SIGNAL FUSION
INFERREDCorrelative events inferred by fusing live threat intelligence with your tracked FedRAMP vendors, CMMC ecosystem, and exposure corpus. The correlation is the signal — each card is a cross-source match, not a raw feed item.
Correlations
42
inferred cross-source events
CVE fusion
24
actor CVEs hitting your stack
Shared infra
13
vendors hosting malicious IPs
Vendor breach
0
tracked entities disclosed
CVE FUSION · ACTOR-LINKED VULNS HITTING YOUR STACK
24 matched
CVE-2026-35273
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 10 products you track.
▤ Aconex for Defense, Federal Managed Cloud Services, Fusion Cloud, Government Cloud - Common Controls, Oracle Cloud Infrastructure-Government Cloud, Oracle Enterprise Performance Management (EPM), Oracle Enterprise Performance Management (EPM) - Moderate, Oracle Service Cloud, Oracle Service Cloud (DOD), Taleo Cloud - U.S. Government Cloud
IOC 162.219.30.165 · GB
CVE-2026-20182
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 9 products you track.
▤ AppDynamics GovAPM, Cisco Cloudlock for Government, Cisco Meraki for Government, Cisco SD-WAN for Government, Cisco Umbrella for Government, Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government), Duo Federal, WebEx Contact Center Enterprise for Government (WxCCE-G), Webex for Government
IOC 20.9.10.1 · US
CVE-2026-20245
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 9 products you track.
▤ AppDynamics GovAPM, Cisco Cloudlock for Government, Cisco Meraki for Government, Cisco SD-WAN for Government, Cisco Umbrella for Government, Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government), Duo Federal, WebEx Contact Center Enterprise for Government (WxCCE-G), Webex for Government
IOC 20.9.10.1 · US
CVE-2026-20262
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 9 products you track.
▤ AppDynamics GovAPM, Cisco Cloudlock for Government, Cisco Meraki for Government, Cisco SD-WAN for Government, Cisco Umbrella for Government, Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government), Duo Federal, WebEx Contact Center Enterprise for Government (WxCCE-G), Webex for Government
IOC 20.9.10.1 · US
CVE-2026-76504
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 8 products you track.
▤ Cisco Cloudlock for Government, Cisco Meraki for Government, Cisco SD-WAN for Government, Cisco Umbrella for Government, Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government), Duo Federal, WebEx Contact Center Enterprise for Government (WxCCE-G), Webex for Government
IOC 79.141.169.187 · HK
CVE-2023-46805
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 2 products you track.
▤ Ivanti Neurons for ITSM (Formerly Service Manager), Ivanti Neurons for MDM (Formerly MobileIron)
IOC 145.249.115.184 · NL
CVE-2024-21887
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 2 products you track.
▤ Ivanti Neurons for ITSM (Formerly Service Manager), Ivanti Neurons for MDM (Formerly MobileIron)
IOC 145.249.115.184 · NL
CVE-2026-85046
KEV
Live threat-actor IOC attributed to Earth Lusca, TeamPCP references this CVE — which is correlated to 2 products you track.
▤ Google Services (Google Cloud Platform Products and underlying Infrastructure), Google Workspace
IOC 3.171.153.119 · US
CVE-2026-2441
KEV
Live threat-actor IOC attributed to Earth Lusca, TeamPCP references this CVE — which is correlated to 2 products you track.
▤ Google Services (Google Cloud Platform Products and underlying Infrastructure), Google Workspace
IOC 3.171.153.119 · US
CVE-2026-3909
KEV
Live threat-actor IOC attributed to Earth Lusca, TeamPCP references this CVE — which is correlated to 2 products you track.
▤ Google Services (Google Cloud Platform Products and underlying Infrastructure), Google Workspace
IOC 3.171.153.119 · US
CVE-2026-3910
KEV
Live threat-actor IOC attributed to Earth Lusca, TeamPCP references this CVE — which is correlated to 2 products you track.
