This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. Alleged sale of Apple Email Checker v2
- Category: Malware
- Content: Threat actor is offering Apple Email Checker v2 a fast, console-based bulk email-status scanner that processes large address lists with threaded performance, live reporting, and exportable results; classified as credential validation / checker utility, optimized for speed and throughput but potentially usable for large-scale email verification or account-testing operations.
- Date: 2025-10-24T23:10:38Z
- Network: openweb
- Published URL: (https://demonforums.net/Thread-Apple-Email-Checker-v2)
- Screenshots:
- Threat Actors: Starip
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
2. Alleged sale of ROBLOX Cracking Tools Pack
- Category: Malware
- Content: Threat actor is offering ROBLOX Tools Pack a compact, dual-use toolbox (giftcard generator, list normalizer, mock UI, account manager, FPS unlocker, and a lightweight scraper) for format testing and quick data handling that also contains grabber/scraping and account-management features which can be repurposed for credential harvesting or abuse.
- Date: 2025-10-24T23:06:42Z
- Network: openweb
- Published URL: (https://demonforums.net/Thread-ROBLOX-Cracking-Tools-Pack)
- Screenshots:
- Threat Actors: Starip
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
3. Hanson Inc. falls victim to CHAOS Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 350 GB of the organization’s data.
- Date: 2025-10-24T21:44:02Z
- Network: tor
- Published URL: (http://hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion/zI05fEpYNVWprdwn8dXyMq2ZrS08bR98/hanson-inc-com)
- Screenshots:
- Threat Actors: CHAOS
- Victim Country: USA
- Victim Industry: Marketing, Advertising & Sales
- Victim Organization: hanson inc.
- Victim Site: hansoninc.com
4. Construction Donald Provost falls victim to SAFEPAY Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data, and intends to publish it with in 2 to 3 days.
- Date: 2025-10-24T21:26:06Z
- Network: tor
- Published URL: (http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/constructiondprovostcom/)
- Screenshots:
- Threat Actors: SAFEPAY
- Victim Country: Canada
- Victim Industry: Building and construction
- Victim Organization: construction donald provost
- Victim Site: constructiondprovost.com
5. Xortec GmbH falls victim to SAFEPAY Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data, and intends to publish it with in 2 to 3 days.
- Date: 2025-10-24T21:13:48Z
- Network: tor
- Published URL: (http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/xortecde/)
- Screenshots:
- Threat Actors: SAFEPAY
- Victim Country: Germany
- Victim Industry: Wholesale
- Victim Organization: xortec gmbh
- Victim Site: xortec.de
6. Mino Industry Co.,Ltd. falls victim to SAFEPAY Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data, and intends to publish it with in 2 to 3 days.
- Date: 2025-10-24T20:55:28Z
- Network: tor
- Published URL: (http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/mino-incojp/)
- Screenshots:
- Threat Actors: SAFEPAY
- Victim Country: Japan
- Victim Industry: Software Development
- Victim Organization: mino industry co.,ltd.
- Victim Site: mino-in.co.jp
7. Alleged data sale of Rad TV
- Category: Data Breach
- Content: Threat actor claims to be selling leaked users data from Rad TV, USA. The compromised data reportedly contains 884,000 records including username, name, email, IP, birthdate and eth-address.
- Date: 2025-10-24T20:46:18Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-rad-live-884k)
- Screenshots:
- Threat Actors: pkm
- Victim Country: USA
- Victim Industry: Entertainment & Movie Production
- Victim Organization: rad tv
- Victim Site: rad.live
8. Bannenberg & Rowell Design falls victim to SAFEPAY Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data, and intends to publish it with in 2 to 3 days.
- Date: 2025-10-24T20:39:17Z
- Network: tor
- Published URL: (http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/bannenbergandrowellcom/)
- Screenshots:
- Threat Actors: SAFEPAY
- Victim Country: UK
- Victim Industry: Design
- Victim Organization: bannenberg & rowell design
- Victim Site: bannenbergandrowell.com
9. Alleged data breach of Kiwi Farms
- Category: Data Breach
- Content: Threat actor claims to have leaked data and source code of Kiwi Farms, a forum based in USA.
