-vortex-russian-cybercrime-group-steals-1600-credentials-from-global-logistics-sector/A Russian-linked cybercrime group dubbed Diesel Vortex has been systematically targeting the global freight and logistics industry, stealing over 1,600 unique login credentials from users of major logistics platforms in a sophisticated phishing campaign that ran from September 20Thu, 26 Feb 2026 02:04:05 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/cisco-talos-exposes-three-year-campaign-uat-8616-exploits-sd-wan-zero-day-for-critical-infrastructure-access/https://bulwarkblack.com/cisco-talos-exposes-three-year-campaign-uat-8616-exploits-sd-wan-zero-day-for-critical-infrastructure-access/Cisco Talos has disclosed the active exploitation of CVE-2026-20127, a critical zero-day vulnerability in Cisco Catalyst SD-WAN Controller (formerly vSmart), by a highly sophisticated threat actor tracked as UAT-8616. The campaign, which dates back at least three years, targets cWed, 25 Feb 2026 21:03:36 GMTGeneral CTIhttps://bulwarkblack.com/north-korean-lazarus-group-adopts-medusa-ransomware-in-global-extortion-campaign/https://bulwarkblack.com/north-korean-lazarus-group-adopts-medusa-ransomware-in-global-extortion-campaign/North Korean cyber operations are crossing a significant threshold into commercial ransomware markets, demonstrating an intensified focus on direct financial gains. Recent intelligence from Symantec and Carbon Black Threat Hunter Team reveals the notorious state-backed Lazarus GrWed, 25 Feb 2026 16:04:45 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/apt31s-multi-year-cyber-espionage-campaign-against-czech-ministry-of-foreign-affairs/https://bulwarkblack.com/apt31s-multi-year-cyber-espionage-campaign-against-czech-ministry-of-foreign-affairs/The Czech Republic has publicly attributed a sophisticated multi-year cyber intrusion to Chinese state-sponsored group APT31 (also known as Zirconium or Judgment Panda), marking one of the most significant national attribution cases in European cyber defense history. The CampaignWed, 25 Feb 2026 02:02:30 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/apt28-deploys-operation-macromaze-webhook-based-macro-malware-targets-european-entities/https://bulwarkblack.com/apt28-deploys-operation-macromaze-webhook-based-macro-malware-targets-european-entities/Russia-linked APT28 (also known as Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) has launched a sophisticated espionage campaign targeting entities across Western and Central Europe. The operation, codenamed Operation MacroMaze by S2 Grupo’s LAB52 threatTue, 24 Feb 2026 21:05:38 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/chinese-apt-unsolicitedbooker-deploys-lucidoor-and-marssnake-backdoors-against-central-asian-telecoms/https://bulwarkblack.com/chinese-apt-unsolicitedbooker-deploys-lucidoor-and-marssnake-backdoors-against-central-asian-telecoms/A China-aligned threat actor known as UnsolicitedBooker has expanded its targeting to telecommunications companies in Kyrgyzstan and Tajikistan, deploying two sophisticated backdoors—LuciDoor and MarsSnake—in a series of espionage campaigns documented by Positive Technologies resTue, 24 Feb 2026 16:03:09 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/ai-augmented-attack-russian-speaking-cybercriminals-compromise-600-fortigate-firewalls/https://bulwarkblack.com/ai-augmented-attack-russian-speaking-cybercriminals-compromise-600-fortigate-firewalls/A Russian-speaking cybercrime group has compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, leveraging off-the-shelf generative AI tools to automate and scale their operations, according to a new incident report from AWS. AttacTue, 24 Feb 2026 02:02:45 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/apt28-targets-european-entities-with-operation-macromaze-webhook-malware-campaign/https://bulwarkblack.com/apt28-targets-european-entities-with-operation-macromaze-webhook-malware-campaign/Russia’s notorious state-sponsored threat actor APT28 (also known as Fancy Bear) has been attributed to a sophisticated new campaign targeting organizations across Western and Central Europe. According to S2 Grupo’s LAB52 threat intelligence team, the campaign—codenamed OperationMon, 23 Feb 2026 21:01:39 GMTGeneral CTIhttps://bulwarkblack.com/unit-42-exposes-active-exploitation-of-beyondtrust-cve-2026-1731-with-vshell-and-sparkrat-backdoors/https://bulwarkblack.com/unit-42-exposes-active-exploitation-of-beyondtrust-cve-2026-1731-with-vshell-and-sparkrat-backdoors/Palo Alto Networks’ Unit 42 has uncovered an active exploitation campaign targeting BeyondTrust Remote Support and Privileged Remote Access appliances through CVE-2026-1731, a critical pre-authentication remote code execution vulnerability with a CVSS score of 9.9. The attacks haMon, 23 Feb 2026 16:03:10 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/chinese-apt-exploited-dell-recoverpoint-zero-day-for-18-months-before-discovery/https://bulwarkblack.com/chinese-apt-exploited-dell-recoverpoint-zero-day-for-18-months-before-discovery/A suspected China-linked cyberespionage group has been covertly exploiting a critical zero-day vulnerability in Dell’s RecoverPoint for Virtual Machines (CVE-2026-22769) since at least mid-2024, according to new research from Google’s Threat Intelligence Group (GTIG) and MandiantMon, 23 Feb 2026 02:03:18 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/remcos-rat-evolves-with-real-time-webcam-streaming-and-live-keylogging-capabilities/https://bulwarkblack.com/remcos-rat-evolves-with-real-time-webcam-streaming-and-live-keylogging-capabilities/A newly observed variant of Remcos RAT has introduced significant upgrades to its surveillance arsenal, marking a dangerous evolution in how this remote access trojan operates on compromised Windows systems. From Storage to Streaming According to Infosecurity Magazine, the updateSun, 22 Feb 2026 21:03:16 GMTMalwarehttps://bulwarkblack.com/cve-2026-20841-windows-notepad-rce-vulnerability-weaponized-with-public-poc-exploit/https://bulwarkblack.com/cve-2026-20841-windows-notepad-rce-vulnerability-weaponized-with-public-poc-exploit/A high-severity remote code execution (RCE) vulnerability in Microsoft’s modern Windows Notepad application has been patched as part of the February 2026 Patch Tuesday release—but security researchers have already published a working proof-of-concept exploit on GitHub, raising coSun, 22 Feb 2026 16:01:18 GMTThreat Intelligencehttps://bulwarkblack.com/sandwormmode-self-replicating-npm-worm-steals-dev-secrets-and-targets-ai-coding-tools/https://bulwarkblack.com/sandwormmode-self-replicating-npm-worm-steals-dev-secrets-and-targets-ai-coding-tools/A sophisticated supply chain worm dubbed SANDWORMMODE is actively targeting the npm ecosystem, compromising at least 19 malicious packages designed to steal developer credentials and CI/CD secrets while automatically spreading across repositories and workflows. Researchers at SocSat, 21 Feb 2026 21:01:37 GMTMalwarehttps://bulwarkblack.com/starkiller-new-commercial-grade-phishing-kit-bypasses-mfa-with-live-site-proxying/https://bulwarkblack.com/starkiller-new-commercial-grade-phishing-kit-bypasses-mfa-with-live-site-proxying/A newly uncovered phishing kit allows cybercriminals to steal credentials with a sophisticated toolkit that spoofs live login pages and bypasses multi-factor authentication (MFA) protections, cybersecurity analysts at Abnormal Security have warned. Dubbed Starkiller, the phishingSat, 21 Feb 2026 16:30:20 GMTThreat Intelligencehttps://bulwarkblack.com/idmerit-exposes-one-billion-personal-records-in-massive-kyc-database-leak/https://bulwarkblack.com/idmerit-exposes-one-billion-personal-records-in-massive-kyc-database-leak/Digital identity verification provider IDMerit inadvertently exposed more than one billion personal records across 26 countries after leaving a database unsecured and accessible on the public internet, according to research by Cybernews. Scale of the Exposure The exposed MongoDB Sat, 21 Feb 2026 16:03:49 GMTGeneral CTIhttps://bulwarkblack.com/facebook-malvertising-campaign-uses-fake-windows-11-pages-to-deploy-credential-stealing-malware/https://bulwarkblack.com/facebook-malvertising-campaign-uses-fake-windows-11-pages-to-deploy-credential-stealing-malware/Attackers are running a sophisticated malvertising campaign that leverages paid Facebook ads to distribute credential-stealing malware disguised as official Windows 11 updates. The campaign uses convincing fake Microsoft download pages and includes multiple technical countermeasuSat, 21 Feb 2026 02:03:27 GMTMalwarehttps://bulwarkblack.com/ai-fueled-supply-chain-attacks-surge-in-asia-pacific-group-ib-report-exposes-self-reinforcing-cybercrime-ecosystem/https://bulwarkblack.com/ai-fueled-supply-chain-attacks-surge-in-asia-pacific-group-ib-report-exposes-self-reinforcing-cybercrime-ecosystem/Supply chain cyber attacks are reshaping the threat landscape across Asia-Pacific, as criminals and state-aligned groups increasingly use trusted vendors, software components, and service providers as entry points into broader networks, according to Group-IB’s High-Tech Crime TreFri, 20 Feb 2026 21:04:20 GMTGeneral CTIhttps://bulwarkblack.com/287-chrome-extensions-caught-exfiltrating-browsing-history-from-37-4-million-users/https://bulwarkblack.com/287-chrome-extensions-caught-exfiltrating-browsing-history-from-37-4-million-users/A massive data exfiltration operation involving 287 Chrome extensions that secretly steal browsing history from approximately 37.4 million users worldwide has been uncovered by security researcher Q Continuum (alias qcontinuum1). The discovery represents roughly one percent of thFri, 20 Feb 2026 16:04:41 GMTGeneral CTIhttps://bulwarkblack.com/kimwolf-botnet-swamps-i2p-anonymity-network-in-massive-sybil-attack/https://bulwarkblack.com/kimwolf-botnet-swamps-i2p-anonymity-network-in-massive-sybil-attack/The massive Kimwolf IoT botnet has caused significant disruptions to The Invisible Internet Project (I2P), a decentralized privacy network, after botnet operators accidentally overwhelmed the system while attempting to use it for command-and-control evasion. The Attack According Fri, 20 Feb 2026 