Skip to content
Bulwark Black Bulwark Black LLC
Latest
Jscrambler npm Compromise Shows Build Pipelines Need Runtime ControlsGhost Phishing Shows Why Email Security Must Follow the BrowserPakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic TargetsBad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority QueueFake Payment SDKs Show Why Dependency Risk Is Credential RiskCritical UniFi Flaws Put Network Control Planes Back in the Patch QueueVidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak ControlsADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity InfrastructureUAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay InfrastructureFortiBleed Shows Firewall Credentials Are Ransomware FuelNetNut and Popa Takedown Shows Residential Proxies Are Now Attack InfrastructureVect and TeamPCP Show Supply-Chain Credentials Are Ransomware FuelOusaban Shows Banking Trojans Are Learning to Hide From SandboxesNUT upsmon Command Injection Shows UPS Monitoring Belongs in the Patch Queue

Indicator of Compromise

e8000ddfddbe120b5f2fb3677abbad901615d1abd01a0de204fade5d2dd5ad0d

SHA-256 hash Seen in 1 report Watch this →

A SHA-256 file hash identifying a specific malicious sample. Match it against files on disk or in your EDR.

Included in the Hashes feed (live, machine-readable).

Seen in these reports

North Korean Cyber Threat Intelligence · Mar 22, 2024

The Updated APT Playbook: Tales from the Kimsuky threat actor group

Related indicators

Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.

00701111[.]000webhostapp[.]com 364d4fdf430477222fe854b3cd5b6d40 5c7b2705155023e6e438399d895d30bf924e0547 71db2ae9c36403cec1fd38864d64f239 b5224224fdbabdea53a91a96e9f816c6f9a8708c c62677543eeb50e0def44fc75009a7748cdbedd0a3ccf62f50d7f219f6a5aa05 CVE-2026-0826 CVE-2026-52806 d4fa57f9c9e35222a8cacddc79055c1d76907fb9 da79eea1198a1a10e2ffd50fd949521632d8f252fb1aadb57a45218482b9fd89 f35b05779e9538cec363ca37ab38e287 gosiclass[.]com/m/gnu/convert/html/com/list[.]php?query=6gosiweb[.]gosiclass[.]comhxxp://gosiweb[.]gosiclass[.]com/m/gnu/convert/html/com/list[.]php?query=6hxxps://niscarea[.]com/in[.]php?cn=[base64]&fn=[DateTimeniscarea[.]comniscarea[.]com/in[.]php?cn=[base64
Browse all indicators → Machine-readable feeds → Extract IOCs from text →