NB: The authenticity of the breach is not confirmed.
- Date: 2025-10-24T20:35:19Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Source-Code-KiwiFarms-Leak-alleged)
- Screenshots:
- Threat Actors: equine
- Victim Country: USA
- Victim Industry: Social Media & Online Social Networking
- Victim Organization: kiwi farms
- Victim Site: kiwifarms.net
10. Greenhouse Apartments falls victim to SAFEPAY Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-10-24T20:23:44Z
- Network: tor
- Published URL: (http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/greenhouseaptcom/)
- Screenshots:
- Threat Actors: SAFEPAY
- Victim Country: USA
- Victim Industry: Real Estate
- Victim Organization: greenhouse apartments
- Victim Site: greenhouseapt.com
11. Alleged data breach of Warm Key Kitchen
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Warm Key Kitchen, Russia. The compromised data reportedly contains 9,000 records including name, email, phone, password, balance, etc.
- Date: 2025-10-24T20:19:11Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-FREE-RUSSIAN-DATABASE-pizza-tk-ru-9K)
- Screenshots:
- Threat Actors: trashfunny
- Victim Country: Russia
- Victim Industry: Restaurants
- Victim Organization: warm key kitchen
- Victim Site: pizza-tk.ru
12. Alleged sale of login credentials related to US government domains
- Category: Data Breach
- Content: Threat actor claims to be selling login credentials related with US government domains, including the White House and usa.gov.
- Date: 2025-10-24T19:56:37Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-USA-guvernment-logins)
- Screenshots:
- Threat Actors: Exploit4000938832
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
13. Alleged sale of admin access to an unidentified online store in France
- Category: Initial Access
- Content: The threat actor claims to selling admin access to a Prestashop-based online store in France.
- Date: 2025-10-24T19:35:39Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268901/)
- Screenshots:
- Threat Actors: akr1t
- Victim Country: France
- Victim Industry: E-commerce & Online Stores
- Victim Organization: Unknown
- Victim Site: Unknown
14. Le Multi Laboratoire LC2A falls victim to TENGU Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-24T19:35:00Z
- Network: tor
- Published URL: (http://longcc4fqrfcqt5lzceutylaxir6h66fp6df3oin6mvwvz6pfdbxc6qd.onion/blog/404e2516d4022752f93dc9844fb4712339199312accc129b66a85bcb379cda09/)
- Screenshots:
- Threat Actors: TENGU
- Victim Country: Morocco
- Victim Industry: Consumer Services
- Victim Organization: le multi laboratoire lc2a
- Victim Site: lc2a.ma
15. Alleged sale of admin access to an unidentified online store in Spain
- Category: Initial Access
- Content: Threat actor claims to selling admin access to a Prestashop-based online store in Spain.
- Date: 2025-10-24T19:28:41Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268900/)
- Screenshots:
- Threat Actors: akr1t
- Victim Country: Spain
- Victim Industry: E-commerce & Online Stores
- Victim Organization: Unknown
- Victim Site: Unknown
16. Alleged sale of shell access to an unidentified shop in Europe
- Category: Initial Access
- Content: Threat actor claims to be selling shell access to an unidentified shop in Europe.
- Date: 2025-10-24T19:27:10Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268899/)
- Screenshots:
- Threat Actors: akr1t
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
17. Alleged sale of admin access to Prestashop Spain
- Category: Initial Access
- Content: The threat actor claims to selling admin access to Prestashop Spain.
- Date: 2025-10-24T19:26:18Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268900/)
- Screenshots:
- Threat Actors: akr1t
- Victim Country: Spain
- Victim Industry: E-commerce & Online Stores
- Victim Organization: Unknown
- Victim Site: Unknown
18. Alleged sale of shell access to Big Shop Europe
- Category: Initial Access
- Content: The threat actor clam to sell shell access to Big Shop Europe.