02:04:30 GMTMalwarehttps://bulwarkblack.com/russian-threat-actor-deploys-canfail-malware-against-ukrainian-organizations/https://bulwarkblack.com/russian-threat-actor-deploys-canfail-malware-against-ukrainian-organizations/Google Threat Intelligence Group (GTIG) has uncovered a new threat actor possibly affiliated with Russian intelligence services that has been systematically targeting Ukrainian organizations with a sophisticated malware strain known as CANFAIL. Target Profile The threat group hasThu, 19 Feb 2026 21:02:43 GMTMalwarehttps://bulwarkblack.com/clawhavoc-supply-chain-attack-poisons-openclaw-clawhub-with-1184-malicious-ai-agent-skills/https://bulwarkblack.com/clawhavoc-supply-chain-attack-poisons-openclaw-clawhub-with-1184-malicious-ai-agent-skills/A massive supply chain attack dubbed ClawHavoc has compromised ClawHub, the official skill marketplace for OpenClaw, an open-source AI agent platform formerly known as ClawdBot and Moltbot. Researchers have uncovered at least 1,184 malicious “Skills”—plugin-style packages that exThu, 19 Feb 2026 16:05:12 GMTMalwarehttps://bulwarkblack.com/adidas-investigates-third-party-data-breach-as-lapsus-claims-815000-records-stolen/https://bulwarkblack.com/adidas-investigates-third-party-data-breach-as-lapsus-claims-815000-records-stolen/Adidas has confirmed it is actively investigating a data breach at one of its independent licensing partners after threat actors claiming to be the Lapsus$ Group posted allegedly stolen data on BreachForums. The incident highlights the ongoing risks posed by third-party vendor reThu, 19 Feb 2026 02:04:06 GMTThreat Intelligencehttps://bulwarkblack.com/check-point-reveals-ai-assistants-can-be-weaponized-as-stealthy-c2-proxies-for-malware/https://bulwarkblack.com/check-point-reveals-ai-assistants-can-be-weaponized-as-stealthy-c2-proxies-for-malware/Security researchers at Check Point have uncovered a concerning new attack vector: threat actors can abuse AI assistants like Microsoft Copilot and xAI’s Grok to create covert command-and-control (C2) communication channels that evade traditional security tools. The proof-of-concWed, 18 Feb 2026 21:04:36 GMTGeneral CTIhttps://bulwarkblack.com/threat-actors-abuse-atlassian-jira-cloud-to-bypass-email-security-and-target-government-entities/https://bulwarkblack.com/threat-actors-abuse-atlassian-jira-cloud-to-bypass-email-security-and-target-government-entities/Trend Micro researchers have uncovered a sophisticated spam campaign that weaponizes Atlassian Jira Cloud’s trusted infrastructure to bypass traditional email security controls and target government and corporate entities worldwide. The campaign, active from late December 2025 thWed, 18 Feb 2026 16:04:31 GMTThreat Intelligencehttps://bulwarkblack.com/2026-unit-42-global-incident-response-report-attacks-now-4x-faster-with-ai-accelerated-intrusions/https://bulwarkblack.com/2026-unit-42-global-incident-response-report-attacks-now-4x-faster-with-ai-accelerated-intrusions/Palo Alto Networks’ Unit 42 has released their 2026 Global Incident Response Report, analyzing over 750 major cyber incidents across 50+ countries. The findings paint a stark picture of an evolving threat landscape where attacks are faster, broader, and harder to contain than eveWed, 18 Feb 2026 02:03:32 GMTGeneral CTIhttps://bulwarkblack.com/lockbit-5-0-ransomware-emerges-cross-platform-threat-targeting-windows-linux-and-esxi-systems/https://bulwarkblack.com/lockbit-5-0-ransomware-emerges-cross-platform-threat-targeting-windows-linux-and-esxi-systems/The Acronis Threat Research Unit (TRU) has identified a significantly enhanced version of the notorious LockBit ransomware, designated LockBit 5.0, actively being deployed in campaigns against enterprise environments. The latest variant introduces expanded cross-platform capabiliTue, 17 Feb 2026 21:03:56 GMTThreat Intelligencehttps://bulwarkblack.com/manomano-data-breach-exposes-37-8-million-customer-records-via-zendesk-third-party-compromise/https://bulwarkblack.com/manomano-data-breach-exposes-37-8-million-customer-records-via-zendesk-third-party-compromise/European home improvement marketplace ManoMano has confirmed a massive data breach affecting 37.8 million customer accounts after hackers compromised a third-party customer service provider. The breach, which surfaced on cybercriminal forum BreachForums, represents one of the larTue, 17 Feb 2026 16:04:45 GMTGeneral CTIhttps://bulwarkblack.com/nexshield-fake-ad-blocker-uses-crashfix-attack-to-deliver-modelorat-malware/https://bulwarkblack.com/nexshield-fake-ad-blocker-uses-crashfix-attack-to-deliver-modelorat-malware/Security researchers at Huntress have uncovered a sophisticated new malware campaign that weaponizes browser stability against users. The attack, dubbed CrashFix, represents an evolution of the notorious ClickFix social engineering technique—but with a dangerous twist: instead ofTue, 17 Feb 2026 02:03:31 GMTMalwarehttps://bulwarkblack.com/cve-2026-20700-apple-patches-first-zero-day-of-2026-after-extremely-sophisticated-targeted-attacks/https://bulwarkblack.com/cve-2026-20700-apple-patches-first-zero-day-of-2026-after-extremely-sophisticated-targeted-attacks/Apple has released emergency security updates to patch a zero-day vulnerability that was actively exploited in what the company describes as “extremely sophisticated” attacks targeting specific individuals. Technical Details The vulnerability, tracked as CVE-2026-20700, is an arbMon, 16 Feb 2026 21:04:09 GMTThreat Intelligencehttps://bulwarkblack.com/cve-2026-2441-google-patches-first-actively-exploited-chrome-zero-day-of-2026/https://bulwarkblack.com/cve-2026-2441-google-patches-first-actively-exploited-chrome-zero-day-of-2026/Google has released an emergency security update for Chrome to address CVE-2026-2441, a high-severity use-after-free vulnerability that is already being exploited in the wild. This marks the first actively exploited zero-day in Chrome that Google has patched in 2026, underscoringMon, 16 Feb 2026 16:03:17 GMTThreat Intelligencehttps://bulwarkblack.com/physical-mail-phishing-targets-trezor-and-ledger-users-attackers-use-qr-codes-to-steal-recovery-phrases/https://bulwarkblack.com/physical-mail-phishing-targets-trezor-and-ledger-users-attackers-use-qr-codes-to-steal-recovery-phrases/A new phishing campaign is targeting cryptocurrency hardware wallet users through an unusual vector: physical mail. Threat actors are sending fake letters impersonating Trezor and Ledger security teams, attempting to trick users into surrendering their wallet recovery phrases. ThMon, 16 Feb 2026 02:02:54 GMTSocial Engineeringhttps://bulwarkblack.com/oysterloader-sophisticated-multi-stage-malware-loader-linked-to-rhysida-ransomware-campaigns/https://bulwarkblack.com/oysterloader-sophisticated-multi-stage-malware-loader-linked-to-rhysida-ransomware-campaigns/A highly sophisticated malware loader known as OysterLoader has emerged as a significant cybersecurity threat, employing advanced multi-layer obfuscation techniques to evade detection while delivering dangerous payloads including Rhysida ransomware and the widespread Vidar infostSun, 15 Feb 2026 21:02:59 GMTMalwarehttps://bulwarkblack.com/microsoft-exposes-dns-based-clickfix-attack-nslookup-commands-used-for-stealth-malware-staging/https://bulwarkblack.com/microsoft-exposes-dns-based-clickfix-attack-nslookup-commands-used-for-stealth-malware-staging/Microsoft has disclosed a sophisticated new variant of the ClickFix social engineering attack that weaponizes the Windows nslookup command to stage malware through DNS queries, enabling attackers to bypass traditional web-based detection mechanisms. Attack Methodology This DNS-baSun, 15 Feb 2026 16:04:54 GMTGeneral CTIhttps://bulwarkblack.com/cve-2026-21510-windows-shell-zero-day-exploited-in-the-wild-to-bypass-smartscreen-protections/https://bulwarkblack.com/cve-2026-21510-windows-shell-zero-day-exploited-in-the-wild-to-bypass-smartscreen-protections/Microsoft’s February 2026 Patch Tuesday revealed a critical zero-day vulnerability affecting Windows Shell that attackers are actively exploiting to bypass security protections. CVE-2026-21510 carries a CVSS score of 8.8 and allows threat actors to circumvent Windows SmartScreen Sun, 15 Feb 2026 02:02:46 GMTGeneral CTIhttps://bulwarkblack.com/cve-2026-1731-critical-beyondtrust-remote-support-vulnerability-under-active-exploitation/https://bulwarkblack.com/cve-2026-1731-critical-beyondtrust-remote-support-vulnerability-under-active-exploitation/A critical pre-authentication command injection vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) is now being actively exploited in the wild, with threat actors targeting self-hosted deployments including legacy Bomgar appliances. Vulnerability Sat, 14 Feb 2026 21:05:43 GMTGeneral CTIhttps://bulwarkblack.com/dockerdash-critical-ai-assistant-flaw-enabled-code-execution-via-malicious-image-metadata/https://bulwarkblack.com/dockerdash-critical-ai-assistant-flaw-enabled-code-execution-via-malicious-image-metadata/Cybersecurity researchers at Noma Labs have disclosed details of a critical vulnerability in Ask Gordon, Docker’s AI assistant integrated into Docker Desktop and the Docker CLI. The flaw, codenamed DockerDash, could have been exploited to execute arbitrary code and exfiltrate senSat, 14 Feb 2026 16:02:57 GMTThreat Intelligencehttps://bulwarkblack.com/critical-unstructured-io-vulnerability-cve-2025-64712-threatens-ai-pipelines-at-amazon-google-and-fortune-1000-enterprises/https://bulwarkblack.com/critical-unstructured-io-vulnerability-cve-2025-64712-threatens-ai-pipelines-at-amazon-google-and-fortune-1000-enterprises/A critical vulnerability (CVE-2025-64712) discovered in Unstructured.io, a widely deployed ETL library for AI data processing, exposes Amazon, Google, Bank of America, and 87% of Fortune 1000 companies to remote code execution attacks. The Vulnerability: CVSS 9.8 Path Traversal LSat, 14 Feb 2026 02:03:25 GMTGeneral CTIhttps://bulwarkblack.com/xworm-rat-campaign-exploits-7-year-old-office-vulnerability-with-fileless-techniques/https://bulwarkblack.com/xworm-rat-campaign-exploits-7-year-old-office-vulnerability-with-fileless-techniques/Fortinet researchers have uncovered a