Bulgaria

Reported Context (4)

in three different countries: 185.122.185[.]36 in Estonia on 24 January 2026, 194.71.107[.]243 in Bulgaria on 30 January, and 188.190.29[.]126 on 26 February, and where it currently resolves as of this post's Researchers Map SpiceRAT-Linked Infrastructure Impersonating Central Asian Government and Energy Targets
Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, Netherlands, Italy, Spain, United Kingdom, and Austria. Research details toolkits targeting Ukrainian IP cameras and routers
we mapped potentially malicious infrastructure across 10 countries in the region, covering Belarus, Bulgaria, the Czech Republic, Hungary, Poland, Moldova, Romania, Russia, Slovakia, and Ukraine. Hunt.io Maps 3,923 Potentially Malicious Infrastructure Endpoints Across Eastern Europe
taxpayers was also targeting DPD delivery customers in the UK and Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States. Hunt.io Traces Smishing Campaign Targeting Services in 19 Countries

CVE (12)

Malware (17)

People (5)

Threat Actors (12)

MITRE ATT&CK (23)

Vendors (43)

Products (17)

Tools (25)

Industries (11)

Countries (38)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.