This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. Payouts King Ransomware group adds an unknown victim (L****s)
- Category: Ransomware
- Content: The group claims to have obtained 1.1 TB of the organization’s data and intends to publish it within 6 to 7 days.
- Date: 2025-09-30T13:55:34Z
- Network: tor
- Published URL: (https://payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion/)
- Screenshots:
- Threat Actors: Payouts King
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
2. Alleged access sale of PayTrace
- Category: Initial Access
- Content: The threat actor claims to be selling access to the PayTrace system, the listing includes screenshots showing a functional Dashboard and forms that allow for the manual input of full card details, including the Credit Card Number, CVV, Expiry Date, and Billing Code for a “Key Entry Card.”
- Date: 2025-09-30T13:41:56Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267294/)
- Screenshots:
- Threat Actors: che_guevara
- Victim Country: USA
- Victim Industry: Financial Services
- Victim Organization: paytrance
- Victim Site: paytrace.net
3. Alleged unauthorized access to unidentified air conditioning control system of manufacturing facility in UK
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to a unidentified air conditioning control system with access control elements of manufacturing facility in UK. The compromised system reportedly enables precise adjustment of monitoring and regulation of air temperature and fresh air supply, control of door and gate status for security, separation of operating modes by room occupancy level, industrial use, laboratory, production facility.
- Date: 2025-09-30T13:37:50Z
- Network: telegram
- Published URL: (https://t.me/Z_ALLIANCE/795)
- Screenshots:
- Threat Actors: Z-PENTEST ALLIANCE
- Victim Country: UK
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
4. Burke Contracting falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 292GB of corporate data from Burke Contracting, including personal information of employees, founders, and upper management such as W9 forms with full names, dates of birth, addresses, emails, and phone numbers, financial records including credit card details, customer information, NDAs, and other sensitive documents.
- Date: 2025-09-30T13:21:08Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: burke contracting llc
- Victim Site: burkecontractingllc.com
5. Priester Aviation falls victim to Akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 124 GB of corporate data from Priester Aviation, including employee and relative personal documents (passports, driver’s licenses, medical records), crew personal files, financial records, aircraft maintenance data, contracts, NDAs, and confidential customer information.
- Date: 2025-09-30T13:14:59Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Airlines & Aviation
- Victim Organization: priester aviation
- Victim Site: priesterav.com
6. Louisiana Fish Fry Products falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 113GB of corporate data from Louisiana Fish Fry Products, including detailed employee personal information, financial records such as credit card details, client and customer information, internal confidential files, NDAs, and other sensitive documents.
- Date: 2025-09-30T12:57:15Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Manufacturing
- Victim Organization: louisiana fish fry products
- Victim Site: louisianafishfry.com
7. Akira ransomware targets multiple organizations
- Category: Ransomware
- Content: The group claims to have targeted multiple organizations that were clients of the victim, including Davis Research, Jamerson & Bauwens, Clawson Honda of Fresno, Advance Retail Technology, Applejack Wine & Spirits, and Jones-McLeod, stating that the compromise occurred through their relationship with the victim.
NB: The authenticity of the post is yet to be verified.
- Date: 2025-09-30T12:45:23Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Market Research
- Victim Organization: davis research llc
- Victim Site: davisresearch.com
8. Midwest Industries Inc falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained corporate data including full employee information names, DOB, address, emails, phones, SSNs, passports, medical information, financials, agreements, internal confidential files, HR files etc.
- Date: 2025-09-30T12:42:32Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Maritime
- Victim Organization: midwest industries inc
- Victim Site: midwestindustries.com
9. Lasse Larsen Huse falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 139GB of corporate data from Lasse Larsen Huse. The leaked information allegedly includes client names, contacts, addresses, architectural drawings of houses, financial data, project details, NDAs, and other sensitive corporate documents.
- Date: 2025-09-30T12:34:17Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: Denmark
- Victim Industry: Building and construction
- Victim Organization: lasse larsen huse
- Victim Site: lasselarsenhuse.dk
10. Hibbs ElectroMechanical, Inc. falls victim to Akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained corporate data. which includes employee personal information, financials information, customer information etc.
- Date: 2025-09-30T12:27:46Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Electrical & Electronic Manufacturing
- Victim Organization: hibbs electromechanical, inc.
