This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. Alleged data breach of Samco
- Category: Data Breach
- Content: The threat actor claims to have leaked a database from Samco. The compromised data includes full customer, trading, and account records.
- Date: 2025-09-19T14:27:11Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-DATABASE-%F0%9F%94%B4-SAMCO-FINANCE-CUSTOMER-ACCOUNT-DATABASE-LEAK-INDIA-FINANCE
- Screenshots:
- Threat Actors: Samco
- Victim Country: India
- Victim Industry: Financial Services
- Victim Organization: samco
- Victim Site: samco.in
2. Alleged unauthorized access to unidentified SCADA system controlling biomass boiler in Czech Republic
- Category: Initial Access
- Content: The group claims to have gained access to an unidentified SCADA system controlling biomass boiler in Czech Republic. The alleged breach control over hot water temperature settings, system’s on and off temperatures, screw cycling parameters, exhaust and auxiliary fans, operation parameters, heating circuit temperature parameters and schedule settings for the heating circuit.
- Date: 2025-09-19T14:02:47Z
- Network: telegram
- Published URL: https://t.me/c/2948243735/53
- Screenshots:
- Threat Actors: TwoNet
- Victim Country: Czech Republic
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
3. Alleged unauthorized access to unidentified TRC Automation production control in Italy
- Category: Initial Access
- Content: The group claims to have gained access to an unidentified TRC Automation production control in Italy.
- Date: 2025-09-19T13:21:11Z
- Network: telegram
- Published URL: https://t.me/Z_ALLIANCE/774
- Screenshots:
- Threat Actors: Z-ALLIANCE
- Victim Country: Italy
- Victim Industry: Industrial Automation
- Victim Organization: Unknown
- Victim Site: Unknown
4. Alleged data sale of personally identifiable information (PII) from multiple countries
- Category: Data Breach
- Content: The threat actor claims to be selling personally identifiable information (PII) from multiple countries, including Belgium, Germany, France, the United States, and Canada. The compromised data includes names, dates of birth, and ID documents.
- Date: 2025-09-19T12:53:21Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-Source-Code-%E2%80%9CWorldwide-PII-dump%E2%80%9D
- Screenshots:
- Threat Actors: TomSec
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
5. Alleged Unauthorized Access to Optical Network Control System, Ukraine
- Category: Initial Access
- Content: The group claims to have gained access to a PON optical network control panel in Ukraine. The alleged breach reportedly enables monitoring of optical ports, signal strength, voltage, and temperature, as well as management of user ONU/ONT devices, switch information, remote port controls and device blocking.
- Date: 2025-09-19T12:30:29Z
- Network: telegram
- Published URL: https://t.me/n2LP_wVf79c2YzM0/1681
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: Ukraine
- Victim Industry: Network & Telecommunications
- Victim Organization: Unknown
- Victim Site: Unknown
6. Alleged data sale of Wärtsilä
- Category: Data Breach
- Content: The threat actor claims to be selling data from Wärtsilä. The compromised data includes information on employees, partners, and vendors, including but not limited to names, email addresses, phone numbers, mobile numbers, addresses, and more.
- Date: 2025-09-19T12:25:10Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-W%C3%A4rtsil%C3%A4-Corporation-Energy-Marine-Organization-Data
- Screenshots:
- Threat Actors: 1nval1d
- Victim Country: Finland
- Victim Industry: Machinery Manufacturing
- Victim Organization: wärtsilä
- Victim Site: wartsila.com
7. Alleged Breach of Iran International
- Category: Data Breach
- Content: The group claims to have breached the Iran International, gaining access to documents and defacing the site. NB: The authenticity of the claim is yet to be verified.
- Date: 2025-09-19T12:01:41Z
- Network: telegram
- Published URL: https://t.me/Anonymous_iran_1357/11
- Screenshots:
- Threat Actors: Iran Anonymous
- Victim Country: UK
- Victim Industry: Newspapers & Journalism
- Victim Organization: iran international
- Victim Site: iranintl.com
8. Alleged sale of custom malware
- Category: Malware
- Content: The threat actor claims to be selling a fully functional custom malware.
