Skip to content
Bulwark BlackBulwark Black LLC
Latest
Passkey Phishing Shows Why Microsoft 365 Needs Enrollment GuardrailsCyclops Blink on Cisco FMC Shows Why Edge Appliances Need Compromise ReviewRevolut Breach Shows Why Data Requests Need Verification ControlsCheck Point VPN Flaws Show Why Remote Access Needs Emergency Patch DisciplineMirth Connect Flaws Show Why Healthcare Middleware Needs Compromise ReviewAI Invoice Fraud Shows Why Finance Needs Verification ControlsAngular SSR Flaws Show Why Hydration and Edge Caches Need Security ReviewSloppyRAT Shows Why Ransomware Defense Has to Watch the Whole Infection FunneltestCloud Web Apps Need Attack-Path Defense, Not Just App ScansTHost9 Shows Why Exposed Android Debug Interfaces Need Compromise ReviewOfferLoader Shows Why Commodity Malware Needs Funnel-Aware DefenseApache Impala Flaws Show Why Data Platforms Need Zero-Trust ControlsChatGPT Sandbox Leak Shows Why AI Agents Need Tenant Isolation

Intel Workbench · Beta

Campaign Constellation

Beta · Automated correlation

Campaign Constellation links reports that reuse two or more non-CVE indicators. Names now come from the strongest repeated campaign, malware, technique, or infrastructure evidence—not whichever report was published most recently. Actor names appear only when repeated reporting supports them, and co-occurrence still does not establish a common campaign, owner, or actor attribution.

evidence core report planet shared indicator

Report relationships

Observed Constellations

These graphs show shared indicators recorded in published reports. Their current lifecycle is unverified; a report relationship does not establish that an indicator is malicious or active.

14 constellations · 35 linked reports

Constellation Vishing ActivityInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Vishing Activity — Technique, 4/6 reportsApollo Breach Shows Why Helpdesk Vishing Is a Cloud-Control ProblemUNC6671 Shows Why Helpdesk Vishing Is a Cloud Data-Theft ProblemPink Extortion Shows Microsoft 365 Defense Starts With Vishing ControlsBlackFile Vishing Campaign Shows Why MFA Alone Is Not EnoughPasskey Phishing Shows Why Microsoft 365 Needs Enrollment GuardrailsAI Invoice Fraud Shows Why Finance Needs Verification Controls185[.]178[.]208[.]153add-passkey[.]comdeploypasskey[.]comkeysyncos[.]comoskeyconnect[.]comoskeysync[.]com

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+82 indicators not plotted

Constellation Vishing Activity

Report correlation · lifecycle unverifiedStrong evidence

Technique4/6 reports86 shared indicatorsSnapshot BB-CST-8BCFDD3E25B01A6F

4 of 6 reports explicitly reference vishing; 86 indicators recur across that supporting set.

Reports

Shared infrastructure

add-passkey[.]comdeploypasskey[.]comkeysyncos[.]comoskeyconnect[.]comoskeysync[.]compasskeyadd[.]compasskeydeploy[.]compasskeyhelpdesk[.]compasskeyms[.]comportalsetuphub[.]comsecure-passkey[.]comsetupsso[.]com185[.]178[.]208[.]153activatemypasskey[.]comactivatepasskey[.]comactivatepasskeyportal[.]comaddmypasskey[.]comaddoktapasskey[.]comaddpasskey2fa[.]comaddssopasskey[.]comaddyourpasskey[.]comassignpasskey[.]comcreatemfa[.]comcreatemypasskey[.]com+64 more
Constellation GRIDTIDEInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation GRIDTIDE — Malware, 3/5 reportsGoogle Disrupts Chinese APT UNC2814’s GRIDTIDE Backdoor Campaign Targeting 42 CountriesGoogle and Mandiant Disrupt GRIDTIDE: Chinese APT Espionage Campaign Compromises 53 Victims in 42 CountriesGoogle Disrupts UNC2814 GRIDTIDE Campaign: Chinese APT Breaches 53 Organizations Across 42 CountriesHoneyMyte’s CoolClient Rootkit Shows Why Kernel Visibility MattersPoisoned Search and AI Recommendations Turn Utility Downloads Into RMM Accessgiize[.]comcasacam[.]netgleeze[.]comtheworkpc[.]com01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb130[.]94[.]6[.]228

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+235 indicators not plotted

Constellation GRIDTIDE

Report correlation · lifecycle unverifiedStrong evidence

Malware3/5 reports241 shared indicatorsSnapshot BB-CST-951CB00E4C4C6984

3 of 5 reports explicitly reference GRIDTIDE; 241 indicators recur across that supporting set.