new phishing campaign delivering the XWorm remote access trojan (RAT) by chaining a years-old Microsoft Office vulnerability with fileless execution techniques to evade detection. The Attack Chain The campaign uses business-themed phishing emFri, 13 Feb 2026 21:02:51 GMTGeneral CTIhttps://bulwarkblack.com/google-blocks-massive-model-extraction-campaign-targeting-gemini-ai-with-100000-malicious-prompts/https://bulwarkblack.com/google-blocks-massive-model-extraction-campaign-targeting-gemini-ai-with-100000-malicious-prompts/Google has revealed it detected and blocked a sophisticated campaign involving more than 100,000 prompts designed to extract the proprietary reasoning capabilities of its Gemini AI model, according to the Google Threat Intelligence Group’s latest quarterly threat report. The GrowFri, 13 Feb 2026 16:03:33 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/metro4shell-critical-react-native-cli-vulnerability-actively-exploited-to-deploy-malware/https://bulwarkblack.com/metro4shell-critical-react-native-cli-vulnerability-actively-exploited-to-deploy-malware/Threat actors are actively exploiting a critical remote code execution vulnerability in the popular @react-native-community/cli npm package, impacting countless mobile application developers worldwide. The Vulnerability: CVE-2025-11953 Dubbed Metro4Shell, this critical vulnerabilFri, 13 Feb 2026 02:05:28 GMTGeneral CTIhttps://bulwarkblack.com/aiframe-campaign-30-fake-ai-chrome-extensions-with-300k-users-steal-credentials-gmail-content/https://bulwarkblack.com/aiframe-campaign-30-fake-ai-chrome-extensions-with-300k-users-steal-credentials-gmail-content/Researchers at browser security platform LayerX have uncovered a coordinated malware campaign dubbed “AiFrame” involving 30 malicious Chrome extensions installed by more than 300,000 users. The extensions masquerade as AI assistants while secretly stealing credentials, email contThu, 12 Feb 2026 21:03:21 GMTMalwarehttps://bulwarkblack.com/phorpiex-botnet-resurfaces-phishing-campaign-delivers-offline-capable-global-group-ransomware/https://bulwarkblack.com/phorpiex-botnet-resurfaces-phishing-campaign-delivers-offline-capable-global-group-ransomware/A new phishing campaign leveraging the infamous Phorpiex botnet has been observed distributing Global Group ransomware through weaponized Windows shortcut (.LNK) files, according to a new advisory from Forcepoint X-Labs. The Attack Chain The campaign uses phishing emails with theThu, 12 Feb 2026 16:03:17 GMTMalwarehttps://bulwarkblack.com/cybercriminals-weaponize-chatgpt-and-grok-to-distribute-amos-stealer-on-macos/https://bulwarkblack.com/cybercriminals-weaponize-chatgpt-and-grok-to-distribute-amos-stealer-on-macos/A sophisticated attack campaign is exploiting user trust in artificial intelligence platforms to distribute the Atomic macOS Stealer (AMOS), representing a dangerous evolution in social engineering tactics that combines legitimate AI chatbot services with paid Google advertising.Thu, 12 Feb 2026 02:04:53 GMTMalwarehttps://bulwarkblack.com/xworm-rat-campaign-exploits-cve-2018-0802-in-multi-language-phishing-attacks-using-fileless-injection/https://bulwarkblack.com/xworm-rat-campaign-exploits-cve-2018-0802-in-multi-language-phishing-attacks-using-fileless-injection/FortiGuard Labs has uncovered a sophisticated phishing campaign delivering XWorm version 7.2, a multi-functional Remote Access Trojan (RAT) that provides attackers with full remote control of compromised Windows systems. Campaign Overview The campaign utilizes multiple phishing eWed, 11 Feb 2026 21:02:35 GMTMalwarehttps://bulwarkblack.com/google-warns-of-sustained-russia-and-china-cyberattacks-targeting-defense-industrial-base/https://bulwarkblack.com/google-warns-of-sustained-russia-and-china-cyberattacks-targeting-defense-industrial-base/Google Threat Intelligence Group (GTIG) has published a comprehensive report revealing persistent cyber operations targeting the defense industrial base (DIB) from Russia and China-linked threat actors. The findings detail how state-sponsored hackers are exploiting everything froWed, 11 Feb 2026 16:03:52 GMTGeneral CTIhttps://bulwarkblack.com/wormgpt-database-breach-exposes-19000-cybercriminal-users-and-billing-data/https://bulwarkblack.com/wormgpt-database-breach-exposes-19000-cybercriminal-users-and-billing-data/A threat actor has leaked the complete WormGPT database, exposing over 19,000 users of the notorious cybercrime AI platform along with their email addresses, billing data, and subscription information.Wed, 11 Feb 2026 02:02:56 GMTThreat Intelligencehttps://bulwarkblack.com/chinese-apt-unc3886-breaches-singapores-four-largest-telcos-in-coordinated-espionage-campaign/https://bulwarkblack.com/chinese-apt-unc3886-breaches-singapores-four-largest-telcos-in-coordinated-espionage-campaign/Singapore’s government has officially confirmed that a sophisticated Chinese cyber-espionage group breached all four of the nation’s largest telecommunications providers in a coordinated campaign that exploited zero-day vulnerabilities and deployed advanced persistence mechanismsTue, 10 Feb 2026 21:02:21 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/bluenoroffs-ghostcall-and-ghosthire-campaigns-use-stolen-victim-videos-to-compromise-crypto-executives/https://bulwarkblack.com/bluenoroffs-ghostcall-and-ghosthire-campaigns-use-stolen-victim-videos-to-compromise-crypto-executives/North Korean threat actor BlueNoroff (also known as Sapphire Sleet, APT38, Alluring Pisces, Stardust Chollima, and TA444) has launched two sophisticated campaigns—GhostCall and GhostHire—targeting cryptocurrency executives, blockchain developers, and venture capital professionalsTue, 10 Feb 2026 16:02:30 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/apt28-exploits-cve-2026-21509-in-operation-neusploit-stealing-emails-with-minidoor-backdoor/https://bulwarkblack.com/apt28-exploits-cve-2026-21509-in-operation-neusploit-stealing-emails-with-minidoor-backdoor/Russia’s infamous APT28 (Fancy Bear/Forest Blizzard) threat group has weaponized a recently patched Microsoft Office vulnerability in just three days, launching a sophisticated espionage campaign dubbed Operation Neusploit targeting government and diplomatic entities across CentrTue, 10 Feb 2026 02:02:37 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/fake-7-zip-downloads-convert-home-pcs-into-residential-proxy-nodes-for-cybercriminals/https://bulwarkblack.com/fake-7-zip-downloads-convert-home-pcs-into-residential-proxy-nodes-for-cybercriminals/A sophisticated brand impersonation campaign is weaponizing the popular 7-Zip file archiver to silently transform infected Windows computers into residential proxy nodes—monetizing victims’ IP addresses for fraud, scraping, and anonymity laundering operations. The Lookalike DomaiMon, 09 Feb 2026 21:02:27 GMTMalwarehttps://bulwarkblack.com/north-korean-hackers-deploy-ai-generated-deepfakes-and-seven-malware-families-in-targeted-cryptocurrency-attacks/https://bulwarkblack.com/north-korean-hackers-deploy-ai-generated-deepfakes-and-seven-malware-families-in-targeted-cryptocurrency-attacks/North Korean threat actor UNC1069 has launched a sophisticated campaign targeting the cryptocurrency and decentralized finance (DeFi) sectors, deploying AI-generated deepfake videos and seven unique malware families to steal credentials and financial data, according to new researMon, 09 Feb 2026 16:01:51 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/tgr-sta-1030-espionage-campaign-compromises-70-organizations-across-37-nations-using-shadowguard-linux-rootkit/https://bulwarkblack.com/tgr-sta-1030-espionage-campaign-compromises-70-organizations-across-37-nations-using-shadowguard-linux-rootkit/A massive, state-aligned cyber espionage campaign has quietly infiltrated government networks across 37 countries, targeting ministries of finance, law enforcement, and critical infrastructure. In a new report, Unit 42 exposes the operations of TGR-STA-1030 (also tracked as UNC66Mon, 09 Feb 2026 02:02:32 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/bridgepay-ransomware-attack-forces-nationwide-cash-only-payment-disruption/https://bulwarkblack.com/bridgepay-ransomware-attack-forces-nationwide-cash-only-payment-disruption/A major ransomware attack on BridgePay Network Solutions has caused a nationwide payment processing outage, forcing merchants across the United States to switch to cash-only operations and disrupting card transactions for municipalities and businesses alike. Ransomware Confirmed Sun, 08 Feb 2026 21:02:34 GMTGeneral CTIhttps://bulwarkblack.com/qilin-ransomware-hits-romanias-national-oil-pipeline-operator-conpet-claims-nearly-1-tb-data-theft/https://bulwarkblack.com/qilin-ransomware-hits-romanias-national-oil-pipeline-operator-conpet-claims-nearly-1-tb-data-theft/Romania’s national oil pipeline operator Conpet has confirmed a cyberattack disrupted parts of its technology infrastructure and knocked its website offline earlier this week. The company operates approximately 3,800 kilometers (2,360 miles) of pipelines supplying domestic and imSun, 08 Feb 2026 16:02:36 GMTOperational Technology (OT)https://bulwarkblack.com/flickr-data-breach-exposes-user-information-through-third-party-email-vendor-vulnerability/https://bulwarkblack.com/flickr-data-breach-exposes-user-information-through-third-party-email-vendor-vulnerability/Photo and video sharing service Flickr has disclosed a data security incident where user personal information was potentially exposed through a vulnerability at a third-party email service provider. The San Francisco-based platform confirmed on February 5, 2026, that the breach mSun, 08 Feb 2026 02:03:02 GMTGeneral CTIhttps://bulwarkblack.com/safepay-ransomware-attack-on-conduent-exposes-data-of-25-9-million-americans/https://bulwarkblack.com/safepay-ransomware-attack-on-conduent-exposes-data-of-25-9-million-americans/A January 2025 ransomware attack on government technology giant Conduent has exploded into one of the largest data breaches in recent history, with confirmed victims now numbering at least 25.9 million Americans across multiple states. The breach, attributed to the SafePay ransomSat, 07 Feb 2026 21:01:54 GMTThreat