This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. Alleged sale of CIA Intelligence data
- Category: Data Breach
- Content: Threat actor claims to be selling intelligence data related to the Ukraine–Russia conflict.
- Date: 2025-10-25T22:27:28Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-%E2%98%84%EF%B8%8F-TOP-SECRET-CIA-INTELLIGENCE-UPDATE-SEP-2025-DOC-%E2%98%84%EF%B8%8F)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/5adc1be6-1713-4b77-8253-f2ea80b1feb9.png https://d34iuop8pidsy8.cloudfront.net/55e772b3-0862-45b9-935f-f3d64642131b.png
- Threat Actors: jrintel
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
2. PAP SUD falls victim to Nova Ransomware
- Category: Ransomware
- Content: Group claims to have obtained 100 GB of the organization’s data and intends to publish them within 5-6 days.
- Date: 2025-10-25T22:25:13Z
- Network: tor
- Published URL: (http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/#)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/8d5f3585-a990-4f41-a348-ff9bae246455.png
- Threat Actors: Nova
- Victim Country: France
- Victim Industry: Automotive
- Victim Organization: pap sud
- Victim Site: pap-sud.fr
3. Alleged leak of confidential intelligence data from multiple countries
- Category: Data Breach
- Content: Threat actor claims to be selling confidential intelligence and materials from multiple countries, including the USA, China, India, Pakistan, the UK, and Russia.
- Date: 2025-10-25T22:21:44Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-1-TOP-SECRET-INTEL-SUPPLIER-%F0%9F%8E%83-TRUSTED-BY-FSB-AND-CHINESE-GOV-%F0%9F%8E%83)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/a867ec15-2352-4c5d-85f1-6e363c8c3aa6.png https://d34iuop8pidsy8.cloudfront.net/958d83fe-2f63-4bc2-aa51-763b9baa79f1.png
- Threat Actors: jrintel
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
4. Alleged data breach of Bahia Park
- Category: Data Breach
- Content: Threat actor claims to have leaked data of Bahia Park, Spain, exposing over 15,000 records containing personal and contact information of visitors.
- Date: 2025-10-25T22:14:58Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-%F0%9F%87%AA%F0%9F%87%B8-BAHIAPARK-COM-WATER-PARK-FROM-SPAIN-2025-15-816-ROWS-%F0%9F%87%AA%F0%9F%87%B8)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/8dd81844-5b5d-4ee8-bb8c-b389e56eed7d.png https://d34iuop8pidsy8.cloudfront.net/e1de577f-8758-489a-ae01-cefb63ef047b.png
- Threat Actors: Colmenero
- Victim Country: Spain
- Victim Industry: Leisure & Travel
- Victim Organization: bahia park
- Victim Site: bahiapark.com
5. Alleged leak of unauthorized access to Wintale
- Category: Initial Access
- Content: Threat actor claims to have leaked unauthorized admin dashboard access to Wintale.
- Date: 2025-10-25T22:14:31Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Italy-Admin-Dashboard-Access-wintale-it)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/72a84858-6e40-4b92-961d-555cb80300c6.png
- Threat Actors: blackhunter1
- Victim Country: Italy
- Victim Industry: Hospitality & Tourism
- Victim Organization: wintale
- Victim Site: wintale.it
6. Alleged leak of unauthorized access to Carbonia Musei
- Category: Initial Access
- Content: Threat actor claims to have leaked unauthorized admin dashboard access to Carbonia Musei.
- Date: 2025-10-25T22:08:10Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Italy-Admin-Dashboard-Access-carboniamusei-it)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/c848224e-b76b-4875-8d51-4b4468ee38f6.png
- Threat Actors: blackhunter1
- Victim Country: Italy
- Victim Industry: Museums & Institutions
- Victim Organization: carbonia musei
- Victim Site: carboniamusei.it
7. Alleged leak of unauthorized access to Divyan Properties
- Category: Initial Access
- Content: Threat actor claims to have leaked unauthorized admin access to Divyan Properties.
- Date: 2025-10-25T22:04:48Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-INDIA-Admin-Dashboard-Access-divyanproperty-in)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/e1245708-aaa6-47ec-9a0f-13623b469c65.png
- Threat Actors: blackhunter1
- Victim Country: India
- Victim Industry: Real Estate
- Victim Organization: divyan properties
- Victim Site: divyanproperty.in
8. Precision Machined Products falls victim to akira ransomware
- Category: Ransomware
- Content: Group claims to have obtained 12 GB of data from the organization. The compromised information reportedly includes corporate documents, employee information, HR files, project data, internal confidential files, client confidential files, various specifications and drawings, NDA, etc.