- Date: 2025-10-24T19:18:53Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268899/)
- Screenshots:
- Threat Actors: akr1t
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
19. Alleged data breach of Summit Hotel Properties, Inc.
- Category: Data Breach
- Content: The group claims to have breached the organizations data and intends to publish it with in 1 to 2 days.
- Date: 2025-10-24T18:17:31Z
- Network: tor
- Published URL: (https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies/9082711426/overview)
- Screenshots:
- Threat Actors: Worldleaks
- Victim Country: USA
- Victim Industry: Hospitality & Tourism
- Victim Organization: summit hotel properties, inc.
- Victim Site: shpreit.com
20. Alleged leak of leads from Hungary
- Category: Data Breach
- Content: The threat actor claims to have leaked leads from Hungary. The compromised data includes 64,000 records that includes name, email, phone number.
- Date: 2025-10-24T17:57:58Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268892/)
- Screenshots:
- Threat Actors: betway
- Victim Country: Hungary
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
21. Alleged sale of access to unidentified organization from USA
- Category: Initial Access
- Content: Threat actor claims to be selling unauthorized RDP access to an unidentified organization operating in the Law Firms and Legal Services industry from USA.
- Date: 2025-10-24T17:45:56Z
- Network: openweb
- Published URL: (https://xss.pro/threads/143920/)
- Screenshots:
- Threat Actors: C3FaRiR
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: Unknown
- Victim Site: Unknown
22. Alleged data breach of Essilor Group
- Category: Data Breach
- Content: The group claims to have breached the organizations data and intends to publish it with in 1 to 2 days.
- Date: 2025-10-24T17:41:31Z
- Network: tor
- Published URL: (https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies/1642223688/overview)
- Screenshots:
- Threat Actors: Worldleaks
- Victim Country: France
- Victim Industry: Medical Equipment Manufacturing
- Victim Organization: essilor group
- Victim Site: essilor.com
23. Alleged data leak of Hungary leads.
- Category: Data Breach
- Content: The threat actor claims to have leaked data from Hungary leads. The compromised data includes 64,000 records that includes name, email, phone number.
- Date: 2025-10-24T17:27:15Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268892/)
- Screenshots:
- Threat Actors: betway
- Victim Country: Hungary
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
24. Alleged data sale of of Physics Wallah
- Category: Data Breach
- Content: The threat actor claims to be selling the database of Physics Wallah. The compromised data includes 2.8 millions records that includes names, emails, phone numbers.
- Date: 2025-10-24T17:15:56Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268891/)
- Screenshots:
- Threat Actors: betway
- Victim Country: India
- Victim Industry: Education
- Victim Organization: physics wallah
- Victim Site: pw.live
25. Alleged data breach of Sportshop.com
- Category: Data Breach
- Content: The threat actor claims to be selling the database of Sportshop.com. The compromised data reportedly contains above 1.8 millions records that includes name, email and Phone number.
- Date: 2025-10-24T17:02:50Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268889/)
- Screenshots:
- Threat Actors: betway
- Victim Country: Netherlands
- Victim Industry: Sporting Goods
- Victim Organization: sportshop.com
- Victim Site: sportshop.com
26. Alleged data breach of Peruvian Connection
- Category: Data Breach
- Content: The group claims to have breached the organizations data and intends to publish it with in 1 to 2 days.
- Date: 2025-10-24T16:21:08Z
- Network: tor
- Published URL: (https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies/7647874169/overview)
- Screenshots:
- Threat Actors: Worldleaks
- Victim Country: USA
- Victim Industry: Fashion & Apparel
- Victim Organization: peruvian connection
- Victim Site: peruvianconnection.com
27. Alleged sale of merged credit card database
- Category: Data Breach
- Content: The threat actor claims to selling merged backup of credit card data from a former card shop, containing 8 millions Records from 2022–2025.
- Date: 2025-10-24T16:16:38Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268885/)
- Screenshots:
- Threat Actors: cashmoneycard
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
28. Alleged sale of unauthorized access to a U.S. insurance Salesforce database
- Category: Initial Access
- Content: The threat actor claims to be selling unauthorized access to a U.S. insurance Salesforce database. The compromised data contains 250,000 Records, with more than 50 internal tables containing customer information, agent details, etc.