Intelligencehttps://bulwarkblack.com/apt-q-27-goldeneyedog-deploys-fileless-malware-in-stealthy-corporate-network-attacks/https://bulwarkblack.com/apt-q-27-goldeneyedog-deploys-fileless-malware-in-stealthy-corporate-network-attacks/A new investigation from CyStack’s security team reveals how the threat group APT-Q-27, also known as GoldenEyeDog, is bypassing modern security defenses through an elaborate multi-stage attack chain that operates almost entirely in memory. The Attack Chain: From Support Ticket tSat, 07 Feb 2026 16:03:37 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/betterment-data-breach-exposes-1-4-million-customers-following-sophisticated-social-engineering-attack/https://bulwarkblack.com/betterment-data-breach-exposes-1-4-million-customers-following-sophisticated-social-engineering-attack/Automated investment platform Betterment has disclosed a significant data breach affecting approximately 1.4 million customers, following a sophisticated social engineering campaign that targeted company employees in January 2026. Attack Overview According to Betterment’s officiaSat, 07 Feb 2026 02:03:03 GMTSocial Engineeringhttps://bulwarkblack.com/iranian-apt-infy-resurfaces-with-new-tornado-malware-after-internet-blackout/https://bulwarkblack.com/iranian-apt-infy-resurfaces-with-new-tornado-malware-after-internet-blackout/The elusive Iranian threat group known as Infy (also tracked as Prince of Persia) has evolved its tactics and deployed new command-and-control infrastructure, resuming operations precisely when Iran’s government-imposed internet blackout ended in late January 2026. Operational TiFri, 06 Feb 2026 21:02:39 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/ransomware-gangs-abuse-ispsystem-vmmanager-to-hide-malicious-infrastructure-at-scale/https://bulwarkblack.com/ransomware-gangs-abuse-ispsystem-vmmanager-to-hide-malicious-infrastructure-at-scale/Ransomware operators are increasingly exploiting legitimate virtual infrastructure management platforms to host and deliver malicious payloads at scale, effectively hiding their command-and-control infrastructure among thousands of innocuous systems. The Discovery Researchers at Fri, 06 Feb 2026 16:03:47 GMTGeneral CTIhttps://bulwarkblack.com/silver-fox-apt-unleashes-valleyrat-with-rare-poolparty-process-injection-technique/https://bulwarkblack.com/silver-fox-apt-unleashes-valleyrat-with-rare-poolparty-process-injection-technique/A sophisticated malware campaign targeting Chinese-speaking users has revealed a significant evolution in the Silver Fox APT group’s capabilities. According to new research from Cybereason Security Services, the threat actors are deploying fake software installers to deliver VallFri, 06 Feb 2026 02:02:14 GMTMalwarehttps://bulwarkblack.com/systembc-botnet-survives-law-enforcement-takedown-infects-over-10000-devices-worldwide/https://bulwarkblack.com/systembc-botnet-survives-law-enforcement-takedown-infects-over-10000-devices-worldwide/The SystemBC malware loader has demonstrated remarkable resilience, continuing to operate despite targeted efforts during Europol’s Operation Endgame in May 2024. Cybersecurity firm Silent Push has identified more than 10,000 unique infected IP addresses across a massive botnet iThu, 05 Feb 2026 21:02:12 GMTMalwarehttps://bulwarkblack.com/strategic-intelligence-and-the-cognitive-threshold-a-multidimensional-analysis-of-ai-model-efficacy-in-2026/https://bulwarkblack.com/strategic-intelligence-and-the-cognitive-threshold-a-multidimensional-analysis-of-ai-model-efficacy-in-2026/A comprehensive analysis of frontier AI models for strategic intelligence work in 2026, comparing GPT-5.2, Claude Opus 4.5, Gemini 3 Pro, and Grok 4.1 across reasoning benchmarks, research capabilities, geopolitical analysis, and financial intelligence applications.Thu, 05 Feb 2026 19:20:13 GMTThreat Intelligencehttps://bulwarkblack.com/dknife-cisco-talos-exposes-china-nexus-gateway-monitoring-aitm-framework-active-since-2019/https://bulwarkblack.com/dknife-cisco-talos-exposes-china-nexus-gateway-monitoring-aitm-framework-active-since-2019/Cisco Talos researchers have disclosed a sophisticated adversary-in-the-middle (AitM) framework dubbed “DKnife” that enables China-nexus threat actors to intercept, manipulate, and weaponize network traffic at the gateway level. The framework has been operational since at least 2Thu, 05 Feb 2026 16:03:06 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/cisa-confirms-vmware-esxi-flaw-cve-2025-22225-now-exploited-in-active-ransomware-campaigns/https://bulwarkblack.com/cisa-confirms-vmware-esxi-flaw-cve-2025-22225-now-exploited-in-active-ransomware-campaigns/The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to confirm that CVE-2025-22225, a high-severity VMware ESXi sandbox escape vulnerability, is now being actively exploited in ransomware attacks. The VulnThu, 05 Feb 2026 05:12:51 GMTBusinesshttps://bulwarkblack.com/encase-forensic-driver-weaponized-byovd-attack-targets-59-edr-tools-through-sonicwall-vpn-breach/https://bulwarkblack.com/encase-forensic-driver-weaponized-byovd-attack-targets-59-edr-tools-through-sonicwall-vpn-breach/Security researchers at Huntress have documented a sophisticated intrusion where threat actors leveraged compromised SonicWall SSLVPN credentials to deploy a custom EDR killer that abuses a legitimate forensic driver from Guidance Software’s EnCase to terminate security processesThu, 05 Feb 2026 02:02:23 GMTGeneral CTIhttps://bulwarkblack.com/pdfsider-the-stealthy-backdoor-targeting-fortune-100-financial-institutions/https://bulwarkblack.com/pdfsider-the-stealthy-backdoor-targeting-fortune-100-financial-institutions/A newly identified Windows malware strain called PDFSider has emerged as a dangerous tool in the arsenals of multiple ransomware operators, with at least one confirmed attack targeting a Fortune 100 finance company. Security researchers at Resecurity uncovered the malware during Wed, 04 Feb 2026 21:01:57 GMTMalwarehttps://bulwarkblack.com/shinyhunters-claims-massive-ivy-league-breach-2-2-million-records-from-harvard-and-upenn/https://bulwarkblack.com/shinyhunters-claims-massive-ivy-league-breach-2-2-million-records-from-harvard-and-upenn/The notorious threat actor group ShinyHunters has claimed responsibility for a significant data breach targeting two of America’s most prestigious academic institutions: Harvard University and the University of Pennsylvania. What’s Being Claimed On February 4, 2026, ShinyHunters Wed, 04 Feb 2026 16:15:55 GMTThreat Intelligencehttps://bulwarkblack.com/ai-powered-attack-achieves-aws-admin-access-in-under-10-minutes-a-new-era-of-automated-intrusions/https://bulwarkblack.com/ai-powered-attack-achieves-aws-admin-access-in-under-10-minutes-a-new-era-of-automated-intrusions/In a stark demonstration of how artificial intelligence is transforming the cybersecurity threat landscape, the Sysdig Threat Research Team (TRT) has documented a sophisticated cloud intrusion where attackers achieved full administrative control of an AWS environment in less thanWed, 04 Feb 2026 16:02:58 GMTGeneral CTIhttps://bulwarkblack.com/shadowhs-fileless-linux-post-exploitation-framework-runs-entirely-in-memory/https://bulwarkblack.com/shadowhs-fileless-linux-post-exploitation-framework-runs-entirely-in-memory/Cyble Research & Intelligence Labs (CRIL) has uncovered a sophisticated Linux intrusion framework dubbed ShadowHS — a stealthy, fileless post-exploitation tool that executes entirely from memory, leaving virtually no traces on disk. This discovery highlights the growing sophisticWed, 04 Feb 2026 02:01:50 GMTMalwarehttps://bulwarkblack.com/vibe-coding-gone-wrong-moltbook-ai-social-network-exposes-4-75-million-records-in-massive-database-breach/https://bulwarkblack.com/vibe-coding-gone-wrong-moltbook-ai-social-network-exposes-4-75-million-records-in-massive-database-breach/Google-owned Wiz discovers 4.75 million exposed records in AI social network Moltbook, including 1.5M API tokens and plaintext OpenAI keys—all because Row Level Security was never enabled on the “vibe-coded” platform.Tue, 03 Feb 2026 16:02:13 GMTGeneral CTIhttps://bulwarkblack.com/chinese-apt-lotus-blossom-hijacks-notepad-update-mechanism-to-deploy-chrysalis-backdoor/https://bulwarkblack.com/chinese-apt-lotus-blossom-hijacks-notepad-update-mechanism-to-deploy-chrysalis-backdoor/Chinese state-sponsored threat actors hijacked Notepad++ update infrastructure for nearly six months, deploying a sophisticated custom backdoor called Chrysalis to selectively targeted victims.Tue, 03 Feb 2026 02:01:35 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/russian-legion-hacker-alliance-launches-opdenmark-campaign-against-danish-critical-infrastructure/https://bulwarkblack.com/russian-legion-hacker-alliance-launches-opdenmark-campaign-against-danish-critical-infrastructure/A newly formed Russian hacktivist alliance called Russian Legion has launched OpDenmark, a coordinated cyberattack campaign against Danish critical infrastructure in retaliation for the country’s 1.5 billion DKK military aid package to Ukraine.Mon, 02 Feb 2026 21:01:36 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/breachforums-breach-exposes-324000-cybercriminal-identities-dark-web-leak/https://bulwarkblack.com/breachforums-breach-exposes-324000-cybercriminal-identities-dark-web-leak/The tables have turned: BreachForums, one of the largest dark web marketplaces for stolen data, has been breached. A disgruntled insider leaked the real identities of nearly 324,000 cybercriminals, including email addresses, IP addresses, and connections to notorious groups like Mon, 02 Feb 2026 16:02:18 GMTGeneral CTIhttps://bulwarkblack.com/sonicwall-cloud-breach-enables-ransomware-attack-on-74-us-banks-and-credit-unions/https://bulwarkblack.com/sonicwall-cloud-breach-enables-ransomware-attack-on-74-us-banks-and-credit-unions/State-sponsored hackers exploited SonicWall’s MySonicWall cloud breach to launch a ransomware attack affecting 74 US banks and credit unions, compromising data of over 400,000 individuals. The attack demonstrates how third-party security breaches can cascade into devastating downMon, 02 Feb 2026 02:01:47 GMTGeneral