- Date: 2025-10-25T21:16:57Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/ab55c7c4-3e8a-4574-b0c7-8ad059b1eab8.png
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Manufacturing
- Victim Organization: precision machined products
- Victim Site: pmpmach.com
9. Alleged gain of access to the FTP server of MB “Gripitas IT”
- Category: Initial Access
- Content: The group claims to have gained access to the FTP server containing all data about the company MB “Gripitas IT”, which is located in Lithuania.
- Date: 2025-10-25T19:31:31Z
- Network: telegram
- Published URL: (https://t.me/TwoNetchannel/84)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/3803b5b9-a9cb-4665-af1d-0b49a65ca644.png https://d34iuop8pidsy8.cloudfront.net/080a9245-c627-498a-acee-4d14673859f1.png https://d34iuop8pidsy8.cloudfront.net/3df5c5c6-6587-490f-833e-0a080b3e914c.png
- Threat Actors: TwoNet
- Victim Country: Lithuania
- Victim Industry: Information Technology (IT) Services
- Victim Organization: mb “gripitas it”
- Victim Site: Unknown
10. Essential Cabinetry Group falls victim to Qilin Ransomware
- Category: Ransomware
- Content: Group claims to have obtained the organization’s data.
- Date: 2025-10-25T18:57:17Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=eeecd40d-180a-3ff1-9e8c-ac73885e9659)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/bdb070c9-a5c1-4861-bacc-d6c437c00faf.png
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Wholesale
- Victim Organization: essential cabinetry group
- Victim Site: essentialcabinetrygroup.com
11. Red wolf cyber claims to target India
- Category: Alert
- Content: A recent post by the group indicates that they are targeting India.
- Date: 2025-10-25T18:40:19Z
- Network: telegram
- Published URL: (https://t.me/c/2609313110/451)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/a63d3870-65dd-4697-a606-17b91cb44e25.png
- Threat Actors: Red wolf cyber
- Victim Country: India
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
12. Alleged Sale of Italian Credit Card Dumps
- Category: Data Breach
- Content: Threat actor claims to be selling 300 Italian credit-card records and 300 “SS” card dumps.
- Date: 2025-10-25T18:39:40Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268958/)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/b937a187-700b-4be5-9a48-053412f8ebb9.png
- Threat Actors: Drummers
- Victim Country: Italy
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
13. Alleged data breach of Sensory
- Category: Data Breach
- Content: Threat actor claims to have leaked data of Israeli software firm Sensory, including citizen IDs, medical records, and financial data around 1TB.
- Date: 2025-10-25T18:33:45Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Data-Breach-of-gov-il-via-Sensory-Israel)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/b58172f7-d9d8-41cf-8dd6-94e03740307b.png
- Threat Actors: MoneyTalks
- Victim Country: Israel
- Victim Industry: Software
- Victim Organization: sensory
- Victim Site: sensory.co.il
14. Alleged data breach of Central Military Hospital
- Category: Data Breach
- Content: Threat actor claims to have leaked data of the Hospital Militar Central, exposing records of nearly 23,000 military personnel and civilians.
- Date: 2025-10-25T18:30:42Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Hospital-Militar-Central-%E2%80%9CLuis-Arias-Schreiber%E2%80%9D-%E2%80%93-Ej%C3%A9rcito-del-Per%C3%BA-Breach-22K)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/f57f0765-d61f-49d6-af94-21031bbd507e.png
- Threat Actors: Kazu
- Victim Country: Peru
- Victim Industry: Hospital & Health Care
- Victim Organization: hospital militar central
- Victim Site: hmc.ejercito.mil.pe
15. Alleged data sale of Royal Thai Army
- Category: Data Breach
- Content: Threat actor claims to be selling data from Royal Thai Army. The compromised data reportedly contain 30,084 files.
- Date: 2025-10-25T17:49:43Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Official-Royal-Thai-Army-Online-Enlistment-Portal-Breach)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/25d295ea-5726-4be1-b2cf-e0c7707a3d34.png
- Threat Actors: Kazu
- Victim Country: Thailand
- Victim Industry: Government Administration
- Victim Organization: royal thai army
- Victim Site: rta.mi.th
16. Alleged sale of citizens’ data from Spain
- Category: Data Breach
- Content: Threat actor claims to be selling 38 million rows of citizen’s data from Spain.
