Bulwark Black LLC

9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors

acint2 months ago03 mins

Low-cost IP KVM devices—designed to provide remote keyboard, video, and mouse access to physical systems—are introducing catastrophic security risks into enterprise environments. New research from Eclypsium reveals nine vulnerabilities affecting products from GL-iNet, Angeet/Yeeso, Sipeed, and JetKVM, with the most severe enabling unauthenticated attackers to achieve root access. Why IP KVM Vulnerabilities Are Uniquely Dangerous…

54 EDR Killers Exploit 34 Vulnerable Signed Drivers to Disable Security Before Ransomware Deployment

acint2 months ago03 mins

A comprehensive analysis by ESET has uncovered a thriving ecosystem of endpoint detection and response (EDR) killer tools, revealing that 54 of these specialized programs abuse 34 vulnerable signed drivers to neutralize security software before ransomware attacks. The BYOVD Threat Landscape EDR killer programs have become a standard component in ransomware intrusions, offering affiliates a…

LeakNet Ransomware Scales Operations with ClickFix Lures and Stealthy Deno-Based Fileless Loader

acint2 months ago03 mins

The LeakNet ransomware group is rapidly scaling its operations with two dangerous innovations: a social engineering technique called ClickFix and a previously unreported fileless loader built on the legitimate Deno JavaScript runtime. According to ReliaQuest research, LeakNet has shifted away from purchasing stolen credentials from initial access brokers (IABs). Instead, the group now plants fake…

Rapid7 2026 Global Threat Landscape Report: Exploited Vulnerabilities Surge 105% as Attack Timelines Collapse

acint2 months ago03 mins

Rapid7 has released its 2026 Global Threat Landscape Report, revealing a dramatic acceleration in cyber attack patterns that leaves organizations with shrinking windows to respond to emerging threats. The research demonstrates that the predictive lead time defenders once relied upon between vulnerability disclosure and active exploitation has largely disappeared. Key Findings: The Numbers Tell the…

CISA Adds Wing FTP Server Information Disclosure Flaw to KEV Catalog Amid Active Exploitation

acint2 months ago03 mins

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a medium-severity vulnerability in Wing FTP Server to its Known Exploited Vulnerabilities (KEV) catalog on March 16, 2026, confirming that attackers are actively exploiting the flaw in real-world attacks. Vulnerability Details Tracked as CVE-2025-47813 (CVSS score: 4.3), the vulnerability is an information disclosure flaw that…

Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization

acint2 months ago03 mins

A comprehensive analysis by Unit 42 reveals a fundamental shift in Iranian cyber operations: state-aligned threat actors are abandoning custom malware in favor of weaponizing enterprise administrative tools to achieve unprecedented scale and stealth. The Strategic Shift During recent wiper incidents attributed to Void Manticore (Handala), attackers did not deploy novel malware or traditional compiled…

GlassWorm Supply Chain Campaign Hijacks 72 Open VSX Extensions to Target Developers

acint2 months ago02 mins

Threat actors are abusing Visual Studio Code extension dependencies in the Open VSX registry to distribute the GlassWorm malware loader through 72 malicious extensions targeting developers.

GlassWorm ForceMemo Campaign: Stolen GitHub Tokens Used to Inject Malware Into Hundreds of Python Repositories

acint2 months ago03 mins

A sophisticated supply chain attack dubbed ForceMemo is leveraging stolen GitHub tokens to inject malware into hundreds of Python repositories, marking a dangerous escalation in the ongoing GlassWorm campaign targeting software developers. The Attack Chain According to StepSecurity research, the attackers are targeting Python projects including Django applications, machine learning research code, Streamlit dashboards, and…

Iranian Threat Actors Target Hikvision and Dahua IP Cameras for Kinetic Strike Coordination

acint2 months ago03 mins

As Iran-Israel-US military operations escalate in the Middle East, Check Point Research and Tenable have identified a significant surge in Iranian threat actors targeting IP cameras manufactured by Hikvision and Dahua. The activity, which began spiking on February 28, 2026, coincides with the start of Operation Epic Fury and extends across Israel, Qatar, Bahrain, Kuwait,…

Critical Veeam Backup Vulnerabilities Draw Ransomware Group Attention: Seven CVSS 9.9 Flaws Patched

acint2 months ago03 mins

Veeam has released emergency patches for seven severe vulnerabilities in its flagship Backup & Replication platform, several scoring CVSS 9.9 — the highest possible criticality rating. The flaws enable remote code execution (RCE), privilege escalation, and credential theft by authenticated users, making enterprise backup infrastructure a prime target for ransomware operators. Vulnerability Details The newly…

Bulwark Black LLC

Bulwark Black LLC

JDownloader Site Compromise Shows Why Trusted Downloads Still Need Verification

Fake OpenAI Hugging Face Repo Shows AI Supply Chain Risk Is Already Here

MCP Server Command Injection Shows Why AI Tools Need Real Isolation

Dirty Frag Turns Linux Footholds Into Root: What Defenders Should Do Now

Prompt Injection Just Became an RCE Problem for AI Agents

NASA Put a Geospatial AI Foundation Model in Orbit — That Should Make You Think

PAN-OS Captive Portal Zero-Day Shows Why Internet-Facing Edge Devices Need Immediate Review

PCPJack Shows Cloud Malware Is Moving From Cryptomining to Credential Theft

9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors

54 EDR Killers Exploit 34 Vulnerable Signed Drivers to Disable Security Before Ransomware Deployment

Rapid7 2026 Global Threat Landscape Report: Exploited Vulnerabilities Surge 105% as Attack Timelines Collapse

CISA Adds Wing FTP Server Information Disclosure Flaw to KEV Catalog Amid Active Exploitation

Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization

GlassWorm Supply Chain Campaign Hijacks 72 Open VSX Extensions to Target Developers

GlassWorm ForceMemo Campaign: Stolen GitHub Tokens Used to Inject Malware Into Hundreds of Python Repositories

Iranian Threat Actors Target Hikvision and Dahua IP Cameras for Kinetic Strike Coordination

Critical Veeam Backup Vulnerabilities Draw Ransomware Group Attention: Seven CVSS 9.9 Flaws Patched