CTIhttps://bulwarkblack.com/nike-investigates-1-4-tb-data-leak-after-world-leaks-ransomware-gang-posts-stolen-files/https://bulwarkblack.com/nike-investigates-1-4-tb-data-leak-after-world-leaks-ransomware-gang-posts-stolen-files/Nike confirms it is investigating a potential breach after the World Leaks ransomware gang claimed to have stolen 1.4 TB of corporate data. The group, a rebrand of Hunters International, has targeted major organizations including the U.S. Marshals Service and Tata Technologies.Sun, 01 Feb 2026 21:02:10 GMTGeneral CTIhttps://bulwarkblack.com/russian-hackers-launch-coordinated-cyberattacks-on-polands-renewable-energy-infrastructure/https://bulwarkblack.com/russian-hackers-launch-coordinated-cyberattacks-on-polands-renewable-energy-infrastructure/Russian state-sponsored threat actors launched coordinated cyberattacks against Poland’s energy sector on December 29, 2025, targeting over 30 wind and solar farms, a manufacturing company, and a major combined heat and power (CHP) plant that serves nearly 500,000 people, accordiSun, 01 Feb 2026 16:02:50 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/iconics-suite-scada-vulnerability-enables-denial-of-service-through-privileged-file-operations/https://bulwarkblack.com/iconics-suite-scada-vulnerability-enables-denial-of-service-through-privileged-file-operations/CVE-2025-0921 in Iconics Suite SCADA allows attackers to exploit privileged file operations to corrupt critical system binaries and crash Windows systems through symbolic link attacks.Sun, 01 Feb 2026 02:05:19 GMTOperational Technology (OT)https://bulwarkblack.com/global-energy-systems-exposed-widespread-cybersecurity-gaps-found-in-power-grid-ot-networks/https://bulwarkblack.com/global-energy-systems-exposed-widespread-cybersecurity-gaps-found-in-power-grid-ot-networks/A global study by OMICRON reveals critical cybersecurity weaknesses in power grid OT networks, including unpatched devices, weak segmentation, and asset blind spots that leave critical infrastructure vulnerable to attack.Sat, 31 Jan 2026 21:04:54 GMTOperational Technology (OT)https://bulwarkblack.com/winrar-cve-2025-8088-russia-china-and-cybercriminals-unite-to-exploit-path-traversal-flaw/https://bulwarkblack.com/winrar-cve-2025-8088-russia-china-and-cybercriminals-unite-to-exploit-path-traversal-flaw/Google Threat Intelligence reveals widespread exploitation of CVE-2025-8088 by Russian APT groups, Chinese actors, and cybercriminals. The WinRAR path traversal flaw enables payload delivery via the Windows Startup folder, with active campaigns targeting Ukraine, LATAM, and finanSat, 31 Jan 2026 18:32:04 GMTGeneral CTIhttps://bulwarkblack.com/north-korean-konni-apt-deploys-ai-generated-malware-to-target-blockchain-developers/https://bulwarkblack.com/north-korean-konni-apt-deploys-ai-generated-malware-to-target-blockchain-developers/The North Korean threat group Konni has launched a new campaign using AI-generated PowerShell malware to target blockchain developers across the APAC region, marking a significant shift toward technical targets and cryptocurrency infrastructure.Sat, 31 Jan 2026 08:48:55 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/microsoft-to-disable-30-year-old-ntlm-authentication-protocol-by-default/https://bulwarkblack.com/microsoft-to-disable-30-year-old-ntlm-authentication-protocol-by-default/Microsoft announces NTLM will be disabled by default in upcoming Windows releases, marking the end of the 30-year-old authentication protocol that has been a persistent security vulnerability.Sat, 31 Jan 2026 02:05:00 GMTGeneral CTIhttps://bulwarkblack.com/cve-2026-24061-11-year-old-gnu-telnetd-vulnerability-grants-instant-root-access/https://bulwarkblack.com/cve-2026-24061-11-year-old-gnu-telnetd-vulnerability-grants-instant-root-access/CVE-2026-24061 is a critical 11-year-old vulnerability in GNU InetUtils telnetd that allows unauthenticated attackers to gain instant root shell access. With a CVSS score of 9.8 and active exploitation confirmed, this flaw affects over 200,000 devices running Telnet servers globaSat, 31 Jan 2026 01:50:32 GMTOperational Technology (OT)https://bulwarkblack.com/ivanti-patches-two-critical-epmm-zero-day-vulnerabilities-under-active-exploitation/https://bulwarkblack.com/ivanti-patches-two-critical-epmm-zero-day-vulnerabilities-under-active-exploitation/Two critical CVSS 9.8 vulnerabilities in Ivanti Endpoint Manager Mobile (CVE-2026-1281, CVE-2026-1340) are under active exploitation, allowing unauthenticated remote code execution. CISA has added them to the KEV catalog with a February 1 federal deadline.Sat, 31 Jan 2026 01:43:37 GMTGeneral CTIhttps://bulwarkblack.com/ivanti-epmm-zero-days-actively-exploited-pre-auth-rce-via-bash-arithmetic-expansion/https://bulwarkblack.com/ivanti-epmm-zero-days-actively-exploited-pre-auth-rce-via-bash-arithmetic-expansion/Two actively exploited pre-auth RCE vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile allow attackers to execute arbitrary commands via Bash arithmetic expansion. CISA has added these to the KEV catalog.Sat, 31 Jan 2026 01:42:13 GMTGeneral CTIhttps://bulwarkblack.com/android-malware-campaign-abuses-hugging-face-ai-platform-to-distribute-rat/https://bulwarkblack.com/android-malware-campaign-abuses-hugging-face-ai-platform-to-distribute-rat/Threat actors are abusing the Hugging Face AI platform to host Android malware, using server-side polymorphism to generate thousands of RAT variants every 15 minutes.Fri, 30 Jan 2026 21:04:13 GMTMalwarehttps://bulwarkblack.com/smartermail-fixes-critical-unauthenticated-rce-flaw-with-cvss-9-3-score/https://bulwarkblack.com/smartermail-fixes-critical-unauthenticated-rce-flaw-with-cvss-9-3-score/SmarterTools patches critical CVE-2026-24423 (CVSS 9.3) unauthenticated RCE vulnerability in SmarterMail email server. Two other flaws including one under active exploitation also addressed. Update immediately.Fri, 30 Jan 2026 16:05:31 GMTGeneral CTIhttps://bulwarkblack.com/aisuru-botnet-shatters-records-with-31-4-tbps-ddos-attack/https://bulwarkblack.com/aisuru-botnet-shatters-records-with-31-4-tbps-ddos-attack/The Aisuru/Kimwolf botnet launched the largest DDoS attack ever publicly disclosed, peaking at 31.4 Tbps and 200 million requests per second in Cloudflare’s ‘Night Before Christmas’ campaign.Fri, 30 Jan 2026 08:51:36 GMTBusinesshttps://bulwarkblack.com/match-group-data-breach-exposes-user-information-from-tinder-hinge-and-okcupid/https://bulwarkblack.com/match-group-data-breach-exposes-user-information-from-tinder-hinge-and-okcupid/Match Group confirms cybersecurity incident after ShinyHunters voice phishing campaign compromises SSO account, exposing data from popular dating apps including Tinder, Hinge, OkCupid, and Match.com.Fri, 30 Jan 2026 08:41:50 GMTBusinesshttps://bulwarkblack.com/solarwinds-fixes-six-critical-web-help-desk-vulnerabilities-including-rce-and-auth-bypass/https://bulwarkblack.com/solarwinds-fixes-six-critical-web-help-desk-vulnerabilities-including-rce-and-auth-bypass/SolarWinds patches six severe vulnerabilities in Web Help Desk, including four critical flaws (CVSS 9.8) enabling unauthenticated remote code execution and authentication bypass. Organizations should update to WHD 2026.1 immediately.Thu, 29 Jan 2026 16:05:46 GMTGeneral CTIhttps://bulwarkblack.com/16-malicious-chrome-extensions-steal-chatgpt-session-tokens/https://bulwarkblack.com/16-malicious-chrome-extensions-steal-chatgpt-session-tokens/Security researchers discovered 16 malicious browser extensions claiming to enhance ChatGPT that actually steal session tokens, giving attackers full access to accounts and conversation history.Thu, 29 Jan 2026 02:48:27 GMTBusinesshttps://bulwarkblack.com/google-disrupts-worlds-largest-residential-proxy-botnet/https://bulwarkblack.com/google-disrupts-worlds-largest-residential-proxy-botnet/Google Threat Intelligence Group disrupts IPIDEA, the world’s largest residential proxy network, used by 550+ threat groups including nation-state actors from China, Russia, Iran, and North Korea.Thu, 29 Jan 2026 02:48:01 GMTBusinesshttps://bulwarkblack.com/soundcloud-data-breach-exposes-29-8-million-user-accounts/https://bulwarkblack.com/soundcloud-data-breach-exposes-29-8-million-user-accounts/Music streaming platform SoundCloud confirmed a data breach affecting 29.8 million user accounts. The December 2025 incident exposed emails and profile data, creating risks for phishing and credential stuffing attacks.Wed, 28 Jan 2026 19:02:42 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/fortinet-blocks-actively-exploited-forticloud-sso-zero-day-until-patch-is-ready/https://bulwarkblack.com/fortinet-blocks-actively-exploited-forticloud-sso-zero-day-until-patch-is-ready/Fortinet confirms CVE-2026-24858, a critical FortiCloud SSO authentication bypass zero-day actively exploited in the wild. The company has blocked FortiCloud SSO from vulnerable devices while patches are being developed.Wed, 28 Jan 2026 02:14:09 GMTGeneral CTIhttps://bulwarkblack.com/fake-clawdbot-vs-code-extension-deploys-screenconnect-rat/https://bulwarkblack.com/fake-clawdbot-vs-code-extension-deploys-screenconnect-rat/A malicious VS Code extension impersonating the popular Clawdbot AI assistant has been caught deploying ScreenConnect RAT on Windows machines. The trojanized extension worked as a functional AI coding tool while silently installing remote access software.Tue, 27 Jan 2026 23:41:51 GMTMalwarehttps://bulwarkblack.com/chinese-apt-groups-leverage-peckbirdy-javascript-c2-framework-since-2023/https://bulwarkblack.com/chinese-apt-groups-leverage-peckbirdy-javascript-c2-framework-since-2023/Trend Micro researchers have discovered PeckBirdy, a flexible JScript-based C2 framework used by China-linked APT actors to target gambling industries and Asian government entities since 2023.Tue, 27 Jan 2026 23:07:51 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/poland-thwarts-russian-sandworm-wiper-attack-on-power-plants/https://bulwarkblack.com/poland-thwarts-russian-sandworm-wiper-attack-on-power-plants/Russian APT group Sandworm attempted to deploy destructive DynoWiper malware against Polish power plants in late December 2025. The attack was thwarted, but highlights ongoing threats to critical infrastructure from