- Date: 2025-10-24T16:04:14Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268884/)
- Screenshots:
- Threat Actors: letchik
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
29. Alleged data leak of Mexico Water infrastructure
- Category: Data Breach
- Content: Threat actor claims to be selling leaked water infrastructure data from Mexico. The compromised data reportedly contains 9,852,845 lines including full names, addresses, consumption data, account balances, tax information, telephone numbers, email addresses, exposing data from multiple states like Aguascalientes, Baja california, Campeche, Coahuila, etc.
- Date: 2025-10-24T15:51:06Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Mexico-Water-infrastructure-AguaLeaks-9-852-845-lines)
- Screenshots:
- Threat Actors: Eternal
- Victim Country: Mexico
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
30. Doha British School falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 481 GB of organization’s sensitive data.
- Date: 2025-10-24T15:47:12Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=98013bad-da1a-397e-9aa9-b53c4e2de165)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Qatar
- Victim Industry: Education
- Victim Organization: doha british school
- Victim Site: dohabritishschool.com
31. COX ENTERPRISES, INC. falls victim to CL0P Ransomware
- Category: Ransomware
- Content: Group claims to have obtained organization’s data.
- Date: 2025-10-24T14:52:13Z
- Network: tor
- Published URL: (http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/coxenterprises-com)
- Screenshots:
- Threat Actors: CL0P
- Victim Country: USA
- Victim Industry: Network & Telecommunications
- Victim Organization: cox enterprises, inc
- Victim Site: coxenterprises.com
32. Pan American Silver Corp. falls victim to CL0P Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-10-24T14:44:27Z
- Network: tor
- Published URL: (http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/panamericansilver-com)
- Screenshots:
- Threat Actors: CL0P
- Victim Country: Canada
- Victim Industry: Mining/Metals
- Victim Organization: pan american silver corp.
- Victim Site: panamericansilver.com
33. CyberBlitz targets the website of Namaa Business Center
- Category: Defacement
- Content: The group claims to have deface the website of Namaa Business Center
- Date: 2025-10-24T14:27:40Z
- Network: telegram
- Published URL: (https://t.me/Cyb3rBlitz/984)
- Screenshots:
- Threat Actors: CyberBlitz
- Victim Country: Yemen
- Victim Industry: Professional Training
- Victim Organization: namaa business center
- Victim Site: nbc-yemen.com
34. Alleged unauthorized access to Cerámica Padilla Padilla
- Category: Initial Access
- Content: The group claims to have gained access to the industrial control system of the Cerámica Padilla Padilla ceramics factory in Spain. They reportedly have the ability to control the burners, temperature settings, transport carts, pulsation parameters, and alarm systems within the kiln and conveyor operations.
- Date: 2025-10-24T12:56:20Z
- Network: telegram
- Published URL: (https://t.me/c/2634086323/2176)
- Screenshots:
- Threat Actors: NoName057(16)
- Victim Country: Spain
- Victim Industry: Manufacturing
- Victim Organization: cerámica padilla padilla
- Victim Site: ceramicapadilla.es
35. Alleged leak of login access of Qmix Supply Company Limited
- Category: Initial Access
- Content: The group claims to have leaked access to Qmix Supply Company Limited.