- Victim Site: hibbsinc.com
11. Kaestle Boos Associates, Inc. falls victim to Akira Ransomware
- Category: Ransomware
- Content: Group claims to have obtained 43 GB of corporate data, includes employee personal documents, financials information, customer information, projects, NDAs, etc.
- Date: 2025-09-30T12:26:43Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Architecture & Planning
- Victim Organization: kaestle boos associates, inc.
- Victim Site: kba-architects.com
12. Alleged databreach of SuperEd Pty Ltd
- Category: Data Breach
- Content: The threat actor claims to have breached 1.5 GB of the organization’s data. The breached data includes some of the information like assigned user id, team id, name, list type, domain name, date entered and modified. A session link is also provided.
- Date: 2025-09-30T12:22:57Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Supered-com-au-Leaked-Download)
- Screenshots:
- Threat Actors: UNIT_PEGASUS
- Victim Country: Australia
- Victim Industry: Financial Services
- Victim Organization: supered pty ltd
- Victim Site: supered.com.au
13. Turf Care Products Canada falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 30GB corporate data including employee personal documents, passports, medical information, prescriptions, questionnaires. HR information, financials, agreements, internal confidential files, projects, clients information etc.
- Date: 2025-09-30T12:16:34Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: Canada
- Victim Industry: Wholesale
- Victim Organization: turf care products canada
- Victim Site: turfcare.ca
14. Bugnard SA falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 32GB corporate data, financial documents, agreements, confidential files, projects, clients information etc.
- Date: 2025-09-30T11:57:48Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: Switzerland
- Victim Industry: Machinery Manufacturing
- Victim Organization: bugnard sa
- Victim Site: bugnard.ch
15. Sueba USA Corporation falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 20GB of corporate data from Sueba USA, including detailed financial documents, client records, agreements, confidential files, project materials, and limited customer information.
- Date: 2025-09-30T11:57:06Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Real Estate
- Victim Organization: sueba usa corporation
- Victim Site: suebausa.com
16. Sinco, Inc. falls victim to Akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 13 GB of corporate data including employee and customer information, complaints, financials information, lots of agreements and contracts, and other data
- Date: 2025-09-30T11:51:24Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Manufacturing
- Victim Organization: sinco, inc.
- Victim Site: sincoinc.com
17. Kabs PolsterWelt falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 110 GB of corporate data, allegedly including names, addresses, scanned personal documents, financial information and payment details, some customer information, NDAs, and more.
- Date: 2025-09-30T11:43:59Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: Germany
- Victim Industry: Furniture
- Victim Organization: kabs polsterwelt
- Victim Site: kabs.de
18. Von Paris Moving & Storage falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained corporate data from Von Paris Moving, including employee personal details (names, addresses, dates of birth, phone numbers), financial records, client documents, contracts and agreements, project files, and other sensitive information.
- Date: 2025-09-30T11:43:41Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Transportation & Logistics
- Victim Organization: von paris moving & storage
- Victim Site: vonparis.com
19. Pawling Corporation falls victim to Akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 21 GB of corporate data including detailed employee personal information (DOB, emails, titles, phones, addresses), financials information, customer information, lots of agreements, and other data.
- Date: 2025-09-30T11:42:42Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: pawling corporation
- Victim Site: pawling.com
20. KIP Ingenieure und Planer AG falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 28 GB of corporate data, allegedly containing employee files, financial information, customer information, NDAs, numerous project files, and more.
- Date: 2025-09-30T11:37:05Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: Switzerland
- Victim Industry: Civil Engineering
- Victim Organization: kip ingenieure und planer ag
- Victim Site: planora.ch
21. Tom Duffy Company falls victim to Akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 7 GB of corporate data including employee personal information (names, DOB, address, emails, phones), financials, customer and partner information, lots of agreements and contracts, NDAs, and other data
- Date: 2025-09-30T11:36:48Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: tom duffy company
- Victim Site: tomduffy.com
22. Apex CoVantage falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained over 35GB of corporate data from Apex CoVantage, including financial records (audits, payment details, invoices), employee and customer personal information (passports, death certificates, emails, phone numbers), NDAs, and other confidential documents.
- Date: 2025-09-30T11:30:54Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: apex covantage
- Victim Site: apexcovantage.com
23. Alleged unauthorized access to unidentified water treatment and filtration plant in Spain
- Category: Initial Access
- Content: The group claims to have gained access to an unidentified water treatment and filtration plant in Spain. The alleged breach reportedly enables control of water pump control, filter control, backwash modes, water quality monitoring, settings and diagnostics.
