Category Archive
Privacy & Security
92 reports·All intelligence
Bulwark Black cyber threat intelligence filed under Privacy & Security.
Showing 1–24 of 92 reports
Malicious Terraform Providers Show Why IaC Needs Supply-Chain Controls
Aikido found Graphalgo-linked Go malware in Terraform providers and Go modules. The defensive lesson is that infrastructure-as-code dependencies need the same scrutiny as application packages, because they often execute near production credentials.
RemControl Shows Why Mobile Banking Fraud Needs App-Control Guardrails
Group-IB reported RemControl, a new Android banking trojan that combines fake app pages, Accessibility Service abuse, banking overlays, remote control, and AI-assisted criminal infrastructure. The defensive lesson: mobile devices that approve access or payments need app-control guardrails and incident playbooks.
CLOSEDQUORUM Shows Why AI C2 Needs Behavior-Based Detection
Cisco Talos documented CLOSEDQUORUM, an AI-assisted implant that uses multiple LLM providers to choose its next action. The defensive answer is correlation, not simple domain blocking.
M-26-15 Makes PQC Migration a Contractor Readiness Issue
OMB Memorandum M-26-15 turns post-quantum cryptography migration into a planning, inventory, procurement, and contractor-readiness problem. Federal agencies and vendors should start with cryptographic inventories, TLS 1.3 milestones, crypto-agile architecture, and contract language now.
Exposed AWS Keys Show Why Secret Scanning Needs Incident Runbooks
Unit 42 analyzed how AWS quarantines publicly exposed IAM access keys after GitHub secret-scanning detections. For SMBs and government contractors, the lesson is clear: provider automation helps, but cloud teams still need logging, rotation, and incident runbooks for leaked secrets.
Linux Kernel LPE Quartet Shows Why Patch Validation Matters
Four Linux kernel local-root vulnerabilities show why defenders need kernel patch validation, container-host prioritization, and attack-surface reduction—not just initial-access monitoring.
WaterPlum Shows Why Developer Hiring Needs Malware-Resistant Guardrails
North Korea-linked WaterPlum/Contagious Interview shows why developer hiring, coding tests, contractor onboarding, and workstation isolation need to be treated as one security workflow.
BragJack Shows Why AI Browser Agents Need Extension Controls
BragJack demonstrates how malicious extensions can hijack AI browser agents, turning browser add-ons into a higher-impact endpoint risk. Here are the practical controls SMBs and government contractors should prioritize.
Honeywell Settlement Shows NIST 800-171 Is a Billing Risk
DOJ’s Honeywell Aerospace settlement is a reminder that NIST 800-171 gaps can create False Claims Act exposure for defense contractors even without a public breach.
Passkey Phishing Shows Why Microsoft 365 Needs Enrollment Guardrails
Microsoft is tracking passkey-themed social engineering that turns MFA enrollment trust into Microsoft 365 cloud compromise. Here is what SMBs and government contractors should monitor and lock down.
Ransomware’s Long Tail Means Defenders Need Faster Triage
Check Point Research’s Q2 2026 ransomware data shows a wider operator ecosystem, faster exploitation windows, and lower payment rates. Here is what SMBs and government contractors should harden first.
Azure Directory Dumps Show Why Identity Data Is Attack Infrastructure
A reported Azure and Entra directory exfiltration campaign shows why cloud identity data, service accounts, and org charts need defensive monitoring before attackers weaponize them.
Signed ClickOnce Shows Fake Interviews Are Now a Credential-Theft Delivery System
A fake Web3 interview chain used a signed ClickOnce app to deliver stealers and a RAT. Here is what SMBs and government contractors should change in endpoint, identity, and hiring-workflow defenses.
Ghost Phishing Shows Why Email Security Must Follow the Browser
Ghost phishing hides the real lure until the browser renders it. Here is what SMBs and government contractors should do to defend Microsoft 365 identities.
Pakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic Targets
SentinelLabs reporting on rival espionage activity against Pakistani law enforcement is a reminder that public-sector portals, case systems, and citizen-data apps are strategic intelligence targets — even when they are not classified systems.
Bad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority Queue
Bad Epoll CVE-2026-46242 is a Linux kernel epoll race-condition LPE. Here is why SMBs and government contractors should prioritize kernel patching, developer endpoint hardening, and post-compromise controls.
Fake Payment SDKs Show Why Dependency Risk Is Credential Risk
Socket uncovered malicious npm and PyPI packages impersonating Paysafe, Skrill, and Neteller SDKs. Here is what SMBs and government contractors should do now to protect CI secrets, developer machines, and payment integrations.
Critical UniFi Flaws Put Network Control Planes Back in the Patch Queue
Ubiquiti patched critical UniFi Connect, Talk, Access, Protect, and UniFi OS flaws. Here is what SMBs and government contractors should patch, restrict, and review now.
ADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity Infrastructure
Mandiant shows how ADFS certificate drift and Machine DPAPI can expose active signing keys. Here is what SMBs and government contractors should do now.
UAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay Infrastructure
Cisco Talos reports UAT-7810 is expanding ORB relay infrastructure using compromised edge and embedded devices. Here is what SMBs and government contractors should do now.
FortiBleed Shows Firewall Credentials Are Ransomware Fuel
SOCRadar linked the FortiBleed FortiGate credential-harvesting campaign to INC and Lynx ransomware operations. Here is what SMBs and government contractors should do next.
NetNut and Popa Takedown Shows Residential Proxies Are Now Attack Infrastructure
The FBI and industry partners disrupted NetNut and the Popa botnet. Here is why residential proxy abuse matters for SMBs, government contractors, and defenders.
Vect and TeamPCP Show Supply-Chain Credentials Are Ransomware Fuel
Sophos CTU reports that Vect and TeamPCP have linked ransomware deployment with supply-chain credential theft. Here is what SMBs and government contractors should harden now.
Ousaban Shows Banking Trojans Are Learning to Hide From Sandboxes
Ousaban’s Spain and Portugal campaign shows how banking trojans use geofencing, phishing PDFs, steganography, and daily-changing C2 to evade sandbox-heavy defenses.