Contractor Codex SaaS · Web app
Quote. Contract. Bill. Get Paid.
Send a quote in 60 seconds, get it signed online, and auto-invoice every stage of the job.
Cyber Threat Intelligence
Daily threat reporting, custom software, and remote tech help from a veteran-owned (SDVOSB) studio.
Updated most weekdays
Our Software
Software we build and run
SAMscout AI SaaS · Web app
The federal proposal team you can afford.
Turn a SAM.gov opportunity into a reviewable, Shipley-grade proposal draft in minutes.
VA Disability Calc & Track iOS · iPhone & iPad
Know your rating. Track your claim.
BVA-accurate combined-rating math and claim tracking, private on your device.
The Feed
Latest Threat Intelligence
Cyber Security Blog
Cyber Security Blog·
Critical UniFi Flaws Put Network Control Planes Back in the Patch Queue
Ubiquiti patched critical UniFi Connect, Talk, Access, Protect, and UniFi OS flaws. Here is what SMBs and government contractors should patch, restrict, and review now.
Cyber Security Blog
Cyber Security Blog·
Vidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak Controls
Unit 42 reported a Vidar stealer and XMRig campaign using malvertising, fake cracked-software lures, misleading certificate metadata, oversized binaries, and commodity loader infrastructure. Here is what SMBs and government contractors should take away.
Cyber Security Blog
Cyber Security Blog·
ADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity Infrastructure
Mandiant shows how ADFS certificate drift and Machine DPAPI can expose active signing keys. Here is what SMBs and government contractors should do now.
Chinese Cyber Threat Intelligence
Chinese Cyber Threat Intelligence·
UAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay Infrastructure
Cisco Talos reports UAT-7810 is expanding ORB relay infrastructure using compromised edge and embedded devices. Here is what SMBs and government contractors should do now.
Cyber Security Blog
Cyber Security Blog·
FortiBleed Shows Firewall Credentials Are Ransomware Fuel
SOCRadar linked the FortiBleed FortiGate credential-harvesting campaign to INC and Lynx ransomware operations. Here is what SMBs and government contractors should do next.
Cyber Security Blog
Cyber Security Blog·
NetNut and Popa Takedown Shows Residential Proxies Are Now Attack Infrastructure
The FBI and industry partners disrupted NetNut and the Popa botnet. Here is why residential proxy abuse matters for SMBs, government contractors, and defenders.
Cyber Security Blog
Cyber Security Blog·
Vect and TeamPCP Show Supply-Chain Credentials Are Ransomware Fuel
Sophos CTU reports that Vect and TeamPCP have linked ransomware deployment with supply-chain credential theft. Here is what SMBs and government contractors should harden now.
Cyber Security Blog
Cyber Security Blog·
Ousaban Shows Banking Trojans Are Learning to Hide From Sandboxes
Ousaban’s Spain and Portugal campaign shows how banking trojans use geofencing, phishing PDFs, steganography, and daily-changing C2 to evade sandbox-heavy defenses.
Cyber Security Blog
Cyber Security Blog·
NUT upsmon Command Injection Shows UPS Monitoring Belongs in the Patch Queue
CVE-2026-54161 in Network UPS Tools upsmon shows why UPS monitoring, notification scripts, and power-infrastructure control paths need patching, segmentation, and process monitoring.
More headlines
Cyber Security Blog
Cyber Security Blog
ARToken Shows Microsoft 365 Tokens Are the New BEC Control Plane
Cyber Security Blog
Cyber Security Blog
CitrixBleed Keeps Returning: NetScaler SAML IdP Memory Leaks Need Edge-Control Discipline
Cyber Security Blog
Cyber Security Blog
SimpleHelp Exploitation Shows RMM Is a Credential Control Plane
AI (General)
AI (General)
Leaky iOS AI Apps Show Mobile AI Needs Real API Gateways
Cyber Security Blog
Cyber Security Blog
Bing SEO Poisoning Shows IT Admin Downloads Are Ransomware Initial Access
Chinese Cyber Threat Intelligence
Chinese Cyber Threat Intelligence
Water Systems Are Becoming Nation-State Pressure Points
Nation-State Tracking
Intelligence by Region
Russian Threat Intelligence
View all Russian intel →Chinese Cyber Threat Intelligence
Chinese Cyber Threat Intelligence·
Water Systems Are Becoming Nation-State Pressure Points
Nation-state targeting of water systems shows why exposed OT, weak credentials, remote access, and poor IT/OT segmentation remain practical business risks—not just utility-sector problems.
Cyber Security Blog
Cyber Security Blog·
Turla’s STOCKSTAY Backdoor Shows Why Espionage Defense Needs Egress Visibility
GTIG’s STOCKSTAY research shows how Turla blends modular .NET malware, WebSocket C2, and diplomatic targeting. Here are the defensive lessons for SMBs and government contractors.
Cyber Security Blog
Cyber Security Blog·
Kazuar Shows Russian Espionage Malware Is Engineering for Resilience
Microsoft reports that Kazuar, attributed to Russian state actor Secret Blizzard, has evolved into a modular P2P botnet. Here is what SMBs and government contractors should take from it defensively.
Chinese Threat Intelligence
View all Chinese intel →Chinese Cyber Threat Intelligence
Chinese Cyber Threat Intelligence·
Pakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic Targets
SentinelLabs reporting on rival espionage activity against Pakistani law enforcement is a reminder that public-sector portals, case systems, and citizen-data apps are strategic intelligence targets — even when they are not classified systems.