- Date: 2025-09-30T10:57:34Z
- Network: telegram
- Published URL: (https://t.me/c/2549402132/375)
- Screenshots:
- Threat Actors: Inteid
- Victim Country: Spain
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
24. HellR00ters Team targets multiple Indian websites
- Category: Defacement
- Content: Group claims to have defaced multiple Indian websites.
Mirror Link :- https://zone-xsec.com/mirror/id/741091 https://zone-xsec.com/mirror/id/741092 https://zone-xsec.com/mirror/id/741093 https://zone-xsec.com/mirror/id/741094 https://zone-xsec.com/mirror/id/741095 https://zone-xsec.com/mirror/id/741096 https://zone-xsec.com/mirror/id/741097 https://zone-xsec.com/mirror/id/741098 https://zone-xsec.com/mirror/id/741099 https://zone-xsec.com/mirror/id/741100 https://zone-xsec.com/mirror/id/741101 https://zone-xsec.com/mirror/id/741102 https://zone-xsec.com/mirror/id/741103 https://zone-xsec.com/mirror/id/741104 https://zone-xsec.com/mirror/id/741105 https://zone-xsec.com/mirror/id/741106 https://zone-xsec.com/mirror/id/741107 https://zone-xsec.com/mirror/id/741108
- Date: 2025-09-30T10:11:37Z
- Network: telegram
- Published URL: (https://t.me/c/2758066065/31)
- Screenshots:
- Threat Actors: HellR00ters Team
- Victim Country: India
- Victim Industry: Building and construction
- Victim Organization: advit associates llp
- Victim Site: advitassociates.com
25. FANATIX LEGION targets the website of Cosmic Soulsound
- Category: Defacement
- Content: The threat actor claims to have defaced the website of Cosmic Soulsound.
Mirror Link: https://zone-xsec.com/search/q=Bnzet
- Date: 2025-09-30T09:47:54Z
- Network: telegram
- Published URL: (https://t.me/fanatixlegionv/3)
- Screenshots:
- Threat Actors: FANATIX LEGION
- Victim Country: Austria
- Victim Industry: Entertainment & Movie Production
- Victim Organization: cosmic soulsound
- Victim Site: cosmic‑https://www.google.com/search?q=soulsound.com
26. FANATIX LEGION targets the website of backup.skin-like-cleopatra
- Category: Defacement
- Content: The threat actor claims to have defaced the website of backup.skin-like-cleopatra.
Mirror Link: https://zone-xsec.com/search/q=Bnzet
- Date: 2025-09-30T09:47:34Z
- Network: telegram
- Published URL: (https://t.me/fanatixlegionv/3)
- Screenshots:
- Threat Actors: FANATIX LEGION
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: backup.skin-like-cleopatra
- Victim Site: backup.skin-like-cleopatra.at
27. Alleged Unauthorized Access to Shimao Agricultural Biotech Co., Ltd.
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to Shimao Agricultural Biotechnology, manipulating temperature, humidity, fan systems, PLC schedules, and monitoring screens, thereby disrupting plant cultivation processes and causing critical operational failures.
- Date: 2025-09-30T09:12:13Z
- Network: telegram
- Published URL: (https://t.me/Z_ALLIANCE/794)
- Screenshots:
- Threat Actors: Z-PENTEST ALLIANCE
- Victim Country: Taiwan
- Victim Industry: Agriculture & Farming
- Victim Organization: shimao agricultural biotech co., ltd.
- Victim Site: symon.com.tw
28. AZPRO falls victim to J group Ransomware
- Category: Ransomware
- Content: Group posted an unidentified victim, (a********p.com), on August 13, 2025
Update:
On September 29th, they revealed the full domain name and made available to download.
- Date: 2025-09-30T08:43:33Z
- Network: tor
- Published URL: (http://twniiyed6mydtbe64i5mdl56nihl7atfaqtpww6gqyaiohgc75apzpad.onion/posts/689d83580b175cbc06955d85/689d83580b175cbc06955d85/)
- Screenshots:
- Threat Actors: J group
- Victim Country: USA
- Victim Industry: Printing
- Victim Organization: azpro
- Victim Site: azprogroup.com
29. Alleged data sale of Avalara, Inc.
- Category: Data Breach
- Content: The threat actor claims to be selling 8 million rows of data from Avalara, Inc., allegedly containing API tokens, API endpoints, first names, last names, phone numbers, email addresses, and more.