- Date: 2025-10-25T17:39:58Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-%F0%9F%87%AA%F0%9F%87%B8Spain-citizens-DB-2025-10-15-34-million-rows)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/a1cb8f02-0a28-4a33-b7f2-d7add736dd94.png
- Threat Actors: Cayenne
- Victim Country: Spain
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
17. Alleged leak of PII data from Indonesia
- Category: Data Breach
- Content: Threat actor claims to be selling 4 billion PII (Personally Identifiable Information) data from Indonesia.
- Date: 2025-10-25T17:35:44Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-ACCESS-TO-4-BILLION-INDONESIA-PII-DATA)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/04846967-9280-4230-b0db-4b54e1fda12a.png
- Threat Actors: indonesiadata
- Victim Country: Indonesia
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
18. Svenska kraftnät falls victim to Everest Ransomware
- Category: Ransomware
- Content: Group claims to have obtained 280GB of organization’s data.
- Date: 2025-10-25T16:07:18Z
- Network: tor
- Published URL: (http://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion/news/svk/)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/c1ec64f1-1b87-427f-af01-625c3200e770.png
- Threat Actors: Everest
- Victim Country: Sweden
- Victim Industry: Energy & Utilities
- Victim Organization: svenska kraftnät
- Victim Site: svk.se
19. Alleged Sale of 200K Credential Combo
- Category: Combo List
- Content: The threat actor claims to be offering a database containing 200,000-record combo file containing credential pairs for multiple services, specifically Roblox, various online shopping sites, Steam, and Valorant.
- Date: 2025-10-25T15:55:45Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/200k-combo-roblox-shopping-steam-valorant.44867/)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/90f4581f-6ba9-49f8-9730-6a6e8d29d23f.png
- Threat Actors: Nira
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
20. Omrin falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-10-25T14:35:02Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=0882797d-14ea-3714-b672-7f7db9f40607)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/8059a297-cbd8-43ea-bec9-2615f119ead7.png
- Threat Actors: Qilin
- Victim Country: Netherlands
- Victim Industry: Environmental Services
- Victim Organization: omrin
- Victim Site: omrin.nl
21. Kaufman & Stigger, PLLC Injury Lawyers falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-25T14:27:30Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=f68940e3-fb1b-37fb-9b84-68d521ae1ac1)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/8f168a77-b986-412c-ad88-9393fda21856.jpg
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: kaufman & stigger, pllc injury lawyers
- Victim Site: getthetiger.com
22. Zacho-Lind falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-10-25T14:22:08Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=5c38c609-1241-3e01-bf8c-6351e9479399)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/9d7d00a7-4839-4e71-9b33-223045de39f7.png
- Threat Actors: Qilin
- Victim Country: Denmark
- Victim Industry: Building and construction
- Victim Organization: zacho-lind a/s
- Victim Site: zacho-lind.dk
23. City of Sugar Land, TX falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 800 GB organization’s data.
- Date: 2025-10-25T14:18:08Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=3e8467fa-2653-362b-9290-f03b07c419cc)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/0021145c-e664-4f9a-81fe-8700226485dc.png
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Government Administration
- Victim Organization: city of sugar land, tx
- Victim Site: sugarlandtx.gov
24. HEZI RASH targets the website of Syrian Financial Analysts Society
- Category: Defacement
- Content: The group claims to have deface the website of Syrian Financial Analysts Society Mirror : https://archive.ph/3BB71
- Date: 2025-10-25T13:15:57Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/179)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/8c194da8-3ecc-4aeb-aaee-cec6daf9da3d.png
- Threat Actors: HEZI RASH
- Victim Country: Syria
- Victim Industry: Financial Services
- Victim Organization: syrian financial analysts society
- Victim Site: syrian-fas.org
25. MetroWest Community FCU falls victim to akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data. The compromised information reportedly includes clients documents such as DLs, birth and death certificates and numerous forms with personal information, financial and accounting information, court cases information, employee personal files, etc.
- Date: 2025-10-25T12:10:52Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/752d1898-04df-4776-bae1-03382c9ea820.jpg
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Financial Services
- Victim Organization: metrowest community fcu
- Victim Site: mwcfcu.com
26. Alleged data breach of Siraj Finance
- Category: Data Breach
- Content: The threat actor claims to have breached organization’s data.