Reports

Shared infrastructure

giize[.]comcasacam[.]netgleeze[.]comtheworkpc[.]com1cv2f3d5s6a9w[.]ddnsfree[.]comaccesscam[.]orgadmina[.]freeddns[.]orgafsaces[.]accesscam[.]organcisesic[.]accesscam[.]orgapplebox[.]camdvr[.]orgappler[.]kozow[.]comasdad21ww[.]freeddns[.]orgaw2o25forsbc[.]camdvr[.]orgawcc001jdaigfwdagdcew[.]giize[.]combab2o25com[.]accesscam[.]orgbabaji[.]accesscam[.]orgbabi5599ss[.]ddnsgeek[.]combalabalabo[.]mywire[.]orgbggs[.]giize[.]combibabo[.]freeddns[.]orgbinmol[.]webredirect[.]orgbioth[.]giize[.]comboemobww[.]ddnsfree[.]combrcallletme[.]theworkpc[.]com+217 more
Constellation Signed ClickOnceInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Signed ClickOnce — Technique, 2/2 reportsSigned ClickOnce Lures Show Why Hiring Workflows Need Endpoint GuardrailsSigned ClickOnce Shows Fake Interviews Are Now a Credential-Theft Delivery System1[.]0[.]0[.]1821[.]0[.]0[.]201112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc12730a7dd9af98f14441d476c10eb346708c119431[.]76[.]7[.]13745[.]125[.]67[.]42

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+22 indicators not plotted

Constellation Signed ClickOnce

Report correlation · lifecycle unverifiedStrong evidence

Technique2/2 reports28 shared indicatorsSnapshot BB-CST-2226F80BD265E826

2 of 2 reports explicitly reference Signed ClickOnce; 28 indicators recur across that supporting set.

Reports

Shared infrastructure

apidrive[.]onlineauth3gapi[.]onlinediegovalanire[.]digitalgapiauth[.]infogapiauth[.]netgapiconnect[.]comgapidriver[.]comgapioath[.]comwww[.]dropbox[.]com112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc12730a7dd9af98f14441d476c10eb346708c1194487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea28064d6abbfc7c052cbafaa53659971ac4717866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf7299c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0aa7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50afafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd1[.]0[.]0[.]1821[.]0[.]0[.]20131[.]76[.]7[.]13745[.]125[.]67[.]4291[.]219[.]238[.]169hxxps://diegovalanire[.]digital+4 more
Constellation APT37 Ruby JumperInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation APT37 Ruby Jumper — Campaign, 2/2 reportsAPT37 Ruby Jumper Campaign: North Korean Hackers Deploy Malware Arsenal to Bridge Air-Gapped NetworksAPT37 Deploys Ruby Jumper Campaign to Breach Air-Gapped Networks098d697f29b94c11b52c51bfe8f9c47d144[.]172[.]106[.]664214818d7cde26ebeb4f35bc2fc29ada476bce9b9a387c5f39461d781e7e22b957dac5f7d21da2454d0fbefdced80bf3585322a931a49f4e1d78fb0b3f3c6212

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+13 indicators not plotted

Constellation APT37 Ruby Jumper

Report correlation · lifecycle unverifiedStrong evidence

Campaign2/2 reports19 shared indicatorsSnapshot BB-CST-711F25C272A7C833

2 of 2 reports explicitly reference APT37 and Ruby Jumper; 19 indicators recur across that supporting set.

Reports

Shared infrastructure

hightkdhe[.]storehomeatedke[.]storephilion[.]storewww[.]hightkdhe[.]storewww[.]homeatedke[.]storewww[.]philion[.]store098d697f29b94c11b52c51bfe8f9c47d4214818d7cde26ebeb4f35bc2fc29ada476bce9b9a387c5f39461d781e7e22b957dac5f7d21da2454d0fbefdced80bf3585322a931a49f4e1d78fb0b3f3c62125c6ff601ccc75e76c2fc99808d8cc9a9709d70239f1e9441e8e21fcacfdc5d08ad556f4eb48e7dba6da14444dcce3170ed54cf1ebffbfc1c8ae1ccdd2c681012144[.]172[.]106[.]66hxxps://www[.]hightkdhe[.]store/star/main[.]phphxxps://www[.]homeatedke[.]store/star/main[.]phphxxps://www[.]philion[.]store/star/main[.]php
Constellation Shared Infrastructure · B27A25Interactive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Shared Infrastructure · B27A25 — Unclassified, 2/2 reportsOWAReaper Shows Why Exchange Mailboxes Need Post-Patch Compromise ReviewTA488 Turns Outlook Web Access Into a Stealthy Persistence Layer6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4acocdn[.]comasecdns[.]comdnsrecursive[.]eui3[.]wp[.]comimages[.]weserv[.]nl