- Date: 2025-09-30T08:40:20Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Avalara-com-Data-breach)
- Screenshots:
- Threat Actors: ghidra
- Victim Country: USA
- Victim Industry: Software Development
- Victim Organization: avalara, inc.
- Victim Site: avalara.com
30. Medical Computer Business Services falls victim to PEAR Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 3.3TB of organization data.
- Date: 2025-09-30T08:17:39Z
- Network: tor
- Published URL: (http://peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion/Companies/mcbs/)
- Screenshots:
- Threat Actors: PEAR
- Victim Country: USA
- Victim Industry: Accounting
- Victim Organization: medical computer business services, llc
- Victim Site: mcbs.com
31. USB Memory Direct falls victim to STORMOUS Ransomware
- Category: Ransomware
- Content: The group claims to have obtained over 60GB of data from USB Memory Direct. The compromised data includes personal information such as names and photos, company data such as names, services, tools and equipment, internal documents, project files, backup copies and system archive compressed files.
- Date: 2025-09-30T07:40:04Z
- Network: tor
- Published URL: (http://pdcizqzjitsgfcgqeyhuee5u6uki6zy5slzioinlhx6xjnsw25irdgqd.onion/)
- Screenshots:
- Threat Actors: STORMOUS
- Victim Country: USA
- Victim Industry: Marketing, Advertising & Sales
- Victim Organization: usb memory direct
- Victim Site: usbmemorydirect.com
32. Alleged leak of Delhi Police Personally Identifiable Information data
- Category: Data Breach
- Content: The threat actor claims to have leaked the Personally Identifiable Information (PII) of 38 Delhi Police personnel. The compromised data reportedly includes personal and sensitive information such as name, father’s name, date of birth, address, residency period, district, police station, nationality, Aadhaar number, email ID, mobile number, organization name, organization address, and additional phone numbers.
- Date: 2025-09-30T07:36:54Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-30x-delhipolice-gov.in-PII)
- Screenshots:
- Threat Actors: Purple0piOd
- Victim Country: India
- Victim Industry: Law Enforcement
- Victim Organization: delhi police
- Victim Site: delhipolice.gov.in
33. Alleged Leak of access to Department of Lands and Surveys
- Category: Initial Access
- Content: Group claims to have leaked credentials providing access to Department of Lands and Surveys.
- Date: 2025-09-30T07:32:03Z
- Network: telegram
- Published URL: (https://t.me/fornetcloud/2306)
- Screenshots:
- Threat Actors: FORNET ORG
- Victim Country: Malaysia
- Victim Industry: Government Administration
- Victim Organization: department of lands and surveys
- Victim Site: dbass.sabah.gov.my
34. Alleged leak of Cambodia database
- Category: Data Breach
- Content: The threat actor claims to have leaked Cambodia database of 107 GB, containing about 203 million rows
- Date: 2025-09-30T07:22:42Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Camboya-DB-leak-avilable-fresh-2025-9-17-203-million-rows-107GB)
- Screenshots:
- Threat Actors: yees09
- Victim Country: Cambodia
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
35. Alleged leak of Indian citizens and companies database
- Category: Data Breach
- Content: The threat actor claims to have leaked a database containing 230 million rows of information tied to Indian citizens and companies
- Date: 2025-09-30T07:14:20Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-India-citizens-and-companies-fresh-extracted-2025-9-24-DB-avilable-203million-rows-29)
- Screenshots:
- Threat Actors: yees09
- Victim Country: India
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
36. Alleged data leak of Dinas Kesehatan Provinsi Sulawesi Tengah
- Category: Data Breach
- Content: The group claims to have leaked biodata from Dinas Kesehatan Provinsi Sulawesi Tengah
- Date: 2025-09-30T07:02:20Z
- Network: telegram
- Published URL: (https://t.me/c/2532663346/27)
- Screenshots:
- Threat Actors: BABAYO EROR SYSTEM
- Victim Country: Indonesia
- Victim Industry: Government Administration
- Victim Organization: dinas kesehatan provinsi sulawesi tengah
- Victim Site: dinkes.sultengprov.go.id
37. Alleged data leak of Google
- Category: Data Breach
- Content: The threat actor claims to have leaked a massive dataset of about 1.2 million rows of information from Google
- Date: 2025-09-30T06:56:58Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Google-DB-leak-avilable-in-our-private-channel-fresh-2025-9-28-1-200million-rows-405)
- Screenshots:
- Threat Actors: yees98237b
- Victim Country: USA
- Victim Industry: Software Development
- Victim Organization: google llc
- Victim Site: google.com
38. Alleged sale of crypto wallet exploits and malware tools
- Category: Malware
- Content: The threat actor has been observed promoting a range of malicious tools on underground forums targeting cryptocurrency platforms and users. The offerings include wallet brute forcers capable of extracting seed phrases from logs, TRC20 and TronLink wallet drainers, and spoofers for Ledger and Trezor applications designed to steal private keys. Additional tools listed are automatic withdrawal bots for ERC20/TRC20 tokens, a Kraken VM for high-speed operations, and an AIO mailer with built-in bypasses for major email providers. The actor is also selling malware such as seed stealers, keyloggers, and loaders for remote command execution. Sales and inquiries are being directed through Telegram.
