This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. Aussie Fluid Power falls victim to ANUBIS Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data including sensitive accounting records, internal quality improvement reports, and contract documents involving major clients.
- Date: 2025-10-16T23:42:13Z
- Network: tor
- Published URL: (http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion/r/+pramV9PZLqGQtQPymaK6dYfpO+n6DjkqLgmqL8LV385aLhqLgG4JPE+8SLLI0JVhKnkLMviwEa9nLoFP1VJHhudU9uUWVo)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/1067f0d9-1501-450c-b7a2-7795a40c4417.png
- https://d34iuop8pidsy8.cloudfront.net/82426dde-9085-491a-b8a7-c742fd1abe69.png
- https://d34iuop8pidsy8.cloudfront.net/5bce479f-d780-4564-b2c0-8d62483ee2c6.png
- https://d34iuop8pidsy8.cloudfront.net/2a5b1efe-1f77-4995-9751-a902dafd0e2b.png
- https://d34iuop8pidsy8.cloudfront.net/95d16ad3-0c89-440a-94b1-2d4add50401e.png
- https://d34iuop8pidsy8.cloudfront.net/6e710dfc-1ebb-4306-8430-9f459063eea1.png
- https://d34iuop8pidsy8.cloudfront.net/5d672693-b3f7-40c4-be9b-57bcdb05985b.png
- https://d34iuop8pidsy8.cloudfront.net/055110a1-daa0-41b0-a909-2d7612f27aca.png
- https://d34iuop8pidsy8.cloudfront.net/9be05b37-82ff-49fb-9ca1-36f9ebe3a0ee.png
- https://d34iuop8pidsy8.cloudfront.net/938e99cf-ca06-453b-af5d-314e820418a2.png
- Threat Actors: ANUBIS
- Victim Country: Australia
- Victim Industry: Machinery Manufacturing
- Victim Organization: aussie fluid power
- Victim Site: aussiefluidpower.com.au
2. Alleged gain of access to DEIF Energy Management and Control System in France
- Category: Initial Access
- Content: Group has claimes to have access to an energy management and control system in France developed by Danish company DEIF. The system manages generators, load distribution, and power stability in critical facilities. The group claims the platform’s interface allowed viewing of alarms, logs, settings, and service functions. They also allege access to supervision data, potentially exposing sensitive operational information.
- Date: 2025-10-16T23:18:57Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/1974)
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: France
- Victim Industry: Energy & Utilities
- Victim Organization: deif energy management and control system
- Victim Site: deif.fr
3. Alleged data breach of Cloudflare
- Category: Data Breach
- Content: A recent post by the group claims to have leaked a list of internal Cloudflare IP addresses used for data-center anycast, internal services (caching, logging, management) and links to hosting/origin partners.
- Date: 2025-10-16T22:53:42Z
- Network: telegram
- Published URL: (https://t.me/c/3076919011/104)
- Screenshots:
- Threat Actors: CLOBELSECTEAM
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: cloudflare
- Victim Site: cloudflare.com
4. Alleged sale of 80k France database
- Category: Data Breach
- Content: Threat actor claims to have leaked France database. The dataset reportedly contains 80,000 records. The leaked information includes personal details such as IDs, full names, birthdates, emails, phone numbers, addresses and 1,500 CVVs/credit-card details.
- Date: 2025-10-16T22:04:41Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-%F0%9F%87%B2%F0%9F%87%AB%F0%9F%92%AFSelling-france-80k-IDs-phone-numbers-addresses-email-plus-1500-CVVs-%F0%9F%92%AF%F0%9F%87%B2%F0%9F%87%AB)
- Screenshots:
- Threat Actors: HvcKMvsoneria33
- Victim Country: France
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
5. DEVMAN 2.0 ransomware group adds an unknown victim (o***mnt.com)
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data and intends to publish it within 7-8 days.
- Date: 2025-10-16T21:54:44Z
- Network: tor
- Published URL: (http://devmanblggk7ddrtqj3tsocnayow3bwnozab2s4yhv4shpv6ueitjzid.onion/)
- Screenshots:
- Threat Actors: DEVMAN 2.0
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
6. Alleged data breach of Kearney Public Schools
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Kearney Public Schools. The compromised data reportedly includes information about students, teachers, staff, and even parents, such as personal details and financial documents.
