Skip to content
Bulwark Black Bulwark Black LLC
Latest
TA488 Turns Outlook Web Access Into a Stealthy Persistence LayerOpen Source Supply Chain Compromise Needs Build-Pipeline Defense, Not Just Dependency ScanningCosmosEscape Shows Why Managed Cloud Databases Still Need Customer-Side DefenseAutonomous AI Agent Espionage Shows Why Post-Compromise Speed MattersSharePoint KEV Listing Turns Collaboration Servers Into Incident-Response PrioritiesJscrambler npm Compromise Shows Build Pipelines Need Runtime ControlsGhost Phishing Shows Why Email Security Must Follow the BrowserPakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic TargetsBad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority QueueFake Payment SDKs Show Why Dependency Risk Is Credential RiskCritical UniFi Flaws Put Network Control Planes Back in the Patch QueueVidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak ControlsADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity InfrastructureUAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay Infrastructure

Indicator of Compromise

6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4

SHA-256 hash Seen in 1 report Watch this →

A SHA-256 file hash identifying a specific malicious sample. Match it against files on disk or in your EDR.

Included in the Hashes feed (live, machine-readable).

Seen in these reports

Cyber Security Blog · Jul 30, 2026

TA488 Turns Outlook Web Access Into a Stealthy Persistence Layer

Related indicators

Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.

acocdn[.]comasecdns[.]com CVE-2026-42897 dnsrecursive[.]eui3[.]wp[.]comimages[.]weserv[.]nlslack-imgs[.]comtdndns[.]comWeserv[.]nl
Browse all indicators → Machine-readable feeds → Extract IOCs from text →