- Date: 2025-09-30T06:23:12Z
- Network: openweb
- Published URL: (https://forum.duty-free.cc/threads/1310/)
- Screenshots:
- Threat Actors: DFGSSDFGSGSAGDFDSG
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
39. Alleged data leak of Salvex
- Category: Data Breach
- Content: The threat actor allegedly leaked a full database from Salvex, an industrial surplus auction platform with international clients. The dataset, timestamped September 2025, contains over 73,000 company files along with employee and buyer registration records. Exposed information includes names, corporate emails, phone numbers, LinkedIn profiles, positions, and procurement notes of decision-makers from major enterprises across energy, insurance, logistics, aviation, and manufacturing. Additional files reportedly include NDAs, KYC documents, CVs, and auction records with financial details. Samples showing structured CSVs of company contacts and redacted verification snippets.
- Date: 2025-09-30T06:12:40Z
- Network: openweb
- Published URL: (https://breachsta.rs/topic/sale-salvex-industrial-surplus-db-full-breach-fresh-sep-2025-xtupe7014h7i)
- Screenshots:
- Threat Actors: CharlesWilson
- Victim Country: USA
- Victim Industry: Environmental Services
- Victim Organization: salvex
- Victim Site: salvex.com
40. Alleged data breach of Akulaku
- Category: Data Breach
- Content: The threat actor claiming affiliation with [CLOBELSECTEAM], claims to have leaked a database of Akulaku, a Southeast Asian fintech platform. The leak allegedly includes 32.6 million login records in CSV format, containing emails, phone numbers, plaintext passwords, and account creation timestamps from users.
- Date: 2025-09-30T05:56:28Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-CLOBELSECTEAM-leaked-32-millions-data-login Akulaku-users)
- Screenshots:
- Threat Actors: petrush4x0r
- Victim Country: Indonesia
- Victim Industry: Financial Services
- Victim Organization: akulaku
- Victim Site: akulaku.com
41. Alleged leak of Volkswagen Group database
- Category: Data Breach
- Content: The threat actor claims to have leaked 104 GB of data from Volkswagen AG, containing about 203 million rows
- Date: 2025-09-30T05:50:32Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Wokswaggen-Group-Db-leak-avilable-2025-9-25-203million-rows-104GB)
- Screenshots:
- Threat Actors: Yees8733
- Victim Country: Germany
- Victim Industry: Automotive
- Victim Organization: volkswagen ag
- Victim Site: volkswagen-group.com
42. INDOHAXSEC claims to target Several Israeli Government Agency Companies
- Category: Alert
- Content: A recent post by the group indicates that they are targeting Several Israeli Government Agency Companies.
- Date: 2025-09-30T05:45:31Z
- Network: telegram
- Published URL: (https://t.me/INDOHAXSEC/11)
- Screenshots:
- Threat Actors: INDOHAXSEC
- Victim Country: Israel
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
43. Alleged data breach of General Motors
- Category: Data Breach
- Content: The threat actor claims to have leaked a database of General Motors, stating that the full dataset contains 230 million lines totaling 198GB.
- Date: 2025-09-30T05:45:02Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-General-Motora-full-DB-leak-avilable-in-our-private-channel-230million-lines-198GB–49818)
- Screenshots:
- Threat Actors: Yees8733
- Victim Country: USA
- Victim Industry: Automotive
- Victim Organization: general motors
- Victim Site: gm.com
44. Allegedly leaked Russian Defense documents
- Category: Data Breach
- Content: A threat actor claims to have leaked databases containing Russian military documents alongside records for citizens and companies.
