Cyber Threat Intelligence
Daily threat reporting, custom software, and remote tech help from a veteran-owned (SDVOSB) studio.
Updated most weekdays
Our Software
Explore all software →
Quote. Contract. Bill. Get Paid.
Send a quote in 60 seconds, get it signed online, and auto-invoice every stage of the job.
Nation-State Tracking
Intelligence by Region
Russian Threat Intelligence
View all Russian intel →
Cyclops Blink on Cisco FMC Shows Why Edge Appliances Need Compromise Review
Sophos CTU and Cisco Talos reporting on Cyclops Blink activity against Cisco Secure FMC shows why edge security appliances need compromise review, not just emergency patching.
OWAReaper Shows Why Exchange Mailboxes Need Post-Patch Compromise Review
Resecurity’s OWAReaper report shows why on-prem Exchange response cannot stop at patching: defenders need mailbox-permission audits, token revocation, OWA exposure control, and post-patch compromise review.
Russian Auth-Flow Phishing Shows MFA Can Be Bypassed Without Exploits
Russian-linked clusters are abusing app passwords, OAuth consent, device-code login, WhatsApp linking, and captive portals. The defense is visibility and governance around authorization flows—not just MFA at login.
Chinese Threat Intelligence
View all Chinese intel →
NeedyMantis Shows Why Post-Compromise Malware Needs Full Intrusion Review
Microsoft’s NeedyMantis analysis shows why targeted malware found after initial access should trigger full intrusion review, not a simple cleanup ticket.
UTA0565 Shows Why Browser Zero-Days Need Endpoint Correlation
Volexity reporting on UTA0565 shows how fake websites, Chrome zero-days, Windows privilege escalation, and CLEANGULP malware turn normal browsing into endpoint compromise. Here are practical controls for SMBs and government contractors.
Fire Ant Shows Why Trusted Infrastructure Needs First-Class Detection
Sygnia’s Fire Ant report shows how routers, TACACS, tunnels, and Linux management hosts can become attacker-controlled infrastructure. The defensive priority is treating the management plane as a monitored, hardened asset class.
North Korean Threat Intelligence
View all North Korean intel →
Ted Backdoor Shows Why Edge Load Balancers Need Compromise Review
Rapid7’s DPRK-attributed ted backdoor and curlRAT research shows why HAProxy, SSH, cron, and other Linux edge services need integrity checks, centralized logs, and post-compromise review.
Nisos DPRK Investigation Shows Why Remote Hiring Is a Security Control
Nisos’ DPRK employment-fraud investigation shows why remote hiring, contractor onboarding, identity verification, and access control now belong in the same security conversation.
PurpleDelta Shows Why Remote Hiring Is Now an Insider-Risk Control
Recorded Future’s PurpleDelta research shows North Korean IT worker operations using fabricated personas, AI-assisted interviews, remote desktop tooling, and facilitators to enter legitimate remote technical roles. Defenders should treat hiring, identity proofing, endpoint onboarding, and contractor access as one security workflow.
Iranian Threat Intelligence
View all Iranian intel →
NodeRabbit and PollCat Show Why Developer Workstations Need Recruiting-Lure Controls
Mirage Kitten’s NodeRabbit and PollCat malware campaigns show why fake recruiter coding tests are a practical workstation, credential, and supply-chain risk for SMBs and government contractors.
HOLLOWGRAPH Shows Why Microsoft 365 Is Now Part of the C2 Battlefield
Group-IB’s HOLLOWGRAPH research shows how attackers can turn Microsoft 365 calendars, Graph API traffic, and DNS into covert command-and-control. Here is what SMBs and government contractors should hunt for now.
Water Systems Are Becoming Nation-State Pressure Points
Nation-state targeting of water systems shows why exposed OT, weak credentials, remote access, and poor IT/OT segmentation remain practical business risks—not just utility-sector problems.
Browse by category
Beyond the feed
Bulwark Black also builds
All services →Websites & Web Apps
Fast, clean marketing sites and custom web apps built for your business, not a template you have to fight. Designed, built, and deployed by the person who will maintain it.
Custom iOS Apps
Native iPhone and iPad apps built for businesses and published to the App Store. From a focused single-purpose tool to a full product, designed, developed, and shipped end to end.
AI & Automation
Practical AI setup and quiet automation that saves you real hours. We pick the right tools, wire them into how you actually work, and skip the hype when it does not fit.
Small-Business IT + Cybersecurity
Right-sized IT support and security fundamentals for small teams, delivered remotely. Backups that actually restore, hardened accounts, and someone honest to call.
You may have missed
Exposed AWS Keys Show Why Secret Scanning Needs Incident Runbooks
Unit 42 analyzed how AWS quarantines publicly exposed IAM access keys after GitHub secret-scanning detections. For SMBs and government contractors, the lesson is clear: provider automation helps, but cloud teams still need logging, rotation, and incident runbooks for leaked secrets.
PAYLOAD Ransomware Shows Why Group Policy Is a Tier-0 Attack Surface
Kaspersky reported a PAYLOAD ransomware incident where attackers abused Active Directory Group Policy to disrupt domain-joined Windows systems without deploying a Windows encryptor. The lesson for SMBs and government contractors: Group Policy needs Tier-0 monitoring, change control, and recovery planning.
Orkes Conductor RCE Shows Why Workflow APIs Need Hard Network Boundaries
Attackers are actively targeting Orkes Conductor deployments vulnerable to CVE-2026-58138, an unauthenticated remote code execution flaw in workflow script evaluators. The practical lesson: workflow APIs and automation control planes need patching, segmentation, and tight exposure control.
Linux Kernel LPE Quartet Shows Why Patch Validation Matters
Four Linux kernel local-root vulnerabilities show why defenders need kernel patch validation, container-host prioritization, and attack-surface reduction—not just initial-access monitoring.
Newsletter
The House-Of-L Brief.
Two short reads a day. Mornings cover markets, cyber threats, and what changed overnight. Evenings cover how AI, energy, and geopolitics are moving the world. A "why it matters" line on every story. A roundup every Sunday.
readers get The Brief
Double opt-in. One-click unsubscribe on every issue. We never share your address.