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+2 indicators not plotted

Constellation Shared Infrastructure · B27A25

Report correlation · lifecycle unverifiedWeak evidence

Unclassified2/2 reports8 shared indicatorsSnapshot BB-CST-A0A93BE82BB27A25

No campaign, actor, malware, or technique repeats strongly enough to name this cluster; 8 observables link 2 reports.

Reports

Shared infrastructure

acocdn[.]comasecdns[.]comdnsrecursive[.]eui3[.]wp[.]comimages[.]weserv[.]nlslack-imgs[.]comtdndns[.]com6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4
Constellation M365 / OWA InfrastructureInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation M365 / OWA Infrastructure — Infrastructure, 2/2 reportsRussian Auth-Flow Phishing Shows MFA Can Be Bypassed Without ExploitsCaptiveCrunch Shows Why Travel Wi-Fi Is an Identity Attack Surface104[.]194[.]159[.]15031[.]57[.]243[.]15438[.]146[.]28[.]75be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42cm365-owa[.]comms365-device[.]com

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.+2 indicators not plotted

Constellation M365 / OWA Infrastructure

Report correlation · lifecycle unverifiedModerate evidence

Infrastructure2/2 reports8 shared indicatorsSnapshot BB-CST-022901EECADC3FC7

4 shared indicators match M365 and OWA infrastructure across 2 of 2 reports; 8 indicators recur across that supporting set.

Reports

Shared infrastructure

m365-owa[.]comms365-device[.]comms365-live[.]comowa-ms365[.]combe99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c104[.]194[.]159[.]15031[.]57[.]243[.]15438[.]146[.]28[.]75
Constellation Shared Infrastructure · EE8A27Interactive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Shared Infrastructure · EE8A27 — Unclassified, 2/2 reportsToy Ghouls Shows Why Custom C2 Needs Protocol-Aware MonitoringVoid Dokkaebi’s InvisibleFerret Shift Shows Developer Endpoints Are Production Riskhxxp://ip-api[.]com/jsonip-api[.]com

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Shared Infrastructure · EE8A27

Report correlation · lifecycle unverifiedWeak evidence

Unclassified2/2 reports2 shared indicatorsSnapshot BB-CST-0CFD9DDF95EE8A27

No campaign, actor, malware, or technique repeats strongly enough to name this cluster; 2 observables link 2 reports.

Reports

Shared infrastructure

ip-api[.]comhxxp://ip-api[.]com/json
Constellation Remote HiringInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Remote Hiring — Named activity, 2/2 reportsNisos DPRK Investigation Shows Why Remote Hiring Is a Security ControlPurpleDelta Shows Why Remote Hiring Is Now an Insider-Risk Control167[.]88[.]61[.]117167[.]88[.]61[.]250

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Remote Hiring

Report correlation · lifecycle unverifiedModerate evidence

Named activity2/2 reports2 shared indicatorsSnapshot BB-CST-328914F4EB969414

2 of 2 reports repeat Remote Hiring; 2 indicators recur across that supporting set.

Reports

Shared infrastructure

167[.]88[.]61[.]117167[.]88[.]61[.]250
Constellation NeedInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Need — Named activity, 2/2 reportsLLM Safety Fragility Shows Why AI Workflows Need Runtime Guardrails84 4G/5G Core Flaws Show Why Telecom Trust Zones Need Zero Trustdoi[.]orgscite[.]ai

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Need

Report correlation · lifecycle unverifiedModerate evidence

Named activity2/2 reports2 shared indicatorsSnapshot BB-CST-C6376EE7A59C3193

2 of 2 reports repeat Need; 2 indicators recur across that supporting set.