- Date: 2025-10-16T21:48:04Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Kearney-Public-Schools-Complete-Data-Students-Teachers-Staff-Backup)
- Screenshots:
- Threat Actors: MarlboroRed
- Victim Country: USA
- Victim Industry: Education
- Victim Organization: kearney public schools
- Victim Site: kearneypublicschools.org
7. Alleged gain of access to MPAC Automation & Controls
- Category: Initial Access
- Content: The group claims to have gained access to HMI interface from MPAC Automation & Controls, UK.
- Date: 2025-10-16T21:22:32Z
- Network: telegram
- Published URL: (https://t.me/Z_ALLIANCE/834)
- Screenshots:
- Threat Actors: Z-PENTEST ALLIANCE
- Victim Country: UK
- Victim Industry: Industrial Automation
- Victim Organization: mpac automation & controls
- Victim Site: mpac-group.com
8. M3 Group falls victim to Nova Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 90 GB of the organization’s data and intends to publish them within 9-10 days.
- Date: 2025-10-16T21:21:34Z
- Network: tor
- Published URL: (http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/#)
- Screenshots:
- Threat Actors: Nova
- Victim Country: Poland
- Victim Industry: Information Technology (IT) Services
- Victim Organization: m3 group
- Victim Site: m3group.pl
9. ShareP – Sustainable Parking Management falls victim to Nova Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 77 GB of the organization’s data and intends to publish them within 10-11 days.
- Date: 2025-10-16T21:12:05Z
- Network: tor
- Published URL: (http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/#)
- Screenshots:
- Threat Actors: Nova
- Victim Country: Switzerland
- Victim Industry: Real Estate
- Victim Organization: sharep – sustainable parking management
- Victim Site: sharep.io
10. Alleged data breach of IIT Kharagpur
- Category: Data Breach
- Content: Threat actor claims to have breached the students data of IIT Kharagpur. The compromised data reportedly contains 50000 records.
- Date: 2025-10-16T21:11:14Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/iit-student-data-leak-50000-rows.44581/#post-247891)
- Screenshots:
- Threat Actors: Nousername_147
- Victim Country: India
- Victim Industry: Education
- Victim Organization: indian institute of technology, kharagpur
- Victim Site: iitkgp.ac.in
11. Alleged Sale of access to Japan mail
- Category: Initial Access
- Content: A threat actor claims to be selling access to Japan mail. The compromised data reportedly contains 2400 records.
- Date: 2025-10-16T20:57:59Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/2-4k-japan-mail-access.44582/)
- Screenshots:
- Threat Actors: Nira
- Victim Country: Japan
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
12. Alleged sale of data from a Japanese forex
- Category: Data Breach
- Content: A threat actor claims to be selling data from a Japanese forex. The compromised data reportedly contains 45,000 records that includes email, password, balance, etc.
- Date: 2025-10-16T20:45:42Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/jp-forex-damp-45k.42336/)
- Screenshots:
- Threat Actors: Ma[x]
- Victim Country: Japan
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
13. American Airlines falls victim to CL0P Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-16T20:36:37Z
- Network: tor
- Published URL: (http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/aa-com)
- Screenshots:
- Threat Actors: CL0P
- Victim Country: USA
- Victim Industry: Airlines & Aviation
- Victim Organization: american airlines
- Victim Site: aa.com
14. University of the Witwatersrand falls victim to CL0P Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-16T20:10:32Z
- Network: tor
- Published URL: (http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/wits-ac-za)
- Screenshots:
- Threat Actors: CL0P
- Victim Country: South Africa
- Victim Industry: Higher Education/Acadamia
- Victim Organization: university of the witwatersrand
- Victim Site: wits.ac.za
15. Alleged Data leak of Discord Support
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Discord Support.
- Date: 2025-10-16T19:46:27Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/new-discord-data.44579/)
- Screenshots:
- Threat Actors: waj98
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
16. BMP Europe Ltd falls victim to PLAY Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data. The compromised data includes Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information, and more. They plan to publish it within 3 to 4 days.
- Date: 2025-10-16T18:35:59Z
- Network: tor
- Published URL: (http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion/topic.php?id=UPPF26N9Fjq8)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: UK
- Victim Industry: Biotechnology
- Victim Organization: bmp europe ltd
- Victim Site: bmpworldwide.com
17. Alleged data breach of Rubens Artistic
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Rubens Artistic. Which includes customer names, email addresses, phone numbers, national ID numbers, addresses, etc.
