Skip to content
Bulwark Black Bulwark Black LLC
Latest
Jscrambler npm Compromise Shows Build Pipelines Need Runtime ControlsGhost Phishing Shows Why Email Security Must Follow the BrowserPakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic TargetsBad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority QueueFake Payment SDKs Show Why Dependency Risk Is Credential RiskCritical UniFi Flaws Put Network Control Planes Back in the Patch QueueVidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak ControlsADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity InfrastructureUAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay InfrastructureFortiBleed Shows Firewall Credentials Are Ransomware FuelNetNut and Popa Takedown Shows Residential Proxies Are Now Attack InfrastructureVect and TeamPCP Show Supply-Chain Credentials Are Ransomware FuelOusaban Shows Banking Trojans Are Learning to Hide From SandboxesNUT upsmon Command Injection Shows UPS Monitoring Belongs in the Patch Queue

Threat Intelligence

Shared Infrastructure

When separate reports reuse the same domains, IPs, or malware, they are usually the same campaign or actor toolkit. We link reports that share two or more indicators (vulnerabilities aside) into clusters, so you can pivot from one report to everything that shares its infrastructure.

7 clusters · 17 linked reports

report shared indicator
Poisoned Search and AI Recommendations Turn Utility Downloads Into RMM Access Google Disrupts Chinese APT UNC2814’s GRIDTIDE Backdoor Campaign Targeting 42 Countries Google and Mandiant Disrupt GRIDTIDE: Chinese APT Espionage Campaign Compromises 53 Victims in 42 Countries Google Disrupts UNC2814 GRIDTIDE Campaign: Chinese APT Breaches 53 Organizations Across 42 Countries giize[.]com gleeze[.]com 01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb 130[.]94[.]6[.]228 139[.]180[.]219[.]115 139[.]84[.]236[.]237 149[.]28[.]128[.]128 149[.]28[.]139[.]125 178[.]79[.]188[.]181 195[.]123[.]211[.]70

Cluster 1

4 reports · 243 shared indicators

Reports

Shared infrastructure

giize[.]comgleeze[.]com01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb130[.]94[.]6[.]228139[.]180[.]219[.]115139[.]84[.]236[.]237149[.]28[.]128[.]128149[.]28[.]139[.]125178[.]79[.]188[.]181195[.]123[.]211[.]70195[.]123[.]226[.]2351cv2f3d5s6a9w[.]ddnsfree[.]com202[.]59[.]10[.]122207[.]148[.]73[.]1838[.]180[.]205[.]1438[.]54[.]112[.]18438[.]54[.]31[.]14638[.]54[.]32[.]24438[.]54[.]37[.]19638[.]54[.]82[.]6938[.]60[.]171[.]24238[.]60[.]194[.]2138[.]60[.]224[.]2538[.]60[.]252[.]66 +219 more
CVE-2026-33017: Critical Langflow AI Framework Vulnerability Exploited Within 20 Hours of Disclosure CVE-2026-33017: Critical Langflow AI Platform Flaw Exploited Within 20 Hours of Disclosure Critical Langflow AI Platform Flaw CVE-2026-33017 Exploited Within 20 Hours of Disclosure 1[.]9[.]0[.]dev 173[.]212[.]205[.]251

Cluster 2

3 reports · 2 shared indicators

Reports

Shared infrastructure

1[.]9[.]0[.]dev173[.]212[.]205[.]251
APT37 Ruby Jumper Campaign: North Korean Hackers Deploy Malware Arsenal to Bridge Air-Gapped Networks APT37 Deploys Ruby Jumper Campaign to Breach Air-Gapped Networks 098d697f29b94c11b52c51bfe8f9c47d 144[.]172[.]106[.]66 4214818d7cde26ebeb4f35bc2fc29ada 476bce9b9a387c5f39461d781e7e22b9 57dac5f7d21da2454d0fbefdced80bf3 585322a931a49f4e1d78fb0b3f3c6212 5c6ff601ccc75e76c2fc99808d8cc9a9 709d70239f1e9441e8e21fcacfdc5d08 ad556f4eb48e7dba6da14444dcce3170 ed54cf1ebffbfc1c8ae1ccdd2c681012

Cluster 3

2 reports · 22 shared indicators

Reports

Shared infrastructure

098d697f29b94c11b52c51bfe8f9c47d144[.]172[.]106[.]664214818d7cde26ebeb4f35bc2fc29ada476bce9b9a387c5f39461d781e7e22b957dac5f7d21da2454d0fbefdced80bf3585322a931a49f4e1d78fb0b3f3c62125c6ff601ccc75e76c2fc99808d8cc9a9709d70239f1e9441e8e21fcacfdc5d08ad556f4eb48e7dba6da14444dcce3170ed54cf1ebffbfc1c8ae1ccdd2c681012hightkdhe[.]storehightkdhe[.]store/star/main[.]phphomeatedke[.]storehomeatedke[.]store/star/main[.]phphxxps://www[.]hightkdhe[.]store/star/main[.]phphxxps://www[.]homeatedke[.]store/star/main[.]phphxxps://www[.]philion[.]store/star/main[.]phpphilion[.]storephilion[.]store/star/main[.]phpwww[.]hightkdhe[.]storewww[.]homeatedke[.]storewww[.]philion[.]store
PDFSider: The Stealthy Backdoor Targeting Fortune 100 Financial Institutions Prior to Cyber Attack, Russian Attackers Spent Months Inside the Ukraine Telecoms Giant Booking[.]com BugsBounty[.]com Builder[.]ai Coinopsy[.]com Collectibles[.]com Discord[.]io Duck[.]ai

Cluster 4

2 reports · 7 shared indicators

Reports

Shared infrastructure

Booking[.]comBugsBounty[.]comBuilder[.]aiCoinopsy[.]comCollectibles[.]comDiscord[.]ioDuck[.]ai
Vidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak Controls Void Dokkaebi’s InvisibleFerret Shift Shows Developer Endpoints Are Production Risk ip-api[.]com ip-api[.]com/json

Cluster 5

2 reports · 2 shared indicators

Reports

Shared infrastructure

ip-api[.]comip-api[.]com/json
Shai-Hulud Shows AI Package Scanners Need Prompt-Injection Boundaries LiteLLM Supply Chain Attack: TeamPCP Deploys Multi-Stage Credential Stealer to 95M Monthly Downloads litellm[.]cloud models[.]litellm[.]cloud

Cluster 7

2 reports · 2 shared indicators

Reports

Shared infrastructure

litellm[.]cloudmodels[.]litellm[.]cloud
Indicator Database → Machine-readable feeds →