state-sponsored actors.Tue, 27 Jan 2026 22:51:35 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/critical-microsoft-office-vulnerabilities-exploited-in-latest-cyber-threat-campaign/https://bulwarkblack.com/critical-microsoft-office-vulnerabilities-exploited-in-latest-cyber-threat-campaign/Security researchers have identified sophisticated attack vectors leveraging Microsoft Office documents to bypass security measures and deliver malicious payloads. Learn about the latest threats and defensive strategies.Tue, 27 Jan 2026 22:28:45 GMTGeneral CTIhttps://bulwarkblack.com/poland-thwarts-russian-wiper-malware-attack-on-power-plants/https://bulwarkblack.com/poland-thwarts-russian-wiper-malware-attack-on-power-plants/Source: Hackread | Author: Deeba Ahmed Poland has narrowly avoided a massive energy crisis following what officials are calling the largest cyberattack on the country in years. Between 29 and 30 December 2025, hackers attempted to break into the nation’s energy infrastructure, spTue, 27 Jan 2026 21:51:08 GMTMalwarehttps://bulwarkblack.com/complete-guide-setting-up-freepbx-with-vps-docker-and-vpn-cgnat-bypass-solution/https://bulwarkblack.com/complete-guide-setting-up-freepbx-with-vps-docker-and-vpn-cgnat-bypass-solution/Complete FreePBX Setup Guide – Docker, VPN, and Twilio Integration Requirements / Setup Digital Ocean or whatever cloud provider you choose Docker (FreePBX) Nginx Setup OVPN Configuration IP Tables Setup YeaLink Phone configuration, the (YeaLinkT45w) was used in this tutorial TwiFri, 18 Jul 2025 05:00:42 GMTBecoming Self Sufficienthttps://bulwarkblack.com/understanding-cryptocurrency-a-modern-metaphor-guide-and-further-thoughts/https://bulwarkblack.com/understanding-cryptocurrency-a-modern-metaphor-guide-and-further-thoughts/Cryptocurrency: Digital Money with a New Tune Think of cryptocurrency like email is to regular mail. Instead of sending paper envelopes through the post office, you now send messages instantly across the globe. Similarly, with crypto, you’re sending value (money) instantly througFri, 16 May 2025 19:19:18 GMTBecoming Self Sufficienthttps://bulwarkblack.com/i-got-in-without-a-badge-easy-social-engineering-strategies/https://bulwarkblack.com/i-got-in-without-a-badge-easy-social-engineering-strategies/People assume social engineering is all charm and quick thinking. But real operators know the truth:Preparation is the payload.Execution is just the final click. This is how I walked into a secured corporate building twice without a badge, without clearance, and without triggerinSun, 23 Mar 2025 19:20:05 GMTRed Teaminghttps://bulwarkblack.com/the-game-is-life-but-what-if-thats-not-just-fiction/https://bulwarkblack.com/the-game-is-life-but-what-if-thats-not-just-fiction/I recently read a book that didn’t just entertain me, it challenged everything I thought I understood about reality. It’s called The Game is Life by Terry Schott. The premise is simple… and wild: humans live in a highly advanced society where children enter a full-immersion simulSat, 22 Mar 2025 18:26:07 GMTMakes you Thinkhttps://bulwarkblack.com/the-ai-edge-outthinking-the-chaos/https://bulwarkblack.com/the-ai-edge-outthinking-the-chaos/The privacy and security landscape has fundamentally changed. It’s not just about firewalls and VPNs anymore, it’s about where you live, how you power your life, and how resilient your systems are when the grid, the internet, or the institutions behind them fail. The concept of “Fri, 21 Mar 2025 18:28:57 GMTBecoming Self Sufficienthttps://bulwarkblack.com/how-to-avoid-the-coming-trap-digital-ids-social-credit-scores-and-government-controlled-crypto/https://bulwarkblack.com/how-to-avoid-the-coming-trap-digital-ids-social-credit-scores-and-government-controlled-crypto/Conspiracy? Blockchain and cryptocurrency were originally designed to free individuals from centralized financial control, but as governments shift toward embracing crypto, a hidden agenda is emerging. With digital IDs, social credit scores, and Central Bank Digital Currencies (CThu, 20 Mar 2025 18:30:35 GMTDigital Assetshttps://bulwarkblack.com/this-week-in-security-loop-dos-flipper-responds-and-more/https://bulwarkblack.com/this-week-in-security-loop-dos-flipper-responds-and-more/by: Jonathan Bennett Here’s a fun thought experiment. UDP packets can be sent with an arbitrary source IP and port, so you can send a packet to one server, and could aim the response at another server. What happens if that response triggers another response? What if you could craFri, 22 Mar 2024 21:09:43 GMTGeneral CTIhttps://bulwarkblack.com/shodan-dorks/https://bulwarkblack.com/shodan-dorks/READ ARTICLE By: ZION3R Shodan Dorks Basic Shodan Filters city: Find devices in a particular city. city:”Bangalore” country: Find devices in a particular country. country:”IN” geo: Find devices by giving geographical coordinates. geo:”56.913055,118.250862″ Location country:us couFri, 22 Mar 2024 21:01:17 GMTOffensive Devices / Tacticshttps://bulwarkblack.com/how-to-communicate-a-cyber-breach-to-minimize-reputational-damage/https://bulwarkblack.com/how-to-communicate-a-cyber-breach-to-minimize-reputational-damage/READ ARTICLE Sarah Woodhouse, Director of AMBITIOUS, explains how businesses must communicate a cyber breach in order to remain trustworthy and minimise damage. A cyber breach occurs roughly once every 39 seconds. With businesses as targets for their data, it’s not a case of if bFri, 22 Mar 2024 20:48:14 GMTBusinesshttps://bulwarkblack.com/new-go-loader-pushes-rhadamanthys-stealer/https://bulwarkblack.com/new-go-loader-pushes-rhadamanthys-stealer/READ ARTICLE Posted: March 22, 2024 by Jérôme Segura Malware loaders (also known as droppers or downloaders) are a popular commodity in the criminal underground. Their primary function is to successfully compromise a machine and deploy one or multiple additional payloads. A good Fri, 22 Mar 2024 20:30:27 GMTMalwarehttps://bulwarkblack.com/the-updated-apt-playbook-tales-from-the-kimsuky-threat-actor-group/https://bulwarkblack.com/the-updated-apt-playbook-tales-from-the-kimsuky-threat-actor-group/READ ARTICLE Last updated at Thu, 21 Mar 2024 13:20:04 GMT Co-authors are Christiaan Beek and Raj Samani Within Rapid7 Labs we continually track and monitor threat groups. This is one of our key areas of focus as we work to ensure that our ability to protect customers remains conFri, 22 Mar 2024 20:17:35 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/curious-serpens-falsefont-backdoor-technical-analysis-detection-and-prevention/https://bulwarkblack.com/curious-serpens-falsefont-backdoor-technical-analysis-detection-and-prevention/By Tom Fakterman, Daniel Frank and Jerome Tujague READ ARTICLE Executive Summary This article reviews the recently discovered FalseFont backdoor, which was used by a suspected Iranian-affiliated threat actor that Unit 42 tracks as Curious Serpens. Curious Serpens (aka Peach SandsFri, 22 Mar 2024 19:16:53 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/china-linked-group-breaches-networks-via-connectwise-f5-software-flaws/https://bulwarkblack.com/china-linked-group-breaches-networks-via-connectwise-f5-software-flaws/READ ARTICLE A China-linked threat cluster leveraged security flaws in Connectwise ScreenConnect and F5 BIG-IP software to deliver custom malware capable of delivering additional backdoors on compromised Linux hosts as part of an “aggressive” campaign. Google-owned Mandiant is trFri, 22 Mar 2024 19:03:36 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/pig-butchering-is-an-evolution-of-a-social-engineering-tactic-weve-seen-for-years/https://bulwarkblack.com/pig-butchering-is-an-evolution-of-a-social-engineering-tactic-weve-seen-for-years/By Jonathan Munshaw READ ARTICLE Whether you want to call them “catfishing,” “pig butchering” or just good ‘old-fashioned “social engineering,” romance scams have been around forever. I was first introduced to them through the MTV show “Catfish,” but recently they seem to be makiFri, 22 Mar 2024 18:51:06 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/new-acidpour-wiper-targeting-linux-devices-spotted-in-ukraine/https://bulwarkblack.com/new-acidpour-wiper-targeting-linux-devices-spotted-in-ukraine/READ ARTICLE By: Kevin Poireault Reporter, Infosecurity Magazine A new variant of the wiper malware AcidRain, known as AcidPour, has been discovered by SentinelOne’s threat intelligence team, SentinelLabs. AcidRain is destructive wiper malware attributed to Russian military intelFri, 22 Mar 2024 17:29:08 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/fancy-bear-espionage-group-expands-global-phishing-campaign/https://bulwarkblack.com/fancy-bear-espionage-group-expands-global-phishing-campaign/Source Russia-linked threat actor Fancy Bear is conducting a wave of phishing campaigns impersonating entities across Europe, Americas, and Asia, focusing on Ukraine-related targets. IBM X-Force has identified an ongoing phishing campaign conducted by ITG05, a Russia state-sponsoFri, 22 Mar 2024 17:20:22 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/tbhm-live-training-with-jhaddix/https://bulwarkblack.com/tbhm-live-training-with-jhaddix/Attending The Bug Hunters Methodology Live training by Jason Haddix was a great experience. I think my goal with writing this post is really to paint a picture of my overall personal experience being new to Bug Bounty Hunting, coming from the Blue Teaming side of things, and to jThu, 21 Mar 2024 17:51:05 GMTBug Bountyhttps://bulwarkblack.com/detecting-and-responding-to-security-incidents-and-why-its-difficult/https://bulwarkblack.com/detecting-and-responding-to-security-incidents-and-why-its-difficult/Quick Picture of Attacker Vs Defender With the relentless advancement of technology and continuous improvements in security measures, there remains a significant challenge in detecting and responding to security incidents. This difficulty arises partly due to the diverse tactics Mon, 19 Feb 2024 07:29:46 GMTCyber Security Bloghttps://bulwarkblack.com/tool-of-first-resort-israel-hamas-war-in-cyber/https://bulwarkblack.com/tool-of-first-resort-israel-hamas-war-in-cyber/Feb 14, 2024 | 4 min read | Sandra Joyce | Shane Huntley READ ARTICLE Cybersecurity plays