- Date: 2025-09-30T05:43:30Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Russian-militar-documents-citizens-and-companies-db-leak-avilable-in-private-channel)
- Screenshots:
- Threat Actors: Datauniverse22
- Victim Country: Russia
- Victim Industry: Military Industry
- Victim Organization: Unknown
- Victim Site: Unknown
45. Alleged data breach of Zeelab Pharmacy
- Category: Data Breach
- Content: The threat actor claims to have leaked a database from Zeelab Pharmacy, marking the second reported breach of the company. The leak allegedly includes 4.4 million records across 123 SQL files, exposing sensitive information such as user data, employee details, order histories, and order PINs
- Date: 2025-09-30T05:22:53Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-zeelabpharmacy.com-4.4M-rows-leaked-download)
- Screenshots:
- Threat Actors: 303
- Victim Country: India
- Victim Industry: Healthcare & Pharmaceuticals
- Victim Organization: zeelab pharmacy
- Victim Site: zeelabpharmacy.com
46. Alleged leak of Audi database
- Category: Data Breach
- Content: The threat actor claims to have leaked 2.7 GB of data from Audi, containing about 2.1 million rows
- Date: 2025-09-30T05:16:14Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Audi-fresh-exctracted-db-leak-2025-8-25-2-1-million-rows-2-7GB–49829)
- Screenshots:
- Threat Actors: Yees8733
- Victim Country: Germany
- Victim Industry: Automotive
- Victim Organization: audi ag
- Victim Site: audi.com
47. Alleged data leak of Samsung database
- Category: Data Breach
- Content: The threat actor Yees8733 claims to have leaked a freshly extracted Samsung database, containing 203.9 million rows and totaling 102.5GB.
- Date: 2025-09-30T04:45:48Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Samung-fresh-DB-leak-avilable-2025-9-27-203-9-mill-rows-102-5GB–49834)
- Screenshots:
- Threat Actors: Yees8733
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
48. Alleged leak of UK database
- Category: Data Breach
- Content: The threat actor claims to have freshly extracted and made available a UK database containing 43 million rows of data, totaling 10.7 GB.
- Date: 2025-09-30T04:43:30Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-UK-db-fresh-extracted-avilable-2025-8-23-43-million-rows-10-7GB–49839)
- Screenshots:
- Threat Actors: ywss082
- Victim Country: UK
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
49. Alleged data breach of RV Institute of Management (RVIM)
- Category: Data Breach
- Content: The threat actor Purple0piOd claims to have leaked databases from the RV Institute of Management in Bangalore, India. The leaked data includes finance-related student application fee approvals, admission test candidate details, and application form analytics, totaling over 570 records with personally identifiable information such as names, emails, phone numbers, and registration data.
- Date: 2025-09-30T04:25:26Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Rv-Institute-of-Management-567x)
- Screenshots:
- Threat Actors: Purple0piOd
- Victim Country: India
- Victim Industry: Higher Education/Acadamia
- Victim Organization: rv institute of management (rvim)
- Victim Site: rvim.edu.in
50. Alleged data leak of Australian private channel database
- Category: Data Breach
- Content: ChatGPT said:
The threat actor claims to have leaked an Australian private channel database containing 10.2 million rows of data, totaling 4.5 GB.
- Date: 2025-09-30T04:18:54Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Australian-DB-leak-avilable-on-private-channel-2025-9-25-10-2-milliln-rows-4-5-GB)
- Screenshots:
- Threat Actors: yes983
- Victim Country: Australia
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
51. Alleged data leak of Global iPhone database
- Category: Data Breach
- Content: The threat actor Yees8733 claims to have leaked a global iPhone database, containing 302 million rows and totaling 203.6GB.
- Date: 2025-09-30T04:17:49Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-IPhone-global-DB-leak-avilable-Fresh-extracted-2025-9-20-302mill-rows-203-6GB–49835)
- Screenshots:
- Threat Actors: Yees8733
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
52. Mobydick Asset Management Co., Ltd. falls victim Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 39 GB of organization’s data including investor personal information, financial documentation, and internal development records. Sample screenshots are provided on their dark web portal.