- Date: 2025-10-16T18:26:20Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Artisticarubens-com-ar-Full-Database-Argentina-AR)
- Screenshots:
- Threat Actors: Satanic
- Victim Country: Argentina
- Victim Industry: Arts & Crafts
- Victim Organization: rubens artistic
- Victim Site: artisticarubens.com.ar
18. Alleged data breach of Candystore
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Candystore. Which includes full names, email addresses, phone numbers, postal codes, physical addresses, etc.
- Date: 2025-10-16T18:18:05Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Candystore-dk-Full-Database-Denmark)
- Screenshots:
- Threat Actors: Satanic
- Victim Country: Denmark
- Victim Industry: Food & Beverages
- Victim Organization: candystore
- Victim Site: candystore.dk
19. Alleged leak of Biology Faculty data from Peru
- Category: Data Breach
- Content: The threat actor claims to have leaked Biology Faculty data from Peru. The compromised data includes id, name, email, etc.
- Date: 2025-10-16T18:14:45Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Faculty-of-Biology-of-Peru-Data-breach-Leaked-Download?highlight=faculty+of+biology+of+peru+data+breach)
- Screenshots:
- Threat Actors: N1KA
- Victim Country: Peru
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
20. Alleged data breach of Kristall Jewelry
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Kristall Jewelry. Which includes customer names, email addresses, phone numbers, addresses, etc.
- Date: 2025-10-16T18:12:10Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Kristalljoyeria-com-Full-Database-Jewelry-Store-Peru)
- Screenshots:
- Threat Actors: Satanic
- Victim Country: Peru
- Victim Industry: Luxury Goods & Jewelry
- Victim Organization: kristall jewelry
- Victim Site: kristalljoyeria.com
21. José Guma S.A. falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 75.44 GB of the organization’s data and intends to publish them within 1-2 days.
- Date: 2025-10-16T17:47:07Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- Threat Actors: DragonForce
- Victim Country: Argentina
- Victim Industry: Manufacturing
- Victim Organization: josé guma s.a.
- Victim Site: joseguma.com
22. Alleged data breach of Canale 7
- Category: Data Breach
- Content: The group claims to have leaked data of Canale 7, contains highly sensitive information.
- Date: 2025-10-16T16:34:51Z
- Network: telegram
- Published URL: (https://t.me/lunarisS3C/59)
- Screenshots:
- Threat Actors: LunarisSec
- Victim Country: Italy
- Victim Industry: Broadcast Media
- Victim Organization: canale 7
- Victim Site: canale7.tv
23. Alleged gain of login access to Laemchabang International RO-RO Terminal Limited
- Category: Initial Access
- Content: The group claims to have gained login access to Laemchabang International RO-RO Terminal Limited.
- Date: 2025-10-16T15:42:53Z
- Network: telegram
- Published URL: (https://t.me/NigthCrawlerX/1019)
- Screenshots:
- Threat Actors: NightCrawlerX
- Victim Country: Thailand
- Victim Industry: Transportation & Logistics
- Victim Organization: laemchabang international ro-ro terminal limited
- Victim Site: lrt-th.com
24. Alleged leak of School uniform USA database
- Category: Data Breach
- Content: Threat actor claims to have leaked the USA school uniform database. The dataset reportedly contains 7 million records of American students, including high school and college data. The leaked information includes personal details such as names, addresses, emails, phone numbers, birthdates, and gender.
- Date: 2025-10-16T15:10:26Z
- Network: openweb
- Published URL: (https://xss.pro/threads/143787/)
- Screenshots:
- Threat Actors: Observe
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
25. NTB CYBER TEAM targets the website of Tam An Trading, Service & Management Consulting Co., Ltd
- Category: Defacement
- Content: The group claims to have deface the website of Tam An Trading, Service & Management Consulting Co., Ltd.