a critical role in geopolitics — particularly during times of conflict. While offensive cyber operations have become nearly universal, the tactics, timing and objectives of threat actors canWed, 14 Feb 2024 05:56:20 GMTDetectionhttps://bulwarkblack.com/endpoints-vs-routes-what-every-api-hacker-needs-to-know/https://bulwarkblack.com/endpoints-vs-routes-what-every-api-hacker-needs-to-know/READ ARTICLE DANA EPP’S BLOG API Hacking Fundamentals February 13, 2024 I recently had an interesting conversation on Twitter/X that got me thinking about API endpoints vs routes. It all started with this tweet: The conversation progressed into whether this was one vulnerability Wed, 14 Feb 2024 05:46:28 GMTBug Bountyhttps://bulwarkblack.com/bypassing-edrs-with-edr-preloading/https://bulwarkblack.com/bypassing-edrs-with-edr-preloading/READ ARTICLE Marcus Hutchins Previously, I wrote an article detailing how system calls can be utilized to bypass user mode EDR hooks. Now, I want to introduce an alternative technique, “EDR-Preloading”, which involves running malicious code before the EDR’s DLL is loaded into theTue, 13 Feb 2024 15:17:22 GMTRed Teaminghttps://bulwarkblack.com/detecting-api-endpoints-and-source-code-with-js-miner/https://bulwarkblack.com/detecting-api-endpoints-and-source-code-with-js-miner/Read Article DANA EPP’S BLOG Security (de)engineering for fun and profit Let’s be honest. Most APIs are naked without some sort of web app frontend calling it. These days, those apps are usually written in some sort of framework based on Javascript. With a bit of work, we can do Wed, 07 Feb 2024 04:43:28 GMTBug Bountyhttps://bulwarkblack.com/book-hacktricks/https://bulwarkblack.com/book-hacktricks/To the Book! Disclaimer This book, ‘HackTricks,’ is intended for educational and informational purposes only. The content within this book is provided on an ‘as is’ basis, and the authors and publishers make no representations or warranties of any kind, express or implied, about Sat, 03 Feb 2024 18:47:10 GMTBug Bountyhttps://bulwarkblack.com/virtual-host-enumeration-for-uncovering-hidden-subdomains/https://bulwarkblack.com/virtual-host-enumeration-for-uncovering-hidden-subdomains/Read Article Nairuz Abulhul – Nov 28, 2023 | Published in R3d Buck3T | 8 min read When performing external penetration testing or bug bounty hunting, we explore the targeted system from various angles to collect as much information as possible to identify potential attack vectorsFri, 26 Jan 2024 23:11:52 GMTBug Bountyhttps://bulwarkblack.com/demystifying-generative-ai-f09fa496-a-security-researchers-notes/https://bulwarkblack.com/demystifying-generative-ai-f09fa496-a-security-researchers-notes/Roberto Rodriguez – Nov 4, 2023 • 22 min read Read Article As a security researcher, stepping into the world of Generative Artificial Intelligence (GenAI) was like entering unfamiliar territory. While I was excited by the potential it held for revolutionizing security, I soon reaFri, 26 Jan 2024 17:26:09 GMTAI (General)https://bulwarkblack.com/threat-modeling-llm-applications/https://bulwarkblack.com/threat-modeling-llm-applications/Posted by Gavin Klondike on 06 June 2023 Read Article Before we get started: Hi! My name is GTKlondike, and these are my opinions as a cybersecurity consultant. While experts from the AI Village provided input, I will always welcome open discussion so that we can come to a betterFri, 26 Jan 2024 17:04:10 GMTAI (General)https://bulwarkblack.com/active-directory-penetration-testing-orange-cyber-defense-mind-maps/https://bulwarkblack.com/active-directory-penetration-testing-orange-cyber-defense-mind-maps/Get Mind Map!Fri, 26 Jan 2024 16:45:59 GMTOffensive Devices / Tacticshttps://bulwarkblack.com/sqlmap-cheat-sheet/https://bulwarkblack.com/sqlmap-cheat-sheet/Link to SheetFri, 26 Jan 2024 16:36:02 GMTBug Bountyhttps://bulwarkblack.com/announcing-cvemap-from-projectdiscovery/https://bulwarkblack.com/announcing-cvemap-from-projectdiscovery/Read Article Project Discovery Tool ManagerGitHub pdtm is a simple and easy-to-use golang based tool for managing open source projects from ProjectDiscovery. Security professionals are constantly on guard against cyber threats, especially given the rising number and sophisticatioFri, 26 Jan 2024 16:30:25 GMTBug Bountyhttps://bulwarkblack.com/how-to-protect-evilginx-using-cloudflare-and-html-obfuscation/https://bulwarkblack.com/how-to-protect-evilginx-using-cloudflare-and-html-obfuscation/Read Article Using a combination of Cloudflare and HTML Obfuscation, it is possible to protect your Evilginx server from being flagged as deceptive and so increase your chances of success on Red Team and Social Engineering engagements. Anyone who has tried to run a Social EngineeFri, 26 Jan 2024 16:14:36 GMTOffensive Devices / Tacticshttps://bulwarkblack.com/how-to-leverage-internal-proxies-for-lateral-movement-firewall-evasion-and-trust-exploitation/https://bulwarkblack.com/how-to-leverage-internal-proxies-for-lateral-movement-firewall-evasion-and-trust-exploitation/Sat, 13 Jan 2024 05:50:43 GMTBusinesshttps://bulwarkblack.com/the-bug-hunters-methodology-live/https://bulwarkblack.com/the-bug-hunters-methodology-live/https://tbhmlive.com/ Jason Haddix TBHM Live – Course Info I am thrilled to introduce you to The Bug Hunter’s Methodology LIVE, my masterclass designed for aspiring and seasoned offensive security professionals, including web application security testers, red teamers, and bug bouFri, 12 Jan 2024 18:55:28 GMTTraininghttps://bulwarkblack.com/pwnagotchi-deep-reinforcement-learning-for-wifi-pwning/https://bulwarkblack.com/pwnagotchi-deep-reinforcement-learning-for-wifi-pwning/Project Site Pwnagotchi is an A2C-based “AI” powered by bettercap and running on a Raspberry Pi Zero W that learns from its surrounding WiFi environment in order to maximize the crackable WPA key material it captures (either through passive sniffing or by performing deauthenticatThu, 11 Jan 2024 18:35:02 GMTOffensive Devices / Tacticshttps://bulwarkblack.com/automating-c2-infrastructure-with-terraform-nebula-caddy-and-cobalt-strike/https://bulwarkblack.com/automating-c2-infrastructure-with-terraform-nebula-caddy-and-cobalt-strike/Read Article The ability to quickly build out a C2 infrastructure within a few minutes, including all the set up and tear down logic included would be a great asset for any offensive security group or operator. In this post, I will show exactly how to build a fully automated funcThu, 11 Jan 2024 18:30:02 GMTBusinesshttps://bulwarkblack.com/faking-bluetooth-le-with-an-nrf24l01-module/https://bulwarkblack.com/faking-bluetooth-le-with-an-nrf24l01-module/Thu, 11 Jan 2024 18:19:55 GMTOffensive Devices / Tacticshttps://bulwarkblack.com/scada-systems-how-secure-are-the-systems-running-our-infrastructuree28ea5malav-vyas-security-researcher-at-palo-alto-networks/https://bulwarkblack.com/scada-systems-how-secure-are-the-systems-running-our-infrastructuree28ea5malav-vyas-security-researcher-at-palo-alto-networks/Thu, 11 Jan 2024 18:04:50 GMTOperational Technology (OT)https://bulwarkblack.com/review-engineering-grade-ot-security-a-managers-guide/https://bulwarkblack.com/review-engineering-grade-ot-security-a-managers-guide/Thu, 11 Jan 2024 18:00:08 GMTBusinesshttps://bulwarkblack.com/dreambus-unleashes-metabase-mayhem-with-new-exploit-module/https://bulwarkblack.com/dreambus-unleashes-metabase-mayhem-with-new-exploit-module/Read Article Key TakeawaysThu, 11 Jan 2024 17:46:01 GMTMalwarehttps://bulwarkblack.com/detection-101-top-detections-for-email-phishing-and-bec/https://bulwarkblack.com/detection-101-top-detections-for-email-phishing-and-bec/Read Article Phishing Detections: Starting the DIR Process Email phishing and BEC attacks both rely on email communication, so an email security tool is integral to protecting your environment. However, while an email security tool plays a central role in detecting phishing attemThu, 11 Jan 2024 17:16:22 GMTDetectionhttps://bulwarkblack.com/hundreds-of-thousands-of-dollars-worth-of-solana-cryptocurrency-assets-stolen-in-recent-clinksink-drainer-campaigns/https://bulwarkblack.com/hundreds-of-thousands-of-dollars-worth-of-solana-cryptocurrency-assets-stolen-in-recent-clinksink-drainer-campaigns/Read Article On January 3, 2024, Mandiant’s X social media account was taken over and subsequently used to distribute links to a cryptocurrency drainer phishing page. Working with X, we were able to regain control of the account and, based on our investigation over the following Thu, 11 Jan 2024 17:06:58 GMTMalwarehttps://bulwarkblack.com/flash-report-lockbit-ends-2023-with-record-number-of-attacks/https://bulwarkblack.com/flash-report-lockbit-ends-2023-with-record-number-of-attacks/Read Article Key FindingsThu, 11 Jan 2024 16:47:31 GMTGeneral CTIhttps://bulwarkblack.com/backdoor-win32-carbanak-anunak-named-pipe-null-dacl/https://bulwarkblack.com/backdoor-win32-carbanak-anunak-named-pipe-null-dacl/Read Article Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/b8e1e5b832e5947f41fd6ae6ef6d09a1.