Skip to content
Bulwark Black Bulwark Black LLC
Latest
QScan and QTRouter Show Why Proxy Infrastructure Is an Espionage Force MultipliervCenter Exploitation Shows Patching Alone Is Not Incident ResponseEdge Infrastructure Convergence Shows Why Perimeter Devices Need Their Own Patch SLAsSigned ClickOnce Lures Show Why Hiring Workflows Need Endpoint GuardrailsShieldBreak Shows Why Endpoint Protection Needs Compensating ControlsAI-Enabled Malware Still Behaves Like MalwarePrivate APNs Are Becoming OT Attack PathsvCenter Exploitation Shows Why Control Planes Need ContainmentApollo Breach Shows Why Helpdesk Vishing Is a Cloud-Control ProblemBTR.sys Shows Why Trusted Security Drivers Need Behavioral MonitoringWeedHack Shows SEO Poisoning Is Malware Delivery InfrastructureAI Agent Incidents Need Task-Scoped Incident ResponseSDLC Supply-Chain Attacks Show Why Developer Tools Need Runtime ControlsRussian Auth-Flow Phishing Shows MFA Can Be Bypassed Without Exploits

Threat Intelligence

Shared Infrastructure

When separate reports reuse the same domains, IPs, or malware, they are usually the same campaign or actor toolkit. We link reports that share two or more indicators (vulnerabilities aside) into clusters, so you can pivot from one report to everything that shares its infrastructure.

8 clusters · 21 linked reports

report shared indicator
HoneyMyte’s CoolClient Rootkit Shows Why Kernel Visibility Matters Poisoned Search and AI Recommendations Turn Utility Downloads Into RMM Access Google Disrupts Chinese APT UNC2814’s GRIDTIDE Backdoor Campaign Targeting 42 Countries Google and Mandiant Disrupt GRIDTIDE: Chinese APT Espionage Campaign Compromises 53 Victims in 42 Countries Google Disrupts UNC2814 GRIDTIDE Campaign: Chinese APT Breaches 53 Organizations Across 42 Countries giize[.]com casacam[.]net gleeze[.]com theworkpc[.]com 01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb 130[.]94[.]6[.]228 139[.]180[.]219[.]115 139[.]84[.]236[.]237 149[.]28[.]128[.]128 149[.]28[.]139[.]125

Cluster 1

5 reports · 241 shared indicators

Reports

Shared infrastructure

giize[.]comcasacam[.]netgleeze[.]comtheworkpc[.]com01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb130[.]94[.]6[.]228139[.]180[.]219[.]115139[.]84[.]236[.]237149[.]28[.]128[.]128149[.]28[.]139[.]125178[.]79[.]188[.]181195[.]123[.]211[.]70195[.]123[.]226[.]2351cv2f3d5s6a9w[.]ddnsfree[.]com202[.]59[.]10[.]122207[.]148[.]73[.]1838[.]180[.]205[.]1438[.]54[.]112[.]18438[.]54[.]31[.]14638[.]54[.]32[.]24438[.]54[.]37[.]19638[.]54[.]82[.]6938[.]60[.]171[.]24238[.]60[.]194[.]21 +217 more
Apollo Breach Shows Why Helpdesk Vishing Is a Cloud-Control Problem UNC6671 Shows Why Helpdesk Vishing Is a Cloud Data-Theft Problem Pink Extortion Shows Microsoft 365 Defense Starts With Vishing Controls BlackFile Vishing Campaign Shows Why MFA Alone Is Not Enough 185[.]178[.]208[.]153 deploypasskey[.]com passkeyadd[.]com passkeydeploy[.]com passkeyms[.]com setupsso[.]com 107[.]128[.]45[.]122 193[.]34[.]212[.]132 195[.]140[.]213[.]114 195[.]140[.]213[.]115

Cluster 2

4 reports · 86 shared indicators

Reports

Shared infrastructure

185[.]178[.]208[.]153deploypasskey[.]compasskeyadd[.]compasskeydeploy[.]compasskeyms[.]comsetupsso[.]com107[.]128[.]45[.]122193[.]34[.]212[.]132195[.]140[.]213[.]114195[.]140[.]213[.]11523[.]234[.]75[.]8431[.]7[.]56[.]5231[.]7[.]56[.]6138[.]42[.]59[.]17147[.]218[.]103[.]14676[.]103[.]148[.]180activatemypasskey[.]comactivatepasskey[.]comactivatepasskeyportal[.]comadd-passkey[.]comaddmypasskey[.]comaddoktapasskey[.]comaddpasskey2fa[.]comaddssopasskey[.]com +62 more
Signed ClickOnce Lures Show Why Hiring Workflows Need Endpoint Guardrails Signed ClickOnce Shows Fake Interviews Are Now a Credential-Theft Delivery System 1[.]0[.]0[.]182 1[.]0[.]0[.]201 112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc 12730A7DD9AF98F14441D476C10EB346708C1194 31[.]76[.]7[.]137 45[.]125[.]67[.]42 487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea2806 4D6ABBFC7C052CBAFAA53659971AC471 7866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5 839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf72