- Date: 2025-09-19T11:33:08Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-Source-Code-For-Sale-Malicious-File-Exploit
- Screenshots:
- Threat Actors: apt_lazuzu
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
9. Alleged data leak of UAE Ministry of Education
- Category: Data Breach
- Content: The threat actor claims to be selling 5,928 login credentials for the UAE Ministry of Education. The compromised data includes personal information on teachers, bachelors, students, and their families.
- Date: 2025-09-19T11:13:05Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-Selling-UAE-Ministry-of-Education-Accesses
- Screenshots:
- Threat Actors: Shad0w
- Victim Country: UAE
- Victim Industry: Government Administration
- Victim Organization: ministry of education
- Victim Site: moe.gov.ae
10. Alleged unauthorized access to unidentified heat control system in Poland
- Category: Initial Access
- Content: The group claims to have gained access to an unidentified heat control system in Poland. The alleged breach reportedly enables control of heating system control, hot water management, energy monitoring, temperature settings, system alarms and history.
- Date: 2025-09-19T11:11:01Z
- Network: telegram
- Published URL: https://t.me/c/2549402132/319
- Screenshots:
- Threat Actors: Inteid
- Victim Country: Poland
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
11. Hider_Nex claims to target Israel
- Category: Alert
- Content: A recent post by the group indicates that they are targeting Israel.
- Date: 2025-09-19T10:06:24Z
- Network: telegram
- Published URL: https://t.me/Hider_N3x/278
- Screenshots:
- Threat Actors: Hider_Nex
- Victim Country: Israel
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
12. Alleged sale of Intelligence data
- Category: Data Breach
- Content: The threat actor claims to be selling intelligence data on country A’s government and country B’s military, covering September 2025 to January 2026. They also offer access to a national security agency machine linked to a UN security council member.
- Date: 2025-09-19T10:00:52Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-Document-intelligence-data-file
- Screenshots:
- Threat Actors: jok_Williams
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
13. UnknowSec claims to target educational institutions in Thailand
- Category: Alert
- Content: A recent post by the group indicates that they are targeting educational institutions in Thailand.
- Date: 2025-09-19T09:40:34Z
- Network: telegram
- Published URL: https://t.me/UnknowSec_hater/10
- Screenshots:
- Threat Actors: UnknowSec
- Victim Country: Thailand
- Victim Industry: Education
- Victim Organization: Unknown
- Victim Site: Unknown
14. Alleged data leak of information on community owners in Suqian City, China
- Category: Data Breach
- Content: The threat actor claims to have leaked 290,000 records of data on community owners in Suqian City, China. The compromised data includes unit name, ID number, household registration address, mobile phone number and more.
- Date: 2025-09-19T09:28:35Z
- Network: tor
- Published URL: http://cabyceogpsji73sske5nvo45mdrkbz4m3qd3iommf3zaaa6izg3j2cqd.onion/#/detail?gid=13b8bec6fa8447548da8ec1047243990
- Screenshots:
- Threat Actors: Exchange Markets
- Victim Country: China
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
15. UnknowSec claims to target School of Thailand
- Category: Alert
- Content: A recent post by the group indicates that they are targeting School of Thailand.
- Date: 2025-09-19T09:25:24Z
- Network: telegram
- Published URL: https://t.me/UnknowSec_hater/10
- Screenshots:
- Threat Actors: UnknowSec
- Victim Country: Thailand
- Victim Industry: Education
- Victim Organization: Unknown
- Victim Site: Unknown
16. Alleged sale of 12.28 million data from UAE
- Category: Data Breach
- Content: The threat actor claims to be selling a database of 12.28 million records from the UAE, the provided sample reportedly includes phone numbers.