- Date: 2025-10-16T14:35:28Z
- Network: telegram
- Published URL: (https://t.me/Garuda_Tersakiti/66)
- Screenshots:
- Threat Actors: NTB CYBER TEAM
- Victim Country: Vietnam
- Victim Industry: Financial Services
- Victim Organization: tam an trading, service & management consulting co., ltd
- Victim Site: dichvutaichinh.com.vn
26. Alleged unauthorized access to an unidentified Scada controlled smart home in Poland
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to an unidentified Scada controlled smart home in Poland. The compromised system allegedly allows control over the home assistant interface, telemetry reading, relay and switch control ,energy consumption monitoring, heat pump and boiler, heating and DHW modes, water control etc.
- Date: 2025-10-16T14:28:01Z
- Network: telegram
- Published URL: (https://t.me/Z_ALLIANCE/832)
- Screenshots:
- Threat Actors: Z-PENTEST ALLIANCE
- Victim Country: Poland
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
27. Alleged data breach of headzshop.co
- Category: Data Breach
- Content: The threat actor claims to have leaked 13,200 unique user records from headzshop.co, allegedly containing ID, status, order date, billing first name, billing last name, billing company, and more.
- Date: 2025-10-16T13:55:52Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Headz-cc-Database-Leaked-Download)
- Screenshots:
- Threat Actors: 888
- Victim Country: Canada
- Victim Industry: Health & Fitness
- Victim Organization: headzshop.co
- Victim Site: headz.cc
28. Alleged leak of access to Khaokhaow Subdistrict Administration Organization
- Category: Initial Access
- Content: The group claims to have leaked access to Khaokhaow Subdistrict Administration Organization.
- Date: 2025-10-16T13:41:20Z
- Network: telegram
- Published URL: (https://t.me/notctber/1316)
- Screenshots:
- Threat Actors: NOTCTBER404
- Victim Country: Thailand
- Victim Industry: Government Administration
- Victim Organization: khaokhaow subdistrict administration organization
- Victim Site: khaokhaow.go.th
29. Montship Inc falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 227 GB of organization’s data.
- Date: 2025-10-16T13:37:33Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=8f2c32d1-b452-3f80-8552-52c9d7bc4af7)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Canada
- Victim Industry: Maritime
- Victim Organization: montship inc
- Victim Site: montship.ca
30. Alleged data breach of co2-extract.ru
- Category: Data Breach
- Content: The threat actor claims to have leaked 34,423 user records from co2-extract.ru, allegedly including customer ID, date of birth, fax numbers, notes, third name, gender, last name, passwords, and more.
- Date: 2025-10-16T13:33:29Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-co2-extract-ru)
- Screenshots:
- Threat Actors: Alberta
- Victim Country: Russia
- Victim Industry: E-commerce & Online Stores
- Victim Organization: co2-extract.ru
- Victim Site: co2-extract.ru
31. Dalton Pharma Services falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 230 GB of organization’s data.
- Date: 2025-10-16T13:24:51Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=9817926c-aaaf-317f-852f-f7140d3eb825)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Canada
- Victim Industry: Healthcare & Pharmaceuticals
- Victim Organization: dalton pharma services
- Victim Site: dalton.com
32. Regency Specialist Hospital falls victim to Nova Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 550 GB of organization’s data.
- Date: 2025-10-16T13:11:18Z
- Network: tor
- Published URL: (http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/#)
- Screenshots:
- Threat Actors: Nova
- Victim Country: Malaysia
- Victim Industry: Hospital & Health Care
- Victim Organization: regency specialist hospital
- Victim Site: regencyspecialist.com
33. Alleged data breach of CoilPlus, Inc.
- Category: Data Breach
- Content: The group claims to have breached the organization’s data.
- Date: 2025-10-16T12:51:21Z
- Network: tor
- Published URL: (https://3jguvp6xhyypdjgxhxweu4zklse66v3awjj2zljpftcjyeoimepnwtyd.onion/)
- Screenshots:
- Threat Actors: Worldleaks
- Victim Country: USA
- Victim Industry: Mining/Metals
- Victim Organization: coilplus
- Victim Site: coilplus.com
34. Panda Rose Consulting Studios falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-16T12:46:48Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=74cc4280-4229-349c-a565-e169dc4b024c)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Canada
- Victim Industry: Software Development
- Victim Organization: panda rose consulting studios, inc.