Cluster 3

2 reports · 31 shared indicators

Reports

Shared infrastructure

1[.]0[.]0[.]1821[.]0[.]0[.]201112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc12730A7DD9AF98F14441D476C10EB346708C119431[.]76[.]7[.]13745[.]125[.]67[.]42487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea28064D6ABBFC7C052CBAFAA53659971AC4717866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf7291[.]219[.]238[.]16999c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0aa7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50aapidrive[.]onlineauth3gapi[.]onlinediegovalanire[.]digitalfafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cdgapiauth[.]infogapiauth[.]netgapiconnect[.]comgapidriver[.]comgapidriver[.]com/api/get[.]phpgapidriver[.]com/api/rest[.]phpgapidriver[.]com/installer/GapiUpdate[.]application +7 more
APT37 Ruby Jumper Campaign: North Korean Hackers Deploy Malware Arsenal to Bridge Air-Gapped Networks APT37 Deploys Ruby Jumper Campaign to Breach Air-Gapped Networks 098d697f29b94c11b52c51bfe8f9c47d 144[.]172[.]106[.]66 4214818d7cde26ebeb4f35bc2fc29ada 476bce9b9a387c5f39461d781e7e22b9 57dac5f7d21da2454d0fbefdced80bf3 585322a931a49f4e1d78fb0b3f3c6212 5c6ff601ccc75e76c2fc99808d8cc9a9 709d70239f1e9441e8e21fcacfdc5d08 ad556f4eb48e7dba6da14444dcce3170 ed54cf1ebffbfc1c8ae1ccdd2c681012

Cluster 4

2 reports · 22 shared indicators

Reports

Shared infrastructure

098d697f29b94c11b52c51bfe8f9c47d144[.]172[.]106[.]664214818d7cde26ebeb4f35bc2fc29ada476bce9b9a387c5f39461d781e7e22b957dac5f7d21da2454d0fbefdced80bf3585322a931a49f4e1d78fb0b3f3c62125c6ff601ccc75e76c2fc99808d8cc9a9709d70239f1e9441e8e21fcacfdc5d08ad556f4eb48e7dba6da14444dcce3170ed54cf1ebffbfc1c8ae1ccdd2c681012hightkdhe[.]storehightkdhe[.]store/star/main[.]phphomeatedke[.]storehomeatedke[.]store/star/main[.]phphxxps://www[.]hightkdhe[.]store/star/main[.]phphxxps://www[.]homeatedke[.]store/star/main[.]phphxxps://www[.]philion[.]store/star/main[.]phpphilion[.]storephilion[.]store/star/main[.]phpwww[.]hightkdhe[.]storewww[.]homeatedke[.]storewww[.]philion[.]store
Russian Auth-Flow Phishing Shows MFA Can Be Bypassed Without Exploits CaptiveCrunch Shows Why Travel Wi-Fi Is an Identity Attack Surface 104[.]194[.]159[.]150 31[.]57[.]243[.]154 38[.]146[.]28[.]75 be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c m365-owa[.]com ms365-device[.]com ms365-live[.]com owa-ms365[.]com

Cluster 5

2 reports · 8 shared indicators

Reports

Shared infrastructure

104[.]194[.]159[.]15031[.]57[.]243[.]15438[.]146[.]28[.]75be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42cm365-owa[.]comms365-device[.]comms365-live[.]comowa-ms365[.]com
SonicWall SMA Exploit Chain Shows Why VPN Appliances Need Incident Response, Not Just Patching NetNut and Popa Takedown Shows Residential Proxies Are Now Attack Infrastructure hxxps://icann[.]org/epp#clientTransferProhibited icann[.]org

Cluster 6

2 reports · 2 shared indicators

Reports

Shared infrastructure

hxxps://icann[.]org/epp#clientTransferProhibitedicann[.]org
Vidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak Controls Void Dokkaebi’s InvisibleFerret Shift Shows Developer Endpoints Are Production Risk ip-api[.]com ip-api[.]com/json

Cluster 7

2 reports · 2 shared indicators

Reports

Shared infrastructure

ip-api[.]comip-api[.]com/json
Shai-Hulud Shows AI Package Scanners Need Prompt-Injection Boundaries LiteLLM Supply Chain Attack: TeamPCP Deploys Multi-Stage Credential Stealer to 95M Monthly Downloads litellm[.]cloud models[.]litellm[.]cloud

Cluster 8

2 reports · 2 shared indicators

Reports

Shared infrastructure

litellm[.]cloudmodels[.]litellm[.]cloud
Indicator Database → Machine-readable feeds →

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.