- Date: 2025-09-19T07:43:55Z
- Network: tor
- Published URL: https://cabyceogpsji73sske5nvo45mdrkbz4m3qd3iommf3zaaa6izg3j2cqd.onion/#/detail?gid=146cf63b167a4bdeaecfd3215b5d66b8
- Screenshots:
- Threat Actors: Exchange Markets
- Victim Country: UAE
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
17. Alleged data sale of an unidentified Dubai power station
- Category: Data Breach
- Content: The threat actor claims to be selling a dataset of an unidentified powers station in Dubai that includes sensitive customer information such as family name, phone number, home address, email, monthly electricity consumption, payment account number, and bill amount. The listing further alleges that the dataset contains details for 700000 to 1.5 million users and that 10,000 tests are provided.
- Date: 2025-09-19T07:33:32Z
- Network: tor
- Published URL: https://cabyceogpsji73sske5nvo45mdrkbz4m3qd3iommf3zaaa6izg3j2cqd.onion/#/detail?gid=a48ab5c913534fe89d6d156544d57cd5
- Screenshots:
- Threat Actors: Exchange Markets
- Victim Country: UAE
- Victim Industry: Energy & Utilities
- Victim Organization: Unknown
- Victim Site: Unknown
18. Alleged data breach of Pasaman Regency Communication and Information Service West
- Category: Data Breach
- Content: The threat actor claims to have leaked a database from the Pasaman Regency Communication and Information Service West, allegedly containing ID number, name, date of birth, registration, email, province, phone number, marital status, and more.
- Date: 2025-09-19T07:00:46Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-DATABASE-Kabupaten-Pasaman-Barat-Leaked-By-LolForum
- Screenshots:
- Threat Actors: Loof
- Victim Country: Indonesia
- Victim Industry: Government Administration
- Victim Organization: pasaman regency communication and information service west
- Victim Site: pasamanbaratkab.go.id
19. Alleged data breach of Ministry of Finance
- Category: Data Breach
- Content: The threat actor claims to have leaked internal documents from the Algerian Ministry of Finance, containing sensitive information related to HR, appointments, and internal correspondence.
- Date: 2025-09-19T05:32:26Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-Document-ARCHIVE-%E2%80%94-Algerian-Ministry-of-Finance-internal-docs-HR-Appointments
- Screenshots:
- Threat Actors: sarah8toumi
- Victim Country: Algeria
- Victim Industry: Government Administration
- Victim Organization: ministry of finance
- Victim Site: mf.gov.dz
20. Alleged sale of unauthorized CRM access to unidentified software company in USA
- Category: Initial Access
- Content: A threat actor claims to be selling unauthorized access to the CRM and database of a US-based software company, reportedly containing personal and financial details such as full name, email, date of birth, SSN, phone numbers, addresses (current and previous), employment info, subscription plans, and status, with full admin privileges to view, edit, delete, export data, and access orders, tickets, employee lists, and email functions.
- Date: 2025-09-19T04:09:53Z
- Network: openweb
- Published URL: https://forum.exploit.in/topic/266568/
- Screenshots:
- Threat Actors: betway
- Victim Country: USA
- Victim Industry: Software
- Victim Organization: Unknown
- Victim Site: Unknown
21. Alleged Access to Fully Undetectable Remote Access Tool with Valid EV Certificate
- Category: Malware
- Content: A threat actor is offering a fully undetectable (FUD) remote access tool as a ScreenConnect alternative, claiming it includes a valid Extended Validation (EV) certificate to bypass Chrome and SmartScreen protections, along with features such as a remote viewer, cloaked landing pages, antibot mechanisms, and a PowerShell-based executable loader, priced at $700 for a one-year license covering 300 devices.
- Date: 2025-09-19T03:21:42Z
- Network: openweb
- Published URL: https://forum.exploit.in/topic/266565/
- Screenshots:
- Threat Actors: anaverageguy
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
22. Alleged sale of 1000 Brazilian credit card data
- Category: Data Breach
- Content: A threat actor claims to be selling a batch of 1,000 Brazilian credit card records with a reported 60%+ validity rate.