Reports

Shared infrastructure

doi[.]orgscite[.]ai
Constellation OAST Service ReferencesInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation OAST Service References — Reference only, 2/2 reportsAI Infrastructure Is Becoming a Control Plane Attack SurfaceUnit 42 Exposes Active Exploitation of BeyondTrust CVE-2026-1731 with VShell and SparkRAT Backdoorsoast[.]funoast[.]pro

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation OAST Service References

Report correlation · lifecycle unverifiedReference-only evidence

Reference only2/2 reports2 shared indicatorsSnapshot BB-CST-3F5DF6F7C58C00FB

2 shared indicators match generic OAST service references across 2 of 2 reports; 2 indicators recur across that supporting set.

This link is retained for transparency, but generic reference infrastructure is weak evidence of a meaningful threat relationship.

Reports

Shared infrastructure

oast[.]funoast[.]pro
Constellation Nodies RPC InfrastructureInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Nodies RPC Infrastructure — Shared service, 2/2 reportsAeternum Shows Why Blockchain-Based C2 Is a Practical Defense ProblemDeadLock Ransomware Shows Why Recovery Infrastructure Is Part of the Attack Surfacenodies[.]apppolygon-pokt[.]nodies[.]app

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Nodies RPC Infrastructure

Report correlation · lifecycle unverifiedWeak evidence

Shared service2/2 reports2 shared indicatorsSnapshot BB-CST-08F6227DB0C6A05B

2 shared indicators match public Nodies RPC infrastructure across 2 of 2 reports; 2 indicators recur across that supporting set.

Reports

Shared infrastructure

nodies[.]apppolygon-pokt[.]nodies[.]app
Constellation ICANN ReferencesInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation ICANN References — Reference only, 2/2 reportsSonicWall SMA Exploit Chain Shows Why VPN Appliances Need Incident Response, Not Just PatchingNetNut and Popa Takedown Shows Residential Proxies Are Now Attack Infrastructurehxxps://icann[.]org/epp#clientTransferProhibitedicann[.]org

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation ICANN References

Report correlation · lifecycle unverifiedReference-only evidence

Reference only2/2 reports2 shared indicatorsSnapshot BB-CST-3C99569E1CC895E3

2 shared indicators match boilerplate ICANN EPP references across 2 of 2 reports; 2 indicators recur across that supporting set.

This link is retained for transparency, but generic reference infrastructure is weak evidence of a meaningful threat relationship.

Reports

Shared infrastructure

icann[.]orghxxps://icann[.]org/epp#clientTransferProhibited
Constellation LiteLLM InfrastructureInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation LiteLLM Infrastructure — Infrastructure, 2/2 reportsShai-Hulud Shows AI Package Scanners Need Prompt-Injection BoundariesLiteLLM Supply Chain Attack: TeamPCP Deploys Multi-Stage Credential Stealer to 95M Monthly Downloadslitellm[.]cloudmodels[.]litellm[.]cloud

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation LiteLLM Infrastructure

Report correlation · lifecycle unverifiedModerate evidence

Infrastructure2/2 reports2 shared indicatorsSnapshot BB-CST-6F4BA0E9ACC71C32

2 shared indicators match LiteLLM infrastructure across 2 of 2 reports; 2 indicators recur across that supporting set.

Reports

Shared infrastructure

litellm[.]cloudmodels[.]litellm[.]cloud
Constellation Critical LangflowInteractive correlation map. The center is an automated evidence core, gold planets are reports, teal moons are shared indicators, and connecting lines are observed report-to-indicator relationships. Hover or focus a node for details; after focusing the map, use arrow keys to move between nodes.Constellation Critical Langflow — Named activity, 2/2 reportsCVE-2026-33017: Critical Langflow AI Platform Flaw Exploited Within 20 Hours of DisclosureCritical Langflow AI Platform Flaw CVE-2026-33017 Exploited Within 20 Hours of Disclosure173[.]212[.]205[.]251173[.]212[.]205[.]251:8443

Orbit position organizes the view; only connecting lines represent observed relationships.Hover, tap, or focus a node for details; use arrow keys after entering the map.

Constellation Critical Langflow

Report correlation · lifecycle unverifiedModerate evidence

Named activity2/2 reports2 shared indicatorsSnapshot BB-CST-5F13D38F8AEC3D87

2 of 2 reports repeat Critical Langflow; 2 indicators recur across that supporting set.

Reports

Shared infrastructure

173[.]212[.]205[.]251173[.]212[.]205[.]251:8443
Intel Workbench →Machine-readable feeds →

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.