Skip to content
Bulwark BlackBulwark Black LLC
Latest
GitHub Enterprise SSRF Shows Why Secret Scanning Needs Network GuardrailsBlinder Tunnel Shows How Developer Trust Becomes Critical Infrastructure RiskBrowser Detection and Response Shows Why the Browser Is Now a Security Blind SpotApache Struts REST Plugin Flaws Show Why Legacy Java Apps Need Exposure ReviewClingSTUN Shows Why IoT Edge Devices Need Real Egress MonitoringApache Thrift 61-CVE Patch Shows Why RPC Frameworks Need InventoryNIST OT Zero Trust Guidance Shows Segmentation Must Reach Below Level 3Milk Dragon Shows Social Commerce Phishing Needs Identity and Payment ControlsCisco SD-WAN Auth Bypass Shows Edge Control Planes Need Emergency ReviewRansomware Data Theft Surge Shows Why Exfiltration Defense Comes FirstLive Exposed Credentials Show Why Secret Scanning Must End in RevocationAntino Backdoor Shows Why Microsoft 365 C2 Needs Cloud-Aware DetectionSession Cookie Bypass Shows Why SSO Is Not the Whole Trust BoundaryWarlock Ransomware Shows SharePoint Is Still Critical Infrastructure Risk

Intel Workbench · Beta

Campaign Constellation

Beta · Automated correlation

Campaign Constellation links reports that reuse two or more non-CVE indicators. Names now come from the strongest repeated campaign, malware, technique, or infrastructure evidence—not whichever report was published most recently. Actor names appear only when repeated reporting supports them, and co-occurrence still does not establish a common campaign, owner, or actor attribution.

Current, revalidating, and archived describe a research lifecycle, not universal maliciousness. Current requires two effective-current observations on the same report pair. Revalidating means that same pair could still reach two after unresolved boundary checks; unrelated pending observations cannot hold a constellation. Archived does not mean clean, benign, remediated, resolved, safe, or that the activity ended.

5 current·6 revalidating·3 archived·35 linked reports total

Current constellations (5)Revalidating (6) ↓Archived constellations (3) ↓

Reporting windows: IP/CIDR 14 days · domains/URLs 30 days · file identifiers 730 days · other context 90 days. Reporting windows use report publication dates, not provider sightings. Applicable enabled services supply a separate final archive decision; verified-feed admission remains a separate policy and output.

evidence core report planet shared indicator

Current correlations

Current Constellations

Report relationships where a particular pair still has two effective-current shared observations: inside their reporting window or held by fresh qualifying provider evidence.

5 constellations · 17 linked reports

Constellation Vishing ActivityInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Vishing Activity — Technique, 4/6 reportsApollo Breach Shows Why Helpdesk Vishing Is a Cloud-Control ProblemUNC6671 Shows Why Helpdesk Vishing Is a Cloud Data-Theft ProblemPink Extortion Shows Microsoft 365 Defense Starts With Vishing ControlsBlackFile Vishing Campaign Shows Why MFA Alone Is Not EnoughPasskey Phishing Shows Why Microsoft 365 Needs Enrollment GuardrailsAI Invoice Fraud Shows Why Finance Needs Verification Controls185[.]178[.]208[.]153add-passkey.comdeploypasskey[.]comkeysyncos.comoskeyconnect.comoskeysync.com

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+82 indicators not plotted

Constellation Vishing Activity

Current correlationStrong evidence

Technique4/6 reports86 shared indicatorsSnapshot BB-CST-8BCFDD3E25B01A6F

4 of 6 reports explicitly reference vishing; 86 indicators recur across that supporting set.

Reporting window boundary · effective-current pair support remains

Reports

Shared infrastructure

add-passkey.comdeploypasskey[.]comkeysyncos.comoskeyconnect.comoskeysync.compasskeyadd[.]compasskeydeploy[.]compasskeyhelpdesk.compasskeyms[.]comportalsetuphub.comsecure-passkey.comsetupsso[.]com185[.]178[.]208[.]153activatemypasskey[.]comactivatepasskey[.]comactivatepasskeyportal[.]comaddmypasskey[.]comaddoktapasskey[.]comaddpasskey2fa[.]comaddssopasskey[.]comaddyourpasskey[.]comassignpasskey[.]comcreatemfa[.]comcreatemypasskey[.]com+64 more
Constellation GRIDTIDEInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation GRIDTIDE — Malware, 3/5 reportsGoogle Disrupts Chinese APT UNC2814’s GRIDTIDE Backdoor Campaign Targeting 42 CountriesGoogle and Mandiant Disrupt GRIDTIDE: Chinese APT Espionage Campaign Compromises 53 Victims in 42 CountriesGoogle Disrupts UNC2814 GRIDTIDE Campaign: Chinese APT Breaches 53 Organizations Across 42 CountriesHoneyMyte’s CoolClient Rootkit Shows Why Kernel Visibility MattersPoisoned Search and AI Recommendations Turn Utility Downloads Into RMM Accessgiize[.]comcasacam[.]netgleeze[.]comtheworkpc[.]com01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb130[.]94[.]6[.]228

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+235 indicators not plotted

Constellation GRIDTIDE

Current correlationStrong evidence

Malware3/5 reports241 shared indicatorsSnapshot BB-CST-951CB00E4C4C6984

3 of 5 reports explicitly reference GRIDTIDE; 241 indicators recur across that supporting set.