▤ Google Services (Google Cloud Platform Products and underlying Infrastructure), Google Workspace
IOC 3.171.153.119 · US
CVE-2026-5281
KEV
Live threat-actor IOC attributed to Earth Lusca, TeamPCP references this CVE — which is correlated to 2 products you track.
▤ Google Services (Google Cloud Platform Products and underlying Infrastructure), Google Workspace
IOC 3.171.153.119 · US
CVE-2026-11645
KEV
Live threat-actor IOC attributed to Earth Lusca, TeamPCP references this CVE — which is correlated to 2 products you track.
▤ Google Services (Google Cloud Platform Products and underlying Infrastructure), Google Workspace
IOC 3.171.153.119 · US
CVE-2026-0257
KEV
Live threat-actor IOC attributed to Lazarus Group references this CVE — which is correlated to 2 products you track.
▤ GCS-HIGH, Palo Alto Networks Government Cloud Services
IOC 91.132.163.78 · DE
CVE-2026-10520
KEV
Live threat-actor IOC attributed to Lazarus Group references this CVE — which is correlated to 2 products you track.
▤ Ivanti Neurons for ITSM (Formerly Service Manager), Ivanti Neurons for MDM (Formerly MobileIron)
IOC 91.132.163.78 · DE
CVE-2026-88772
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 1 product you track.
▤ Citrix for Government
IOC 141.193.213.21 · US
CVE-2019-7256
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 1 product you track.
▤ NICE inContact CXone Customer Experience Platform
IOC 145.249.115.184 · NL
CVE-2026-88771
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 1 product you track.
▤ Citrix for Government
IOC 79.141.169.187 · HK
CVE-2026-19490
KEV
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 1 product you track.
▤ Citrix for Government
IOC 162.240.90.178 · US
CVE-2025-14847
KEV
Live threat-actor IOC attributed to Lazarus Group references this CVE — which is correlated to 1 product you track.
▤ MongoDB Atlas for Government
IOC 91.132.163.78 · DE
CVE-2026-88773
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 1 product you track.
▤ Citrix for Government
IOC 162.240.90.178 · US
CVE-2026-88775
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 1 product you track.
▤ Citrix for Government
IOC 162.240.90.178 · US
CVE-2026-88776
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 1 product you track.
▤ Citrix for Government
IOC 162.240.90.178 · US
CVE-2026-88777
Live threat-actor IOC attributed to ShinyHunters references this CVE — which is correlated to 1 product you track.
▤ Citrix for Government
IOC 162.240.90.178 · US
SHARED INFRASTRUCTURE · YOUR VENDORS HOSTING MALICIOUS IPS
13 vendors
Known-malicious IPs whose hosting network (ASN) belongs to a FedRAMP vendor you track — a shared-responsibility awareness signal, not an accusation against the vendor.
Cloudflare
70 IPs
hosts 70 known-malicious IPs · AU, CA, US
1.0.0.21.0.0.3104.16.218.84104.16.219.84104.16.91.19104.16.92.19104.18.32.47104.20.23.154104.20.24.117104.20.44.100
Amazon
40 IPs
hosts 40 known-malicious IPs · CA, SG, US
13.248.213.4513.32.104.12213.32.104.4813.32.104.5113.32.104.5618.154.219.10718.154.219.12118.154.219.6518.154.219.8718.160.156.19
Google
14 IPs
hosts 14 known-malicious IPs · IN, US
142.250.138.100142.250.138.101142.250.138.102142.250.138.113142.250.138.138142.250.138.139142.251.186.191173.194.208.17173.194.208.18173.194.208.19
Microsoft
10 IPs
hosts 10 known-malicious IPs · AU, JP, NL, US
150.171.110.17920.112.250.13320.12.8.220.15.6.120.18.4.120.231.239.24620.236.44.16220.70.246.2020.76.201.17120.9.10.1
hosts 6 known-malicious IPs · US
11.110.0.14111.134.0.5311.136.0.3711.138.0.211.138.1.726.1.2.1
hosts 3 known-malicious IPs · KR, SG
150.109.230.10443.134.165.20543.153.227.206
hosts 1 known-malicious IP · US
192.170.240.137
SEC 8-K · MATERIAL CYBER DISCLOSURES
10 filings · 180d
Public companies filing SEC Form 8-K Item 1.05 (material cybersecurity incident). A filer you track is a direct early warning; the rest are supply-chain / peer signal.