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32 Carbanak (Anunak) Vulnerability: Named PiThu, 11 Jan 2024 16:22:58 GMTGlobal Cyber Threat Intelligencehttps://bulwarkblack.com/which-type-of-malware-resides-only-in-ram-explaining-fileless-malware/https://bulwarkblack.com/which-type-of-malware-resides-only-in-ram-explaining-fileless-malware/Read Article Explaining malware which resides only in RAM Unlike traditional malware, which typically involves downloading and running an executable file, fileless malware operates in the system’s memory (RAM) and often exploits legitimate tools (like PowerShell, WMI, or Windows Thu, 11 Jan 2024 16:01:14 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/hacked-in-china/https://bulwarkblack.com/hacked-in-china/Read Article foreign government’s response to a U.S. strategy document rarely earns front page coverage, but in the case of the Chinese Communist Party’s (CCP) recent reaction to the U.S. government’s new cyber strategy, we should all be paying attention. Tensions continue to escTue, 09 Jan 2024 23:18:24 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/financially-motivated-threat-actors-misusing-app-installer/https://bulwarkblack.com/financially-motivated-threat-actors-misusing-app-installer/Read Article Since mid-November 2023, Microsoft Threat Intelligence has observed threat actors, including financially motivated actors like Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674, utilizing the ms-appinstaller URI scheme (App Installer) to distribute malware. In Tue, 09 Jan 2024 19:14:14 GMTGeneral CTIhttps://bulwarkblack.com/opening-a-can-of-whoop-ads-detecting-and-disrupting-a-malvertising-campaign-distributing-backdoors/https://bulwarkblack.com/opening-a-can-of-whoop-ads-detecting-and-disrupting-a-malvertising-campaign-distributing-backdoors/Read Article Earlier this year, Mandiant’s Managed Defense threat hunting team identified an UNC2975 malicious advertising (“malvertising”) campaign presented to users in sponsored search engine results and social media posts, consistent with activity reported in From DarkGate toTue, 09 Jan 2024 18:53:58 GMTGlobal Cyber Threat Intelligencehttps://bulwarkblack.com/turkish-hackers-exploiting-poorly-secured-ms-sql-servers-across-the-globeturkish-hackers-exploiting-poorly-secured-ms-sql-servers-across-the-globe/https://bulwarkblack.com/turkish-hackers-exploiting-poorly-secured-ms-sql-servers-across-the-globeturkish-hackers-exploiting-poorly-secured-ms-sql-servers-across-the-globe/Read Article Poorly secured Microsoft SQL (MS SQL) servers are being targeted in the U.S., European Union, and Latin American (LATAM) regions as part of an ongoing financially motivated campaign to gain initial access. “The analyzed threat campaign appears to end in one of two waTue, 09 Jan 2024 17:36:16 GMTGeneral CTIhttps://bulwarkblack.com/the-underground-economist-volume-4-issue-1/https://bulwarkblack.com/the-underground-economist-volume-4-issue-1/https://www.zerofox.com/blog/the-underground-economist-volume-4-issue-1/ On December 27, 2023, threat actor “APTlord” announced on the dark web forum RAMP that they were selling source code and other information owned by marinetraffic[.]com, which was allegedly obtained by the thTue, 09 Jan 2024 17:26:50 GMTBusinesshttps://bulwarkblack.com/custom-gpts-a-case-of-malware-analysis-and-ioc-analyzing/https://bulwarkblack.com/custom-gpts-a-case-of-malware-analysis-and-ioc-analyzing/Read Article On November 6, 2023, CustomGPTs, a new feature that OpenAI stated on its blog, became available. We can already say that the emergence of Custom Generative Pre-trained Transformers (GPTs) could mark a significant shift in the dynamics of both digital defense and offeTue, 09 Jan 2024 17:12:15 GMTAI (General)https://bulwarkblack.com/analysis-of-ot-cyberattacks-and-malwares/https://bulwarkblack.com/analysis-of-ot-cyberattacks-and-malwares/Tue, 09 Jan 2024 16:12:04 GMTOperational Technology (OT)https://bulwarkblack.com/hardware-implants-as-an-initial-access-vector/https://bulwarkblack.com/hardware-implants-as-an-initial-access-vector/Read Article On every red team engagement, one of the first steps is to gain access to the target environment. Generally, red teams will leverage social engineering techniques to get their customer to run a payload sent through email or other digital means. Unfortunately for us, Mon, 08 Jan 2024 18:50:15 GMTOffensive Devices / Tacticshttps://bulwarkblack.com/red-pandas-unleashed-how-webhooks-bad-usb-and-wifi-collide-in-cyberspace/https://bulwarkblack.com/red-pandas-unleashed-how-webhooks-bad-usb-and-wifi-collide-in-cyberspace/Read Article The Power of Automation for Pentesting Automation has become a game-changer in the world of penetration testing. With the ever-increasing complexity of networks and systems, manually tracking and responding to security events is no longer viable. This is where webhooMon, 08 Jan 2024 17:46:54 GMTBusinesshttps://bulwarkblack.com/deceptive-cracked-software-spreads-lumma-variant-on-youtube/https://bulwarkblack.com/deceptive-cracked-software-spreads-lumma-variant-on-youtube/Read Article Initial Infection Vector The hacker initially breaches a YouTuber’s account and uploads videos masquerading as sharing cracked software. Figure 3 shows the video descriptions in which a malicious URL is embedded, enticing users to download a ZIP file that harbors malMon, 08 Jan 2024 17:30:14 GMTMalwarehttps://bulwarkblack.com/noname-on-rampage-claims-ddos-attacks-on-ukrainian-government-sites/https://bulwarkblack.com/noname-on-rampage-claims-ddos-attacks-on-ukrainian-government-sites/Read Article NoName ransomware group has allegedly targeted multiple Ukrainian government websites. The latest victims of the alleged NoName ransomware attack on Ukraine include Accordbank, Zaporizhzhya Titanium-Magnesium Plant, State Tax Service, Central Interregional Tax AdminiMon, 08 Jan 2024 17:19:33 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/alert-carbanak-malware-strikes-again-with-updated-tactics/https://bulwarkblack.com/alert-carbanak-malware-strikes-again-with-updated-tactics/Mon, 08 Jan 2024 17:11:40 GMTMalwarehttps://bulwarkblack.com/from-akamai-to-f5-to-ntlm-with-love/https://bulwarkblack.com/from-akamai-to-f5-to-ntlm-with-love/Read Article Discovery Note: This paper will be covering 1 smuggle gadget out of about 10 that I use in my testing, however this paper will show how this gadget, originally found by @albinowax, can be modified to pin one provider against another in a brutal fashion as you will reMon, 08 Jan 2024 16:05:46 GMTBug Bountyhttps://bulwarkblack.com/asyncrat-loader-obfuscation-dgas-decoys-and-govno/https://bulwarkblack.com/asyncrat-loader-obfuscation-dgas-decoys-and-govno/Read Article Executive summary AT&T Alien Labs has identified a campaign to deliver AsyncRAT onto unsuspecting victim systems. During at least 11 months, this threat actor has been working on delivering the RAT through an initial JavaScript file, embedded in a phishing page. AfteSun, 07 Jan 2024 21:06:01 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/chapter-84-in-depth-analysis-and-technical-analysis-of-lockbit-the-top-encryption-ransomware-organization-part-1/https://bulwarkblack.com/chapter-84-in-depth-analysis-and-technical-analysis-of-lockbit-the-top-encryption-ransomware-organization-part-1/Read Article Excerpt LockBit operators and affiliates will find ways to obtain the victim’s initial access rights and use them to deliver encrypted ransomware. The attack methods can be roughly divided into the following methods: 1. Extensive vulnerability scanning . Using Nday vSun, 07 Jan 2024 20:41:31 GMTMalwarehttps://bulwarkblack.com/javascript-malware-50000-bank-users-at-risk-worldwide/https://bulwarkblack.com/javascript-malware-50000-bank-users-at-risk-worldwide/IOC: jscdnpack[.]comSun, 07 Jan 2024 20:21:03 GMTMalwarehttps://bulwarkblack.com/oauth-endpoint-multilogin-identified-as-root-for-google-chromes-widely-adopted-session-jacking-exploit/https://bulwarkblack.com/oauth-endpoint-multilogin-identified-as-root-for-google-chromes-widely-adopted-session-jacking-exploit/https://www.csoonline.com/article/1285861/highly-exploited-chromium-bug-traced-to-a-google-oauth-endpoint.html An undocumented Google OAuth endpoint has been identified to be the root of the notorious info stealing exploit that is being widely implemented by various threat actorsSun, 07 Jan 2024 20:11:44 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/prior-to-cyber-attack-russian-attackers-spent-months-inside-the-ukraine-telecoms-giant/https://bulwarkblack.com/prior-to-cyber-attack-russian-attackers-spent-months-inside-the-ukraine-telecoms-giant/https://www.cysecurity.news/2024/01/prior-to-cyber-attack-russian-attackers.html Kyivstar experienced a large-scale malfunction in December 2023, resulting in the outage of mobile communications and the internet for about 24 million users for several days. How? Russian hackers brSun, 07 Jan 2024 20:02:23 GMTRussian Cyber Threat Intelligencehttps://bulwarkblack.com/hackers-modifying-registry-keys-to-establish-persistence-via-scheduled-tasks/https://bulwarkblack.com/hackers-modifying-registry-keys-to-establish-persistence-via-scheduled-tasks/Sat, 06 Jan 2024 02:05:48 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/tackling-anti-analysis-techniques-of-guloader-and-redline-stealer/https://bulwarkblack.com/tackling-anti-analysis-techniques-of-guloader-and-redline-stealer/https://unit42.paloaltonetworks.com/malware-configuration-extraction-techniques-guloader-redline-stealer/Fri, 05 Jan 2024 22:35:43 GMTMalwarehttps://bulwarkblack.com/hackers-target-apache-rocketmq-servers-vulnerable-to-rce-attacks/https://bulwarkblack.com/hackers-target-apache-rocketmq-servers-vulnerable-to-rce-attacks/https://www.bleepingcomputer.com/news/security/hackers-target-apache-rocketmq-servers-vulnerable-to-rce-attacks/Fri, 05 Jan 2024 22:24:59 GMTMalwarehttps://bulwarkblack.com/north-korea-debuts-spectralblur-malware-amid-macos-onslaught/https://bulwarkblack.com/north-korea-debuts-spectralblur-malware-amid-macos-onslaught/https://www.darkreading.com/threat-intelligence/north-korea-debuts-spectralblur-malware-amid-macos-onslaughtFri, 05 Jan 2024 22:02:32 GMTNorth Korean Cyber Threat Intelligencehttps://bulwarkblack.com/irans-apt33-targets-us-defense-contractors-with-novel-malware/https://bulwarkblack.com/irans-apt33-targets-us-defense-contractors-with-novel-malware/https://www.scmagazine.com/news/iranian-threat-group-apt33-targets-us-defense-contractors-with-novel-malwareFri, 05 Jan 2024 21:56:48 GMTIranian Cyber Threat Intelligencehttps://bulwarkblack.com/100-days-of-yara-2023/https://bulwarkblack.com/100-days-of-yara-2023/https://bitsofbinary.github.io/yara/2023/01/01/100daysofyara.htmlFri, 05 Jan 2024 20:48:52 GMTGlobal Cyber Threat Intelligencehttps://bulwarkblack.com/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideout/https://bulwarkblack.com/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideout/https://www.securityjoes.com/post/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideoutFri, 05 Jan 2024 20:35:07 GMTChinese Cyber Threat Intelligencehttps://bulwarkblack.com/russia-linked-apt-sandworm-was-inside-ukraine-telecoms-giant-kyivstar-for-months/https://bulwarkblack.com/russia-linked-apt-sandworm-was-inside-ukraine-telecoms-giant-kyivstar-for-months/Fri, 05 Jan 2024 19:59:22 GMTRussian Cyber Threat Intelligence