- Victim Site: pandarose.ca
35. BMC Strategic Innovation falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-16T12:09:59Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=6c26b467-4df3-3c50-b0b2-74c23794fbb8)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Argentina
- Victim Industry: Business and Economic Development
- Victim Organization: bmc strategic innovation
- Victim Site: bmcinnovation.com
36. G.S. Long Company falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-16T11:51:00Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=d8e75910-22f5-3492-8de4-517d5fbf04d5)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Farming
- Victim Organization: g.s. long company
- Victim Site: gslong.com
37. Arpi’s Industries Ltd falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-16T11:27:44Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=d2ecdd53-1802-3034-bd32-96a02ac5a796)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Canada
- Victim Industry: Building and construction
- Victim Organization: arpi’s industries ltd
- Victim Site: arpis.com
38. Specialized Packaging Group falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-16T11:27:19Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=abbbd7fd-9929-3605-a73b-5b91615f9c6a)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Packaging & Containers
- Victim Organization: specialized packaging group
- Victim Site: spgpackaging.com
39. Devman promoting cybersecurity initiative
- Category: Alert
- Content: Devman claims that they are developing a program to protect companies in Ukraine, Russia, Georgia, and the CIS region from cyber incidents, and is prepared to purchase access to systems in this region, as well as those owned by individuals from the CIS, in order to safeguard these businesses.
- Date: 2025-10-16T11:14:35Z
- Network: tor
- Published URL: (http://devmanblggk7ddrtqj3tsocnayow3bwnozab2s4yhv4shpv6ueitjzid.onion/)
- Screenshots:
- Threat Actors: DEVMAN 2.0
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
40. Arizona Fireplaces falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-16T11:06:13Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=90bf67da-f111-34e7-ad84-d0fe06e4fd1c)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Retail Industry
- Victim Organization: arizona fireplaces
- Victim Site: arizonafireplaces.com
41. Coppage Construction Co., Inc falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-10-16T10:46:42Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=5b56dd29-e69b-3836-b3b8-3c06707d29a2)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: coppage construction co., inc
- Victim Site: coppage.net
42. Alleged unauthorized access to an unidentified control system of a wastewater plant in Poland
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to an unidentified control system of a wastewater treatment plant in Poland. The compromised system allegedly allows control over security and environmental threat to the region, start/stop pumps and compressors, manipulating reactor phases, turning off ventilation and compressors.
- Date: 2025-10-16T10:41:36Z
- Network: telegram
- Published URL: (https://t.me/c/2634086323/2009)
- Screenshots:
- Threat Actors: NoName057(16)
- Victim Country: Poland
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
43. Alleged leak of access to Party Cruisers Limited
- Category: Initial Access
- Content: The group claims to have leaked access to Party Cruisers Limited
- Date: 2025-10-16T10:23:56Z
- Network: telegram
- Published URL: (https://t.me/fornetcloud/3323)
- Screenshots:
- Threat Actors: FORNET ORG
- Victim Country: India
- Victim Industry: Events Services
- Victim Organization: party cruisers limited
- Victim Site: partycruisersindia.com
44. Alleged leak of access to OXFORD CENTRE ENGLISH INSTITUTE
- Category: Initial Access
- Content: The group claims to have leaked access to OXFORD CENTRE ENGLISH INSTITUTE
- Date: 2025-10-16T10:20:03Z
- Network: telegram
- Published URL: (https://t.me/fornetcloud/3323)
- Screenshots:
- Threat Actors: FORNET ORG
- Victim Country: Colombia
- Victim Industry: Education
- Victim Organization: oxford centre english institute
- Victim Site: oct.com.co
45. Alleged leak of access to FORNET ORG
- Category: Initial Access
- Content: The group claims to have leaked access to FORNET ORG
- Date: 2025-10-16T10:18:07Z
- Network: telegram
- Published URL: (https://t.me/fornetcloud/3323)
- Screenshots:
- Threat Actors: FORNET ORG
- Victim Country: Colombia
- Victim Industry: Education
- Victim Organization: fornet org
- Victim Site: oct.com.co
46. Sibbalds Chartered Accountants falls victim to RHYSIDA Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s internal data and intents to publish it within 6 to 7 days.
- Date: 2025-10-16T09:59:04Z
- Network: tor
- Published URL: (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
- Screenshots:
- Threat Actors: RHYSIDA
- Victim Country: UK
- Victim Industry: Accounting
- Victim Organization: sibbalds chartered accountants
- Victim Site: sibbald.co.uk
47. Ronemus & Vilensky LLP falls victim to Kraken Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 219 GB of organization’s data.