- Date: 2025-10-24T12:50:55Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2927)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Thailand
- Victim Industry: Manufacturing
- Victim Organization: qmix supply company limited
- Victim Site: qmix.co.th
36. Alleged leak of login access of Siam Multi Cons
- Category: Initial Access
- Content: The group claims to have leaked access to Siam Multi Cons
- Date: 2025-10-24T12:40:21Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2925)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Thailand
- Victim Industry: Building and construction
- Victim Organization: siam multi cons
- Victim Site: smc.in.th
37. Alleged leak of cPanel access of Curso Auge
- Category: Initial Access
- Content: The group claims to have leaked cPanel access to Curso Auge
- Date: 2025-10-24T12:30:44Z
- Network: telegram
- Published URL: (https://t.me/InDoM1nusTe4m/40)
- Screenshots:
- Threat Actors: InDoM1nu’s
- Victim Country: Brazil
- Victim Industry: Education
- Victim Organization: curso auge
- Victim Site: cursoauge.com.br
38. NCT [NTB CYBER TEAM] targets the website of FMG Connect
- Category: Defacement
- Content: The group claims to have deface the website of FMG Connect
- Date: 2025-10-24T12:13:27Z
- Network: telegram
- Published URL: (https://t.me/Garuda_Tersakiti/71)
- Screenshots:
- Threat Actors: NCT [NTB CYBER TEAM]
- Victim Country: India
- Victim Industry: Information Services
- Victim Organization: fmg connect
- Victim Site: fmgconnect.in
39. Alleged data breach of unidentified doctor system dashboard in Yemen
- Category: Data Breach
- Content: The team claims to have gained access to an unidentified doctor system dashboard in Yemen.
- Date: 2025-10-24T10:37:57Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/149)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Yemen
- Victim Industry: Hospital & Health Care
- Victim Organization: Unknown
- Victim Site: Unknown
40. Danthi Communication falls victim to BEAST Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 300 GB of the organization’s data.
- Date: 2025-10-24T10:01:42Z
- Network: tor
- Published URL: (http://beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd.onion/card/danthi_comunicacao_integrada)
- Screenshots:
- Threat Actors: BEAST
- Victim Country: Brazil
- Victim Industry: Public Relations/PR
- Victim Organization: danthi communication
- Victim Site: danthicomunicacao.com
41. Alleged data breach of unidentified hospital dashboard in Yemen
- Category: Data Breach
- Content: The group claims to have gained access to an unidentified hospital’s administrative dashboard in Yemen
- Date: 2025-10-24T08:56:36Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/135?single)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Yemen
- Victim Industry: Hospital & Health Care
- Victim Organization: Unknown
- Victim Site: Unknown
42. Simmers Crane Design & Services falls victim to LYNX Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data. Sample screenshots are provided on their dark web portal.
- Date: 2025-10-24T08:38:54Z
- Network: tor
- Published URL: (http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/leaks/68fb33c52423bc3ce0e922a0)
- Screenshots:
- Threat Actors: LYNX
- Victim Country: USA
- Victim Industry: Mechanical or Industrial Engineering
- Victim Organization: simmers crane design & services
- Victim Site: simmerscrane.com
43. Alleged leak of login access of Database of the National Committee for Sub-National Democratic Development
- Category: Initial Access
- Content: The group claims to have leaked access to Database of the National Committee for Sub-National Democratic Development.
- Date: 2025-10-24T08:09:59Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2923)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Cambodia
- Victim Industry: Government & Public Sector
- Victim Organization: database of the national committee for sub-national democratic development
- Victim Site: db.ncdd.gov.kh
44. CRYPTO24 Ransomware group adds an unknown victim (Mei ***)
- Category: Ransomware
- Content: The group claims to have obtained organization data and intends to publish it within 7-8 days.
- Date: 2025-10-24T07:56:45Z
- Network: tor
- Published URL: (http://j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onion/)
- Screenshots:
- Threat Actors: CRYPTO24
- Victim Country: Singapore
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
45. Alleged leak of login access of Netforce
- Category: Initial Access
- Content: The group claims to have leaked access to Netforce.
- Date: 2025-10-24T07:41:27Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2924)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Thailand
- Victim Industry: Information Technology (IT) Services
- Victim Organization: netforce
- Victim Site: e-order.netforce.co.th
46. Alleged leak of login access of Netforce
- Category: Initial Access
- Content: The group claims to have leaked access to Netforce.
- Date: 2025-10-24T07:25:12Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2923)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Thailand
- Victim Industry: Information Technology (IT) Services
- Victim Organization: netforce
- Victim Site: e-order.netforce.co.th
47. HEZI RASH claims to target Yemen
- Category: Alert
- Content: A recent post by the group claims they are targeting Yemen.