Reporting window boundary · effective-current pair support remains

Reports

Shared infrastructure

giize[.]comcasacam[.]netgleeze[.]comtheworkpc[.]com1cv2f3d5s6a9w[.]ddnsfree[.]comaccesscam[.]orgadmina[.]freeddns[.]orgafsaces[.]accesscam[.]organcisesic[.]accesscam[.]orgapplebox[.]camdvr[.]orgappler[.]kozow[.]comasdad21ww[.]freeddns[.]orgaw2o25forsbc[.]camdvr[.]orgawcc001jdaigfwdagdcew[.]giize[.]combab2o25com[.]accesscam[.]orgbabaji[.]accesscam[.]orgbabi5599ss[.]ddnsgeek[.]combalabalabo[.]mywire[.]orgbggs[.]giize[.]combibabo[.]freeddns[.]orgbinmol[.]webredirect[.]orgbioth[.]giize[.]comboemobww[.]ddnsfree[.]combrcallletme[.]theworkpc[.]com+217 more
Constellation Signed ClickOnceInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Signed ClickOnce — Technique, 2/2 reportsSigned ClickOnce Lures Show Why Hiring Workflows Need Endpoint GuardrailsSigned ClickOnce Shows Fake Interviews Are Now a Credential-Theft Delivery System1[.]0[.]0[.]1821[.]0[.]0[.]201112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc12730a7dd9af98f14441d476c10eb346708c119431[.]76[.]7[.]13745[.]125[.]67[.]42

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+22 indicators not plotted

Constellation Signed ClickOnce

Current correlationStrong evidence

Technique2/2 reports28 shared indicatorsSnapshot BB-CST-2226F80BD265E826

2 of 2 reports explicitly reference Signed ClickOnce; 28 indicators recur across that supporting set.

Reporting window boundary · effective-current pair support remains

Reports

Shared infrastructure

apidrive[.]onlineauth3gapi[.]onlinediegovalanire[.]digitalgapiauth[.]infogapiauth[.]netgapiconnect[.]comgapidriver[.]comgapioath[.]comwww[.]dropbox[.]com112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc12730a7dd9af98f14441d476c10eb346708c1194487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea28064d6abbfc7c052cbafaa53659971ac4717866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf7299c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0aa7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50afafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd1[.]0[.]0[.]1821[.]0[.]0[.]20131[.]76[.]7[.]13745[.]125[.]67[.]4291[.]219[.]238[.]169hxxps://diegovalanire[.]digital+4 more
Constellation APT37 Ruby JumperInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation APT37 Ruby Jumper — Campaign, 2/2 reportsAPT37 Ruby Jumper Campaign: North Korean Hackers Deploy Malware Arsenal to Bridge Air-Gapped NetworksAPT37 Deploys Ruby Jumper Campaign to Breach Air-Gapped Networks098d697f29b94c11b52c51bfe8f9c47d144[.]172[.]106[.]664214818d7cde26ebeb4f35bc2fc29ada476bce9b9a387c5f39461d781e7e22b957dac5f7d21da2454d0fbefdced80bf3585322a931a49f4e1d78fb0b3f3c6212

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+13 indicators not plotted

Constellation APT37 Ruby Jumper

Current correlationStrong evidence

Campaign2/2 reports19 shared indicatorsSnapshot BB-CST-711F25C272A7C833

2 of 2 reports explicitly reference APT37 and Ruby Jumper; 19 indicators recur across that supporting set.

