Skip to content
Bulwark Black Bulwark Black LLC
Latest
Jscrambler npm Compromise Shows Build Pipelines Need Runtime ControlsGhost Phishing Shows Why Email Security Must Follow the BrowserPakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic TargetsBad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority QueueFake Payment SDKs Show Why Dependency Risk Is Credential RiskCritical UniFi Flaws Put Network Control Planes Back in the Patch QueueVidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak ControlsADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity InfrastructureUAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay InfrastructureFortiBleed Shows Firewall Credentials Are Ransomware FuelNetNut and Popa Takedown Shows Residential Proxies Are Now Attack InfrastructureVect and TeamPCP Show Supply-Chain Credentials Are Ransomware FuelOusaban Shows Banking Trojans Are Learning to Hide From SandboxesNUT upsmon Command Injection Shows UPS Monitoring Belongs in the Patch Queue

Indicator of Compromise

EE663D016894D44C69B1FDC9D2A5BE02F028A56FC22B694FF7C1DACB2BBBCC6D

SHA-256 hash Seen in 1 report Watch this →

A SHA-256 file hash identifying a specific malicious sample. Match it against files on disk or in your EDR.

Included in the Hashes feed (live, machine-readable).

Seen in these reports

Malware · Feb 11, 2026

XWorm RAT Campaign Exploits CVE-2018-0802 in Multi-Language Phishing Attacks Using Fileless Injection

Related indicators

Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.

3bc1de741f8149f49bdbafa703067f24 3F4C3C16F63FB90D1FD64B031D8A9803035F3CB18332E198850896881FB42FE5 8665BC1B33CBE6F5859CD6E362AF77738BA73A6E6D4B9974C16C8521D84C1892 berlin101[.]comcloudinary[.]com CVE-2017-11882 CVE-2018-0802 EACD8E95EAD3FFE2C225768EF6F85672C4BFDF61655ED697B97F598203EF2CF6 FD9BA9E6BD4886EDC1123D4074D0EAC363DF61162364530B1303390AA621140B hxxp://pub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txthxxps://pub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txthxxps://res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/hxxps://res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p[.]jpghxxps://retrodayaengineering[.]icu/HGG[.]htapub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]devpub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txtr2[.]devres[.]cloudinary[.]comres[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p[.]jpgretrodayaengineering[.]icuretrodayaengineering[.]icu/HGG[.]hta
Browse all indicators → Machine-readable feeds → Extract IOCs from text →