- Date: 2025-10-24T06:29:15Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/134)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Yemen
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
48. Alleged sale of Sophos Remote Management Tool
- Category: Malware
- Content: Threat actor claims to be selling access to a Sophos Remote Management Tool browser view that purportedly grants remote control over managed endpoints. The offering advertises capabilities to bypass antivirus detection, provide full system control, and includes a valid EV certificate to increase trust.
- Date: 2025-10-24T06:26:58Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268846/)
- Screenshots:
- Threat Actors: SICKOTRUSTED-URL
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
49. Alleged leak of login access of Cambodia Investment Project Management System
- Category: Initial Access
- Content: The group claims to have leaked access to Cambodia Investment Project Management System
- Date: 2025-10-24T06:23:49Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2920)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Cambodia
- Victim Industry: Government & Public Sector
- Victim Organization: cambodia investment project management system
- Victim Site: ipm.cdc.gov.kh
50. Cambodia Investment Project Management System
- Category: Initial Access
- Content: Cambodia Investment Project Management System
- Date: 2025-10-24T06:23:17Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2920)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Cambodia
- Victim Industry: Government & Public Sector
- Victim Organization: cambodia investment project management system
- Victim Site: ipm.cdc.gov.kh
51. Alleged sale of VirusTotal Enterprise account
- Category: Data Breach
- Content: The threat actor claims to be selling a VirusTotal Enterprise account for sale (one-user, non-admin, API-only access) obtained via brute force.
- Date: 2025-10-24T06:19:51Z
- Network: openweb
- Published URL: (https://xss.pro/threads/143906/)
- Screenshots:
- Threat Actors: Zeta
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
52. Alleged leak of login access of FaucetPanel
- Category: Initial Access
- Content: The group claims to have leaked access to FaucetPanel.
- Date: 2025-10-24T06:04:46Z
- Network: telegram
- Published URL: (https://t.me/fornetcloud/3963)
- Screenshots:
- Threat Actors: FORNET ORG
- Victim Country: USA
- Victim Industry: Financial Services
- Victim Organization: faucetpanel
- Victim Site: faucetpanel.com
53. ClearCare Periodontal & Implant Centre falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 528 GB of organization’s sensitive data.
- Date: 2025-10-24T05:49:57Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=c3964e6f-78b0-3576-95eb-f8e67a6dd38c)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Canada
- Victim Industry: Hospital & Health Care
- Victim Organization: clearcare periodontal & implant centre
- Victim Site: clearcareperio.com
54. Alleged data breach of MyVidster
- Category: Data Breach
- Content: The threat actor claims to have leaked a database from MyVidster, a video-sharing and bookmarking platform. The breach allegedly exposes 3,987,766 user records containing email addresses, user IDs, usernames, registration dates, and profile photos.
- Date: 2025-10-24T05:36:10Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-MyVidster-2025-Leaked-Download)
- Screenshots:
- Threat Actors: wikkid
- Victim Country: USA
- Victim Industry: Software
- Victim Organization: myvidster
- Victim Site: [suspicious link removed]
55. GHOST’S OF GAZA claims to target Bangladeshi Govt Website’s and servers
- Category: Alert
- Content: The recent post of group claims that they are targeting Bangladeshi Govt Website’s and servers
- Date: 2025-10-24T04:59:16Z
- Network: telegram
- Published URL: (https://t.me/GHOSTS_OF_GAZA/69)
- Screenshots:
- Threat Actors: GHOST’S OF GAZA
- Victim Country: Bangladesh
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
56. Alleged Sale of Credit Card Data from a 4-Star Hotel in Colombia
- Category: Data Breach
- Content: Threat actor claims to be selling a pack of 562 credit card records allegedly taken from a 4 star hotel in Colombia and other sources records are in CC|MM|YY|CVV|NAME format and are claimed to be around 60 percent valid 346 Colombian cards and 216 mixed international cards
- Date: 2025-10-24T04:02:20Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268843/)
- Screenshots:
- Threat Actors: s4sori
- Victim Country: Colombia
- Victim Industry: Hospitality & Tourism
- Victim Organization: Unknown
- Victim Site: Unknown
57. Infrastructure Destruction Squad claims to target USA
- Category: Alert
- Content: The recent post of group claims that they are targeting USA
- Date: 2025-10-24T03:08:18Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/2060)
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
58. Alleged leak of login access of LYNK
- Category: Initial Access
- Content: The group claims to have leaked access to LYNK.