Reporting window boundary · effective-current pair support remains

Reports

Shared infrastructure

hightkdhe[.]storehomeatedke[.]storephilion[.]storewww[.]hightkdhe[.]storewww[.]homeatedke[.]storewww[.]philion[.]store098d697f29b94c11b52c51bfe8f9c47d4214818d7cde26ebeb4f35bc2fc29ada476bce9b9a387c5f39461d781e7e22b957dac5f7d21da2454d0fbefdced80bf3585322a931a49f4e1d78fb0b3f3c62125c6ff601ccc75e76c2fc99808d8cc9a9709d70239f1e9441e8e21fcacfdc5d08ad556f4eb48e7dba6da14444dcce3170ed54cf1ebffbfc1c8ae1ccdd2c681012144[.]172[.]106[.]66hxxps://www[.]hightkdhe[.]store/star/main[.]phphxxps://www[.]homeatedke[.]store/star/main[.]phphxxps://www[.]philion[.]store/star/main[.]php
Constellation Shared Infrastructure · B27A25Interactive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Shared Infrastructure · B27A25 — Unclassified, 2/2 reportsOWAReaper Shows Why Exchange Mailboxes Need Post-Patch Compromise ReviewTA488 Turns Outlook Web Access Into a Stealthy Persistence Layer6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4acocdn[.]comasecdns[.]comdnsrecursive[.]eui3[.]wp[.]comimages[.]weserv[.]nl

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+2 indicators not plotted

Constellation Shared Infrastructure · B27A25

Current correlationWeak evidence

Unclassified2/2 reports8 shared indicatorsSnapshot BB-CST-A0A93BE82BB27A25

No campaign, actor, malware, or technique repeats strongly enough to name this cluster; 8 observables link 2 reports.

Reporting window boundary · effective-current pair support remains

Reports

Shared infrastructure

acocdn[.]comasecdns[.]comdnsrecursive[.]eui3[.]wp[.]comimages[.]weserv[.]nlslack-imgs[.]comtdndns[.]com6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4

Pre-archive control

Revalidating Constellations

Relationships with no currently qualifying pair, but where the same report pair could still reach two supporting observations after unresolved review or provider checks complete.

6 constellations · 12 linked reports

Missing, unavailable, pending, and review states hold the relevant relationship here. No outage or absent result is treated as permission to archive.

Constellation M365 / OWA InfrastructureInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation M365 / OWA Infrastructure — Infrastructure, 2/2 reportsRussian Auth-Flow Phishing Shows MFA Can Be Bypassed Without ExploitsCaptiveCrunch Shows Why Travel Wi-Fi Is an Identity Attack Surface104[.]194[.]159[.]15031[.]57[.]243[.]15438[.]146[.]28[.]75be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42cm365-owa[.]comms365-device[.]com

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+2 indicators not plotted

Constellation M365 / OWA Infrastructure

Revalidation holdModerate evidence

Infrastructure2/2 reports8 shared indicatorsSnapshot BB-CST-022901EECADC3FC7

4 shared indicators match M365 and OWA infrastructure across 2 of 2 reports; 8 indicators recur across that supporting set.

Reporting window boundary · archive decision unresolved

Reports

Shared infrastructure

m365-owa[.]comms365-device[.]comms365-live[.]comowa-ms365[.]combe99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c104[.]194[.]159[.]15031[.]57[.]243[.]15438[.]146[.]28[.]75
Constellation Shared Infrastructure · EE8A27Interactive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Shared Infrastructure · EE8A27 — Unclassified, 2/2 reportsToy Ghouls Shows Why Custom C2 Needs Protocol-Aware MonitoringVoid Dokkaebi’s InvisibleFerret Shift Shows Developer Endpoints Are Production Riskhxxp://ip-api[.]com/jsonip-api[.]com

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Shared Infrastructure · EE8A27

Revalidation holdWeak evidence

Unclassified2/2 reports2 shared indicatorsSnapshot BB-CST-0CFD9DDF95EE8A27

No campaign, actor, malware, or technique repeats strongly enough to name this cluster; 2 observables link 2 reports.

Reporting window boundary · archive decision unresolved

Reports

Shared infrastructure

ip-api[.]comhxxp://ip-api[.]com/json
Constellation Remote HiringInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Remote Hiring — Named activity, 2/2 reportsNisos DPRK Investigation Shows Why Remote Hiring Is a Security ControlPurpleDelta Shows Why Remote Hiring Is Now an Insider-Risk Control167[.]88[.]61[.]117167[.]88[.]61[.]250

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Remote Hiring

Revalidation holdModerate evidence

Named activity2/2 reports2 shared indicatorsSnapshot BB-CST-328914F4EB969414

2 of 2 reports repeat Remote Hiring; 2 indicators recur across that supporting set.

Reporting window boundary · archive decision unresolved

Reports

Shared infrastructure

167[.]88[.]61[.]117167[.]88[.]61[.]250
Constellation NeedInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Need — Named activity, 2/2 reportsLLM Safety Fragility Shows Why AI Workflows Need Runtime Guardrails84 4G/5G Core Flaws Show Why Telecom Trust Zones Need Zero Trustdoi[.]orgscite[.]ai

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Need

Revalidation holdModerate evidence

Named activity2/2 reports2 shared indicatorsSnapshot BB-CST-C6376EE7A59C3193

2 of 2 reports repeat Need; 2 indicators recur across that supporting set.