Chinese Cyber Threat Intelligence
Chinese Cyber Threat Intelligence·
UAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay Infrastructure
Cisco Talos reports UAT-7810 is expanding ORB relay infrastructure using compromised edge and embedded devices. Here is what SMBs and government contractors should do now.
Chinese Cyber Threat Intelligence
Chinese Cyber Threat Intelligence·
Water Systems Are Becoming Nation-State Pressure Points
Nation-state targeting of water systems shows why exposed OT, weak credentials, remote access, and poor IT/OT segmentation remain practical business risks—not just utility-sector problems.
North Korean Threat Intelligence
View all North Korean intel →AI (General)
AI (General)·
Mastra npm Compromise Shows AI Frameworks Are Supply-Chain Targets
Microsoft linked the Mastra AI npm package compromise to North Korean actor Sapphire Sleet. Here is what SMBs and government contractors should do about AI framework supply-chain risk.
Cyber Security Blog
Cyber Security Blog·
Void Dokkaebi’s InvisibleFerret Shift Shows Developer Endpoints Are Production Risk
Trend Micro reports North Korea-aligned Void Dokkaebi has moved InvisibleFerret into Cython-compiled Python extension modules. For SMBs and government contractors, the real risk is developer endpoint access to CI/CD, cloud, and production secrets.
North Korean Cyber Threat Intelligence
North Korean Cyber Threat Intelligence·
DPRK Threat Actors Leverage GitHub as Command and Control Infrastructure in Multi-Stage LNK Attacks
North Korean state-sponsored threat actors have been observed targeting South Korean organizations with a sophisticated multi-stage attack chain that abuses GitHub as command and control (C2) infrastructure. Fortinet FortiGuard Labs published research on April 2, 2026 detailing t
Iranian Threat Intelligence
View all Iranian intel →Chinese Cyber Threat Intelligence
Chinese Cyber Threat Intelligence·
Water Systems Are Becoming Nation-State Pressure Points
Nation-state targeting of water systems shows why exposed OT, weak credentials, remote access, and poor IT/OT segmentation remain practical business risks—not just utility-sector problems.
Cyber Security Blog
Cyber Security Blog·
MuddyWater’s Chaos Masquerade Shows Ransomware Response Needs Attribution Discipline
Iran-linked MuddyWater activity shows why ransomware response needs to examine identity compromise, remote access, and adversary objectives instead of trusting the ransom note at face value.
Cyber Security Blog
Cyber Security Blog·
Handala’s Cal Water Claim Shows OT Defense Starts With Segmentation
Handala’s California Water Service claim is a reminder that critical-infrastructure defense starts with proving separation between billing systems, telemetry platforms, and operational technology.
Browse by category
Cyber Security Blog 91 General CTI 64 Malware 45 Chinese Cyber Threat Intelligence 38 AI (General) 30 Threat Intelligence 22 Iranian Cyber Threat Intelligence 19 Russian Cyber Threat Intelligence 18 Business 14 North Korean Cyber Threat Intelligence 10 Bug Bounty 8 Operational Technology (OT) 7 Offensive Devices / Tactics 6 Global Cyber Threat Intelligence 5 Becoming Self Sufficient 3 Makes you Think 2 Social Engineering 2 Red Teaming 2 Detection 2 Research Papers 1 Projects 1 Digital Assets 1 Training 1
Beyond the feed
Bulwark Black also builds
All services →Websites & Web Apps
Fast, clean marketing sites and custom web apps built for your business, not a template you have to fight. Designed, built, and deployed by the person who will maintain it.
Custom iOS Apps
Native iPhone and iPad apps built for businesses and published to the App Store. From a focused single-purpose tool to a full product, designed, developed, and shipped end to end.
AI & Automation
Practical AI setup and quiet automation that saves you real hours. We pick the right tools, wire them into how you actually work, and skip the hype when it does not fit.
Small-Business IT + Cybersecurity
Right-sized IT support and security fundamentals for small teams, delivered remotely. Backups that actually restore, hardened accounts, and someone honest to call.
You may have missed
Cyber Security Blog
Cyber Security Blog·
Fluentd Vulnerabilities Show Logging Pipelines Need Production-Grade Segmentation
Multiple Fluentd vulnerabilities show why log collectors need segmentation, least privilege, and hostile-input assumptions—not just patching.
Cyber Security Blog
Cyber Security Blog·
Shai Hulud Shows CI/CD Identity Is Production Cloud Identity
Fortinet’s Shai Hulud case study shows how poisoned CI/CD dependencies can become cloud identity compromise, IAM escalation, and Redshift data theft. Here is what SMBs and government contractors should harden now.
AI (General)
AI (General)·
Clean Repos Can Still Burn Developer Machines When AI Agents Trust Runtime Setup
A clean-looking repository can still become dangerous when an AI coding agent follows setup instructions and executes runtime-fetched configuration. Here is how teams should defend developer workflows.
Cyber Security Blog
Cyber Security Blog·
Splunk Enterprise RCE Shows SIEM Servers Are Tier-Zero Infrastructure
CVE-2026-20253 shows why Splunk and other SIEM platforms need tier-zero hardening: patch quickly, restrict management access, review service accounts, and hunt for suspicious file writes.
Newsletter
The Bulwark Brief.
Cyber threat intel, AI, and tech worth your attention, what we're tracking that day, with a "why it matters" line on every item. Most weekdays. No fluff.