- Date: 2025-10-16T09:19:25Z
- Network: tor
- Published URL: (http://krakenccj3wr23452a4ibkbkuph4d6soyx2xgjoogtuamc3m7u7wemad.onion/news/91172e5b793ee3708e80da29bb3d9cdf)
- Screenshots:
- Threat Actors: Kraken
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: ronemus & vilensky llp
- Victim Site: ronvil.com
48. NXBB.SEC targets the website of Office of the Basic Education Commission
- Category: Defacement
- Content: The group claims to have defaced the website of the Office of the Basic Education Commission.
- Date: 2025-10-16T08:09:00Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2844)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Thailand
- Victim Industry: Government Administration
- Victim Organization: office of the basic education commission
- Victim Site: ars.psdg-obec.go.th
49. Alleged sale of U.S. PII data
- Category: Data Breach
- Content: The threat actor claims to be selling fresh U.S. databases containing sensitive PII, including child Fullz, driver’s license numbers and photos, credit scores, and address/relative details.
- Date: 2025-10-16T07:10:35Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-BULK-USA-Full-Info-CS-DL-number-Exp)
- Screenshots:
- Threat Actors: BitIcon
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
50. Alleged data leak of Cambodia Government System
- Category: Data Breach
- Content: The group claims to have leaked data of Cambodia Government System.
- Date: 2025-10-16T06:25:07Z
- Network: telegram
- Published URL: (https://t.me/NigthCrawlerX/1018)
- Screenshots:
- Threat Actors: NightCrawlerX
- Victim Country: Cambodia
- Victim Industry: Government Administration
- Victim Organization: cambodia government system
- Victim Site: Unknown
51. Alleged data breach of U.S. Department of Justice (DoJ)
- Category: Data Breach
- Content: The threat actor claims to be leaked database of U.S. Department of Justice (DoJ) data dump containing 198 lines of personally identifiable information (PII). A sample includes names, government email addresses, phone numbers, and home addresses of individuals, likely DoJ employees or applicants.
- Date: 2025-10-16T05:24:19Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DoJ-Apps-USA)
- Screenshots:
- Threat Actors: punk
- Victim Country: USA
- Victim Industry: Government Administration
- Victim Organization: u.s. department of justice (doj)
- Victim Site: justice.gov
52. Alleged leak of login access to Badan Kepegawaian Negara
- Category: Initial Access
- Content: The group claims to have leaked login access to the Badan Kepegawaian Negara.
- Date: 2025-10-16T05:12:11Z
- Network: telegram
- Published URL: (https://t.me/c/2702757113/606)
- Screenshots:
- Threat Actors: Night Owll
- Victim Country: Indonesia
- Victim Industry: Government & Public Sector
- Victim Organization: badan kepegawaian negara
- Victim Site: bkn.go.id
53. Alleged sale of Driver with access to physical memory
- Category: Malware
- Content: The threat actor offering to sell a kernel‑level Windows driver that provides unlimited read/write access to physical memory. The ad claims the driver runs on the latest Windows 11 without detection, includes C++ control code for reading/writing physical addresses.
- Date: 2025-10-16T04:54:49Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268308/)
- Screenshots:
- Threat Actors: Detools
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
54. Gulf Warranties falls victim to BlackShrantac
- Category: Ransomware
- Content: The threat actor claims to have obtained 300 GB of organization’s data. The leaked dataset allegedly contains Financial data, HR information and Full legal and executive documents.
- Date: 2025-10-16T03:04:41Z
- Network: tor
- Published URL: (http://jvkpexgkuaw5toiph7fbgucycvnafaqmfvakymfh5pdxepvahw3xryqd.onion/targets/5)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/f4f2d24f-6825-4376-9a31-61e9fa154a00.png
- https://d34iuop8pidsy8.cloudfront.net/d1738287-0773-4106-9088-221b30cf64c7.png
- https://d34iuop8pidsy8.cloudfront.net/1027664a-ae92-4aa0-8277-1966c831db60.png
- https://d34iuop8pidsy8.cloudfront.net/1a13521b-ad49-446a-8a3f-79cd19182454.png
- https://d34iuop8pidsy8.cloudfront.net/6ec0de14-6138-409b-8847-adcec9f1c0cc.png
- Threat Actors: BlackShrantac
- Victim Country: UAE
- Victim Industry: Insurance
- Victim Organization: gulf warranties
- Victim Site: gulfwarranties.com
55. Alleged data breach of Bogofi.ru
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Bogofi.ru. The compromised data includes id, name, password, email, background, etc.