Reporting window boundary · archive decision unresolved

Reports

Shared infrastructure

doi[.]orgscite[.]ai
Constellation OAST Service ReferencesInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation OAST Service References — Reference only, 2/2 reportsAI Infrastructure Is Becoming a Control Plane Attack SurfaceUnit 42 Exposes Active Exploitation of BeyondTrust CVE-2026-1731 with VShell and SparkRAT Backdoorsoast[.]funoast[.]pro

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation OAST Service References

Revalidation holdReference-only evidence

Reference only2/2 reports2 shared indicatorsSnapshot BB-CST-3F5DF6F7C58C00FB

2 shared indicators match generic OAST service references across 2 of 2 reports; 2 indicators recur across that supporting set.

Reporting window boundary · archive decision unresolved

This link is retained for transparency, but generic reference infrastructure is weak evidence of a meaningful threat relationship.

Reports

Shared infrastructure

oast[.]funoast[.]pro
Constellation LiteLLM InfrastructureInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation LiteLLM Infrastructure — Infrastructure, 2/2 reportsShai-Hulud Shows AI Package Scanners Need Prompt-Injection BoundariesLiteLLM Supply Chain Attack: TeamPCP Deploys Multi-Stage Credential Stealer to 95M Monthly Downloadslitellm[.]cloudmodels[.]litellm[.]cloud

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation LiteLLM Infrastructure

Revalidation holdModerate evidence

Infrastructure2/2 reports2 shared indicatorsSnapshot BB-CST-6F4BA0E9ACC71C32

2 shared indicators match LiteLLM infrastructure across 2 of 2 reports; 2 indicators recur across that supporting set.

Reporting window boundary · archive decision unresolved

Reports

Shared infrastructure

litellm[.]cloudmodels[.]litellm[.]cloud

Historical research

Archived Constellations

Historical report correlations with no report pair supported by two effective-current or unresolved observations. They remain available for research and attribution review.

3 constellations · 6 linked reports

Provider-supported observations require a completed archive-cleared boundary decision; context-only types remain recency-only. Archive-cleared is not a clean verdict, proof of remediation, or permission to treat this infrastructure as safe.

Constellation Nodies RPC InfrastructureInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Nodies RPC Infrastructure — Shared service, 2/2 reportsAeternum Shows Why Blockchain-Based C2 Is a Practical Defense ProblemDeadLock Ransomware Shows Why Recovery Infrastructure Is Part of the Attack Surfacenodies[.]apppolygon-pokt[.]nodies[.]app

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Nodies RPC Infrastructure

Archived correlationWeak evidence

Shared service2/2 reports2 shared indicatorsSnapshot BB-CST-08F6227DB0C6A05B

2 shared indicators match public Nodies RPC infrastructure across 2 of 2 reports; 2 indicators recur across that supporting set.

Reporting window boundary · lifecycle state evaluated separately

Reports

Shared infrastructure

nodies[.]apppolygon-pokt[.]nodies[.]app
Constellation ICANN ReferencesInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation ICANN References — Reference only, 2/2 reportsSonicWall SMA Exploit Chain Shows Why VPN Appliances Need Incident Response, Not Just PatchingNetNut and Popa Takedown Shows Residential Proxies Are Now Attack Infrastructurehxxps://icann[.]org/epp#clientTransferProhibitedicann[.]org

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation ICANN References

Archived correlationReference-only evidence

Reference only2/2 reports2 shared indicatorsSnapshot BB-CST-3C99569E1CC895E3

2 shared indicators match boilerplate ICANN EPP references across 2 of 2 reports; 2 indicators recur across that supporting set.

Reporting window boundary · lifecycle state evaluated separately

This link is retained for transparency, but generic reference infrastructure is weak evidence of a meaningful threat relationship.

Reports

Shared infrastructure

icann[.]orghxxps://icann[.]org/epp#clientTransferProhibited
Constellation Critical LangflowInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Critical Langflow — Named activity, 2/2 reportsCVE-2026-33017: Critical Langflow AI Platform Flaw Exploited Within 20 Hours of DisclosureCritical Langflow AI Platform Flaw CVE-2026-33017 Exploited Within 20 Hours of Disclosure173[.]212[.]205[.]251173[.]212[.]205[.]251:8443

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Critical Langflow

Archived correlationModerate evidence

Named activity2/2 reports2 shared indicatorsSnapshot BB-CST-5F13D38F8AEC3D87

2 of 2 reports repeat Critical Langflow; 2 indicators recur across that supporting set.

Reporting window boundary · lifecycle state evaluated separately

Reports

Shared infrastructure

173[.]212[.]205[.]251173[.]212[.]205[.]251:8443
Intel Workbench →Indicator Database →IOC Archive →Machine-readable feeds →

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.