- Date: 2025-09-19T02:39:46Z
- Network: openweb
- Published URL: https://forum.exploit.in/topic/266563/
- Screenshots:
- Threat Actors: Hashcat
- Victim Country: Brazil
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
23. Alleged sale of Aux Logger v3.0.0.0 Monitor
- Category: Malware
- Content: A threat actor claims to be selling a package called Aux Logger v3.0.0.0, a keylogging and surveillance tool allegedly designed for business and private use, featuring email and FTP log exfiltration, unique stub generation, fake message boxes, installed programs logging, mutex support, and persistent keylogging capabilities.
- Date: 2025-09-19T02:33:16Z
- Network: openweb
- Published URL: https://demonforums.net/Thread-Leak-Aux-Logger-v3-0-0-0-Monitor
- Screenshots:
- Threat Actors: rippors
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
24. Alleged data breach of Transparent BPO
- Category: Data Breach
- Content: Threat actor claims to have leaked the data of Transparent BPO. The compromised data includes activation codes, age, appearance, authentication data, account activation status, profile avatars, complete addresses, contact numbers, country, courtesy titles, personal descriptions, email addresses, email notification preferences, external identifiers, first names, completed forms, etc.
- Date: 2025-09-19T02:33:03Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-Transparent-BPO-Leaked-Download
- Screenshots:
- Threat Actors: flirt
- Victim Country: USA
- Victim Industry: Outsourcing & Offshoring
- Victim Organization: transparent bpo
- Victim Site: transparentbpo.com
25. Alleged data breach of Gobierno de San Juan
- Category: Data Breach
- Content: The threat actor claims to have leaked a database from andes.sanjuan.gob.ar, a government health system in Argentina. The leak allegedly contains 992,815 rows of patient data, including names, IDs, birthdates, and locations.
- Date: 2025-09-19T00:32:47Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-DATABASE-ANDES-SANJUAN-GOB-AR-992-815-RECORDS-DATABREACH
- Screenshots:
- Threat Actors: Z1k3n
- Victim Country: Argentina
- Victim Industry: Government Administration
- Victim Organization: gobierno de san juan
- Victim Site: andes.sanjuan.gob.ar
26. Alleged data breach of Malaysia Space Agency (MYSA)
- Category: Data Breach
- Content: A threat actor claims to have leaked a database from the Malaysia Space Agency (MYSA), containing sensitive voter and election data.
- Date: 2025-09-19T00:17:59Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-DATABASE-V-For-Vendetta-MYSA-Voters-Data-Database-Leaked
- Screenshots:
- Threat Actors: VoidDragon
- Victim Country: Malaysia
- Victim Industry: Aviation & Aerospace
- Victim Organization: malaysia space agency (mysa)
- Victim Site: mysa.gov.my
Based on the provided reports, the incidents detailed in this report highlight a diverse and active landscape of cyber threats. Data breaches and leaks are prominent, affecting various sectors, from finance and industrial automation to government administration and education, and impacting countries including India, the Czech Republic, Italy, Ukraine, Finland, the UK, the UAE, Poland, Israel, China, Brazil, Indonesia, Algeria, the USA, Argentina, and Malaysia. The compromised data ranges from personal user information and credit card details to sensitive patient records, classified military components, and large customer databases. Beyond data compromise, the report also reveals significant activity in initial access sales, with threat actors offering unauthorized access to banking systems, corporate networks, government and military infrastructure, and industrial control systems. The sale of malware, including remote access tools, keyloggers, and DDoS tools, further underscores the availability of offensive capabilities in the cyber underground. These incidents collectively demonstrate that organizations across various industries and geographies face persistent threats from data exfiltration, unauthorized network access, and the proliferation of malicious tools. The nature of these incidents emphasizes the critical importance of robust cybersecurity measures, including strong access controls, data protection strategies, continuous vulnerability management, and proactive threat intelligence to defend against a wide array of sophisticated and opportunistic attacks.