- Date: 2025-10-24T03:03:12Z
- Network: telegram
- Published URL: (https://t.me/fornetcloud/3962)
- Screenshots:
- Threat Actors: FORNET ORG
- Victim Country: Indonesia
- Victim Industry: Business and Economic Development
- Victim Organization: lynk
- Victim Site: lynk.id
59. Alleged data breach of Centro de Bachillerato Tecnológico Industrial y de Servicios (CBTIS)
- Category: Data Breach
- Content: The threat actor claims to have leaked a database of CBTIS (Centro de Bachillerato Tecnológico Industrial y de Servicios) students from Mexico. The leak allegedly affects multiple CBTIS campuses and includes sensitive data such as personal details, contact information, student photos, home addresses, academic, medical, family, and socioeconomic records, as well as household and lifestyle information.
- Date: 2025-10-24T03:01:44Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATA-OF-STUDENTS-FROM-CBTIS-SEP)
- Screenshots:
- Threat Actors: L0stex
- Victim Country: Mexico
- Victim Industry: Education
- Victim Organization: centro de bachillerato tecnológico industrial y de servicios (cbtis)
- Victim Site: gob.mx
60. Alleged sale of Diamond Service
- Category: Malware
- Content: The threat actor claims to be selling Diamond Service, which offers the creation and editing of fake documents, PSD templates, and KYC/AML verification materials. The threat actor claims the service provides high-quality forged documents for over 70 countries, ensuring no traces of Photoshop and incorporating realistic metadata and barcodes. The service promises assistance with account verification, unblocking, and identity spoofing, emphasizing reliability and forensic-level document accuracy.
- Date: 2025-10-24T02:51:42Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-%E2%9C%94%EF%B8%8F-Drawing-editing-documents-drops-PSD-templates-KYC-AML-Verification)
- Screenshots:
- Threat Actors: Perfectum
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
61. Alleged data breach of Dinas Kependudukan dan Pencatatan Sipil
- Category: Data Breach
- Content: Threat actor claims to be leaking a database allegedly belonging to the Department of Population and Civil Registration (Dukcapil) of West Kalimantan Province, Indonesia. The leaked information reportedly contains personal and professional details of Indonesian civil servants, including full names, national identification numbers (NIP), job titles, ranks, years of service, and education details.
- Date: 2025-10-24T02:35:53Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Dukcapil-Kalimantan-Barat-Database-Leaked-By-LolForum)
- Screenshots:
- Threat Actors: LolForum
- Victim Country: Indonesia
- Victim Industry: Government Administration
- Victim Organization: dinas kependudukan dan pencatatan sipil
- Victim Site: dukcapil.kalbarprov.go.id
62. Alleged Sale of SSH Server Access to Multiple Organizations
- Category: Initial Access
- Content: A threat actor is allegedly selling unauthorized SSH access to around 600 compromised Linux servers. The servers reportedly belong to casino, crypto, e-commerce, travel, and other company websites.
- Date: 2025-10-24T02:25:30Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268836/)
- Screenshots:
- Threat Actors: bestsshroot2025
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
63. Alleged data leak of Personnel of the Russian Federation
- Category: Data Breach
- Content: Threat actor claims to be selling a Personnel RF 2025 database (allegedly Russian Federation personnel), about 50 million records (50kk lines)
- Date: 2025-10-24T02:19:14Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-%D0%9F%D0%B5%D1%80%D1%81%D0%BE%D0%BD%D0%B0%D0%BB-%D1%80%D1%84-2025-50kk-line)
- Screenshots:
- Threat Actors: radio
- Victim Country: Russia
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
64. Mead & Hunt falls victim to Kryptos Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 500 GB of organization data including engineering plans, architectural blueprints, infrastructure schematics, financial records, client contracts, internal audits, and proprietary design models.