- Date: 2025-10-16T02:56:35Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-bogofi-ru-Russian-DB)
- Screenshots:
- Threat Actors: Robert2025
- Victim Country: Russia
- Victim Industry: Retail Industry
- Victim Organization: bogofi.ru
- Victim Site: bogofi.ru
56. NTB CYBER TEAM targets the website of TAMAN Management Consulting Service trading Company Limited
- Category: Defacement
- Content: The group claims to have deface the website of TAM An Management Consulting Service trading Company Limited
- Date: 2025-10-16T02:55:31Z
- Network: telegram
- Published URL: (https://t.me/Garuda_Tersakiti/65)
- Screenshots:
- Threat Actors: NTB CYBER TEAM
- Victim Country: Vietnam
- Victim Industry: Food Production
- Victim Organization: tam an management consulting service traiding company limited
- Victim Site: tamanco.com.vn
57. Radiant Group ransomware has added an unidentified victim
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data and plans to publish it within the next 7-8 days.
- Date: 2025-10-16T01:53:12Z
- Network: tor
- Published URL: (http://trfqksm6peaeyz4q6egxbij5n2ih6zrg65of4kwasrejc7hnw2jtxryd.onion/)
- Screenshots:
- Threat Actors: Radiant Group
- Victim Country: Netherlands
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
58. Beta Dyne Inc. falls victim to Qilin Ramsomware
- Category: Ransomware
- Content: The group claims to have obtained 68 GB of the organization data. Sample screenshots are available on their dark web portal.
- Date: 2025-10-16T01:41:21Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=cc739fc7-4cc8-35f0-a86a-9e9535b6507d)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Electrical & Electronic Manufacturing
- Victim Organization: beta dyne inc.
- Victim Site: betadynepower.com
59. DocuRail falls victim to Radiant Group Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s internal data.
- Date: 2025-10-16T01:40:32Z
- Network: tor
- Published URL: (http://trfqksm6peaeyz4q6egxbij5n2ih6zrg65of4kwasrejc7hnw2jtxryd.onion/)
- Screenshots:
- Threat Actors: Radiant Group
- Victim Country: UK
- Victim Industry: Software Development
- Victim Organization: docurail
- Victim Site: docurail.com
60. Alleged data sale of Federal Bank
- Category: Data Breach
- Content: Threat actor claims to be selling 600,000 data from Federal Bank. The compromised data includes Name, DOB, Pan No, Sex, Driving License No, Passport No, Aadhar Card No, Voter ID, Category, State, Mobile, Phone, Email, Address, City, Zip Code, etc.
- Date: 2025-10-16T01:11:02Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-600-000-FEDERAL-BANK-OF-INDIA-DATABASE)
- Screenshots:
- Threat Actors: INDOHAXSEC
- Victim Country: India
- Victim Industry: Banking & Mortgage
- Victim Organization: federal bank
- Victim Site: federalbank.co.in
61. Alleged sale of Web Infection Panel
- Category: Malware
- Content: The threat actor is selling a modular, scalable Web Infection Panel with three user tiers (admin/staff/drop); automated bulk workflows (scan → exploit → backdoor) for thousands of targets; centralized real‑time monitoring, analytics and encrypted communications; WordPress‑focused smart scanning (plugin/version detection, REST API checks) and customizable features for buyers no price or seller handle was included in the material you gave.
- Date: 2025-10-16T01:05:26Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268300/)
- Screenshots:
- Threat Actors: backdoor
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
62. Alleged data sale of University of Cádiz
- Category: Data Breach
- Content: Threat actor claims to have leaked data from University of Cádiz. The compromised data includes First surname, Second surname, First name, Date of birth, NIF number, Email, Mobile phone number, Qualification, Department, Center, etc.