MNSG Acquisition Company, LLC
CMMC ecosystem firm
Filed a material cybersecurity incident 8-K as Charlton Aria Acquisition Corp (2026-10-07).
Public Health Foundation
FedRAMP vendor
Filed a material cybersecurity incident 8-K as Astrana Health, Inc. (2026-09-23).
Palo Alto Networks, Inc.
FedRAMP vendor
Filed a material cybersecurity incident 8-K as Alto Ingredients, Inc. (2026-08-07).
Equifax
FedRAMP vendor
Filed a material cybersecurity incident 8-K as EQUIFAX INC (2026-07-21).
Equifax
FedRAMP vendor
Filed a material cybersecurity incident 8-K as EQUIFAX INC (2026-04-21).
RECENT 8-K CYBER FILINGS
sec edgar
| FILER | STATE | FILED | FILING |
|---|---|---|---|
| Charlton Aria Acquisition Corp | CA | 2026-10-07 | EDGAR ▸ |
| Telomir Pharmaceuticals, Inc. | FL | 2026-10-06 | EDGAR ▸ |
| Astrana Health, Inc. | CA | 2026-09-23 | EDGAR ▸ |
| IPG PHOTONICS CORP | MA | 2026-09-08 | EDGAR ▸ |
| Alto Ingredients, Inc. | CA | 2026-08-07 | EDGAR ▸ |
| CID Holdco, Inc. | MD | 2026-07-22 | EDGAR ▸ |
| EQUIFAX INC | GA | 2026-07-21 | EDGAR ▸ |
| IPG PHOTONICS CORP | MA | 2026-07-17 | EDGAR ▸ |
| HONEYWELL INTERNATIONAL INC | NC | 2026-04-23 | EDGAR ▸ |
| EQUIFAX INC | GA | 2026-04-21 | EDGAR ▸ |
RANSOMWARE LEAK-SITE VICTIMS
200 recent claims
RECENT VICTIM CLAIMS
qilin
Via Credit Union
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
www.coopecaja.fi.cr
inc ransom
nowaszkola.com
ransomware groups posting new victim claims (ransomlook) — supply-chain early warning
PIPELINE ESCALATIONS · INTEL-ENGINE CORRELATIONS
500 active
The intel pipeline's own fused correlations — country/source-scoped (a tier above the entity-specific matches above), DEFCON-ranked.
FUSED ESCALATIONS
DEFCON 1
CRITICAL
Nation-State Network Activity · US
Country: US
Distinct threat sources: 4 (sans, feodo, cfradar, changedetection)
Total events: 7
Multi-signal nation-state activity.
sansfeodocfradarchangedetection
DEFCON 1
CRITICAL
Nation-State Network Activity · NL
Country: NL
Distinct threat sources: 4 (sans, ipsum, openphish, cctracker)
Total events: 9
Multi-signal nation-state activity.
sansipsumopenphishcctracker
DEFCON 2
CRITICAL
DDoS Origin + Active Threat Feed Signal · US
Cloudflare Radar top DDoS-origin country correlates with ≥5 active threat events from the same country in the last window — indicates concentrated...
changedetectioncfradarsansfeodo
DEFCON 2
CRITICAL
DDoS Origin + Active Threat Feed Signal · CN
Cloudflare Radar top DDoS-origin country correlates with ≥5 active threat events from the same country in the last window — indicates concentrated...
c2inteleturlhaus
DEFCON 2
CRITICAL
DDoS Origin + Active Threat Feed Signal · SG
Cloudflare Radar top DDoS-origin country correlates with ≥5 active threat events from the same country in the last window — indicates concentrated...
eturlscan
DEFCON 3
HIGH
Bulletproof Hosting Detected
1 ASN(s) flagged across 3+ blocklists:
AS13335 (3 feeds: urlscan, openphish, cctracker)