NB: Initially on October 08, 2025, they added an unidentified victim (mea*****.com) and later revealed the full domain and disclosed 500 GB of compromised data on their dark web portal.
- Date: 2025-10-24T01:49:30Z
- Network: tor
- Published URL: (http://kryptospnjzz7vfkr663bnqv3dxirmr3svo5zwq7cvu2wdfngujgknyd.onion/)
- Screenshots:
- Threat Actors: Kryptos
- Victim Country: USA
- Victim Industry: Professional Services
- Victim Organization: mead & hunt
- Victim Site: meadhunt.com
65. Alleged leak of database of Zionist people
- Category: Data Breach
- Content: Group claims to have accessed a database of 9,000 Zionists, containing emails, passwords, phone numbers, exact addresses and full names.
- Date: 2025-10-24T01:28:07Z
- Network: telegram
- Published URL: (https://t.me/hak994/4294)
- Screenshots:
- Threat Actors: Fatimion cyber team
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
66. Adichunchanagiri Institute of Technology (AIT) falls victim to Kryptos Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s internal data and intends to publish it within 10 days
- Date: 2025-10-24T01:16:31Z
- Network: tor
- Published URL: (http://kryptospnjzz7vfkr663bnqv3dxirmr3svo5zwq7cvu2wdfngujgknyd.onion/)
- Screenshots:
- Threat Actors: Kryptos
- Victim Country: India
- Victim Industry: Education
- Victim Organization: adichunchanagiri institute of technology (ait)
- Victim Site: aitckm.edu.in
67. Alleged leak of unauthorized access of internal control panel of the National Office for Distance Education (ONEFE)
- Category: Initial Access
- Content: Group has claims to have gained full access to the internal control panel of the National Office for Distance Education (ONEFE) in Algeria. The group stated that the operation was conducted in retaliation against fake Algerian accounts accused of inciting against the Moroccan people. They asserted that this act was intended to “defend their country with all available capabilities.” Authorities have not confirmed the authenticity of the claim.
- Date: 2025-10-24T00:15:45Z
- Network: telegram
- Published URL: (https://t.me/MOROCCANSOLDIERS2/461)
- Screenshots:
- Threat Actors: Moroccan Soldiers
- Victim Country: Algeria
- Victim Industry: Education
- Victim Organization: national office for distance education
- Victim Site: onefd.edu.dz
Conclusion
The incidents detailed in this report highlight a diverse and active landscape of cyber threats. Ransomware attacks were prominent, with groups like SAFEPAY, Qilin, CL0P, Kryptos, TENGU, CHAOS, BEAST, LYNX, and CRYPTO24 impacting various sectors globally, including Manufacturing, Real Estate, Software Development, Marketing, Telecommunications, Education, and Healthcare. Many of these groups claim to have exfiltrated large volumes of data.
Data Breaches and Data Leaks were also widely reported, involving the alleged sale or leak of millions of records, including those from MyVidster (3.9 million), Physics Wallah (2.8 million), Sportshop.com (1.8 million+), a U.S. insurance Salesforce database (250,000 records), and even government-related data from the US government domains, Mexico Water infrastructure (9.8 million lines), and a Department of Population and Civil Registration in Indonesia.
Furthermore, the underground markets saw substantial activity in Initial Access sales, with offers for RDP/SSH access to organizations in the Law Firms, E-commerce, and Manufacturing industries, as well as to government systems in Cambodia and an industrial control system in Spain. The sale of malicious Malware tools, such as the Apple Email Checker v2, ROBLOX Tools Pack, Sophos Remote Management Tool, and a Diamond Service for forging documents, underscores the continued evolution and availability of offensive capabilities. The geographical spread of victims, from the USA and Canada to countries in Europe, Asia, and Africa, demonstrates the non-discriminatory nature of current cyber threats.
The collective nature of these incidents emphasizes the need for organizations across all industries to maintain robust cybersecurity posture, particularly focusing on data protection, access control, and proactive monitoring of threat intelligence.