- Date: 2025-10-16T01:04:25Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Spain-uca-es-University-of-C%C3%A1diz)
- Screenshots:
- Threat Actors: pls
- Victim Country: Spain
- Victim Industry: Higher Education/Acadamia
- Victim Organization: university of cádiz
- Victim Site: uca.es
63. Tex Tube falls victim to RHYSIDA Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s internal data and intents to publish it within 7 days
- Date: 2025-10-16T00:51:40Z
- Network: tor
- Published URL: (http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/)
- Screenshots:
- Threat Actors: RHYSIDA
- Victim Country: USA
- Victim Industry: Manufacturing
- Victim Organization: tex tube
- Victim Site: tex-tube.com
64. Sprague & Jackson falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 49 GB of organization’s internal data.
- Date: 2025-10-16T00:30:00Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=3b354138-a7c2-3d33-9df6-ea2220b0504f)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Accounting
- Victim Organization: sprague & jackson
- Victim Site: sprjac.com
65. Dark Storm Team claims to target YouTube Servers
- Category: Alert
- Content: A recent post by the group indicates that they are targeting YouTube Servers
- Date: 2025-10-16T00:14:30Z
- Network: telegram
- Published URL: (https://t.me/Darkstormteamnewteam/195)
- Screenshots:
- Threat Actors: Dark Storm Team
- Victim Country: USA
- Victim Industry: Social Media & Online Social Networking
- Victim Organization: youtube
- Victim Site: youtube.com
66. Middlesex Appraisal Associates falls victim to QiIin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 24 GB of organization’s internal data.
- Date: 2025-10-16T00:01:02Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=8123c0c3-7dbc-3478-af5a-f594adc63ad8)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Real Estate
- Victim Organization: middlesex appraisal associates
- Victim Site: middlesexappraisal.com
Conclusion
The incidents detailed in this report highlight a diverse and active landscape of cyber threats over a single day, predominantly featuring Ransomware, Data Breaches, and Initial Access sales.
Ransomware Dominance and Impact: The most prevalent threat category is Ransomware, with groups like Qilin, Nova, RHYSIDA, CL0P, ANUBIS, PLAY, Kraken, and BlackShrantac actively publishing new victims. Notable ransomware victims include organizations across diverse sectors and geographies, such as:
- Manufacturing (Aussie Fluid Power in Australia, José Guma S.A. in Argentina, Tex Tube in USA)
- Healthcare (Regency Specialist Hospital in Malaysia)
- Aviation (American Airlines in USA)
- Consulting/Tech (Panda Rose Consulting Studios, DocuRail)
- Financial (Gulf Warranties in UAE)
- Construction (Arpi’s Industries Ltd, Coppage Construction Co., Inc)
- Education (University of the Witwatersrand in South Africa)
The volume of data allegedly compromised ranges from 24 GB to 550 GB, underscoring the severe operational and financial risk posed by these attacks.
Widespread Data Breaches and Leaks: Data breaches remain a critical threat, impacting both private organizations and government bodies globally:
- Government/Public Sector: The U.S. Department of Justice (DoJ), Badan Kepegawaian Negara (Indonesia), Cambodia Government System, and educational institutions like IIT Kharagpur (India) and Kearney Public Schools (USA) were allegedly breached.
- Financial/PII: The report noted the sale of a large database from Federal Bank (India), as well as 80k France database containing credit card details, and sensitive U.S. PII data including child Fullz and driver’s licenses.
- Retail/E-commerce: Victims include Bogofi.ru (Russia), Candystore (Denmark), and Kristall Jewelry (Peru).
Focus on Initial Access and Critical Infrastructure: The sale of initial network access is a significant trend, often targeting critical systems and high-value companies:
- Threat actors claimed unauthorized access to industrial control systems (ICS/SCADA), specifically an energy management and control system in France and an unidentified wastewater treatment plant in Poland.
- Physical/Government targets include access to Laemchabang International RO-RO Terminal Limited (Thailand), and a Subdistrict Administration Organization (Thailand).
- Malware and Offensive Tools were also featured, including a kernel-level Windows driver and a Web Infection Panel, indicating the continuous evolution and availability of offensive capabilities in the cyber underground.
The incidents collectively demonstrate that organizations across various industries and geographies face persistent threats from data exfiltration, unauthorized network access, and the proliferation of malicious tools. The nature of these incidents emphasizes the critical importance of robust cybersecurity measures, including strong access controls, data protection strategies, continuous vulnerability management, and proactive threat intelligence to defend against a wide array of sophisticated and opportunistic attacks.