- Date: 2025-09-30T03:11:27Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=f1b0afb6-4935-3559-a03b-ac0492675063)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/0599dcc4-a870-4902-bc27-47d330553980.png
- https://d34iuop8pidsy8.cloudfront.net/ba2a47a6-d5e6-43ab-91e6-4eacd652b9df.png
- https://d34iuop8pidsy8.cloudfront.net/75d03643-7725-4492-866a-0a9b219e4d41.png
- https://d34iuop8pidsy8.cloudfront.net/f9ee8650-a49b-46f2-aa5e-401b8ba6ec2f.png
- Threat Actors: Qilin
- Victim Country: South Korea
- Victim Industry: Financial Services
- Victim Organization: mobydick asset management co., ltd.
- Victim Site: mobydickam.com
53. Alleged data leak of Israeli Phone Numbers
- Category: Data Breach
- Content: The threat actor claims to have leaked a database containing 15,000 active Israeli phone numbers, along with organization names, countries, industries, and associated websites, in protest against alleged corruption and human-rights violations.
- Date: 2025-09-30T03:04:20Z
- Network: telegram
- Published URL: (https://t.me/VFCTeam/189)
- Screenshots:
- Threat Actors: V FOR VENDETTA CYBER TEAM
- Victim Country: Israel
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
54. Alleged sale of unauthorized access to an unidentified telecommunication company
- Category: Initial Access
- Content: Threat actor claims to be selling unauthorized FortiOS VPN access and full network/database access to an unidentified telecommunications company.
- Date: 2025-09-30T02:49:39Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267264/)
- Screenshots:
- Threat Actors: Anon-WMG
- Victim Country: Unknown
- Victim Industry: Network & Telecommunications
- Victim Organization: Unknown
- Victim Site: Unknown
55. Alleged data breach of Plan Ceibal
- Category: Data Breach
- Content: The threat actor claims to have leaked a database of Plan Ceibal, a Uruguayan government program responsible for distributing traceable devices to citizens. The leak includes sensitive data such as full names, ID numbers, device history, and unique serial numbers, with a 33,000-citizen sample released for free and a total of 1 million records allegedly compromised.
- Date: 2025-09-30T01:49:52Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-uruguay-Plan-Ceibal-Database-Device-history-33k-Sample-Free)
- Screenshots:
- Threat Actors: LaPampaLeaks
- Victim Country: Uruguay
- Victim Industry: Education
- Victim Organization: plan ceibal
- Victim Site: ceibal.edu.uy
Conclusion
The incidents detailed in this report highlight a diverse and active landscape of cyber threats. Ransomware attacks, predominantly by the Akira group, are highly active, targeting numerous organizations across various industries like Building and Construction, Airlines & Aviation, and Manufacturing in the USA, Denmark, Canada, Germany, and Switzerland, claiming to have exfiltrated large volumes of corporate and personal data, including financial records, employee PII, and client information. Other ransomware groups like Payouts King, PEAR, STORMOUS, J group, and Qilin have also claimed victims, including Medical Computer Business Services and Mobydick Asset Management.
Data Breaches and leaks are also highly prominent, affecting a wide range of sectors and geographies. Notable leaks include:
- Large citizen/company databases allegedly from India (230M rows) and Cambodia (203M rows) and a UK database (43M rows).
- Major automotive manufacturers like General Motors, Volkswagen AG, and Audi AG (all by threat actor Yees8733).
- Tech giants like Google and Samsung.
- Financial services companies, including Avalara, Inc., SuperEd Pty Ltd, and Southeast Asian fintech Akulaku (32.6M login records).
- Sensitive PII leaks of Delhi Police personnel and an Israeli Phone Numbers database.
- Government program data from Plan Ceibal in Uruguay and health biodata from Dinas Kesehatan Provinsi Sulawesi Tengah in Indonesia.
Furthermore, Initial Access sales continue to be advertised, targeting organizations in Financial Services (PayTrace), Government Administration (Department of Lands and Surveys), and other industrial sectors, including alleged breaches of an air conditioning control system in the UK and a water treatment plant in Spain. Lastly, the report also notes the availability and sale of Malware tools, such as crypto wallet exploits and specialized hacking tools, and minor Defacement activity targeting Indian and Austrian websites.
These incidents collectively demonstrate that organizations across various industries and geographies face persistent threats from data exfiltration, unauthorized network access, and the proliferation of malicious tools.