- Date: 2025-10-25T12:00:19Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/175)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/81c63808-94f9-402b-9866-b2f0c966a57a.png
- Threat Actors: HEZI RASH
- Victim Country: UAE
- Victim Industry: Financial Services
- Victim Organization: siraj finance
- Victim Site: sirajfinance.com
27. Alleged sale of a compact web-shell system
- Category: Malware
- Content: The group claims to be selling a compact web-shell that installs in one step on any website to grant full remote control.
- Date: 2025-10-25T11:54:26Z
- Network: telegram
- Published URL: (https://t.me/DIeNlt/629)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/d8e93906-ad81-41c1-9be5-6dbccaf8aad8.png
- Threat Actors: DieNet
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
28. GHOST’S OF GAZA targets the website of Feni District Council
- Category: Defacement
- Content: The group claims to have deface the website of Feni District Council Mirror : https://ownzyou.com/zone/275882
- Date: 2025-10-25T11:43:17Z
- Network: telegram
- Published URL: (https://t.me/GHOSTS_OF_GAZA/75)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/9a88b8aa-6141-46f1-addf-f735b1cde188.png
- Threat Actors: GHOST’S OF GAZA
- Victim Country: Bangladesh
- Victim Industry: Government Administration
- Victim Organization: feni district council
- Victim Site: zpfeni.gov.bd
29. Alleged data sale of M-TIBA
- Category: Data Breach
- Content: The threat actor claims to be selling 2.15 TB of data from M-TIBA, a mobile healthcare platform for Kenyans. The compromised data contains 17,158,105 records.
- Date: 2025-10-25T09:46:42Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Kenya%E2%80%99s-Mobile-Health-and-Insurance-Platform-2-15TB-17M-files)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/5643e8c0-fe7f-45ac-93df-5901a06320fe.png
- Threat Actors: Kazu
- Victim Country: Kenya
- Victim Industry: Information Technology (IT) Services
- Victim Organization: m-tiba
- Victim Site: mtiba.com
30. Alleged sale of Admin access to Brazilian Police System
- Category: Initial Access
- Content: Threat actor is offering Intranet VPN Access — a VPN service that grants remote access to internal network links enabling entry to webmail, a police investigation system (search citizens/vehicles/weapons), a prisoner management system, and a vehicle tracker/alert manager.
- Date: 2025-10-25T06:35:31Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-ADMIN-ACCESS-TO-POLICE-VPN-FROM-BRAZIL)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/028b352b-b7da-4d4b-b7e1-805821c02363.png
- Threat Actors: Midia22
- Victim Country: Brazil
- Victim Industry: Law Enforcement
- Victim Organization: Unknown
- Victim Site: Unknown
31. BABAYO EROR SYSTEM targets the website of Purbalingga Regency Government
- Category: Defacement
- Content: The group claims to have defaced the website of Purbalingga Regency GovernmentProof : [suspicious link removed]
- Date: 2025-10-25T05:56:10Z
- Network: telegram
- Published URL: (https://t.me/c/3159622829/299)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/7e05c056-43a5-4f48-a344-6101b0650ca8.png
- Threat Actors: BABAYO EROR SYSTEM
- Victim Country: Indonesia
- Victim Industry: Government Administration
- Victim Organization: purbalingga regency government
- Victim Site: dpupr.purbalinggakab.go.id
32. Alleged leak of 5 Million unique Spanish passwords
- Category: Data Breach
- Content: The threat actor claims to be selling a dictionary of 5,055,010 unique Spanish passwords compiled in 2025 from over 100 breached email:password sources.
- Date: 2025-10-25T04:40:56Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-%F0%9F%87%AA%F0%9F%87%B8-5-MILLION-UNIQUE-SPANISH-PASSWORDS-%F0%9F%87%AA%F0%9F%87%B8)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/4000f410-c435-476d-8151-9352174096b4.png https://d34iuop8pidsy8.cloudfront.net/20faa6f4-2826-4cc6-8eda-a9fa0945fa87.png
- Threat Actors: Colmenero
- Victim Country: Spain
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
33. David Yurman falls victim to CL0P Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s internal data.
- Date: 2025-10-25T02:21:14Z
- Network: tor
- Published URL: (http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/e6f7b4dd-cc47-4f11-bafb-e731bf1229ab.png
- Threat Actors: CL0P
- Victim Country: USA
- Victim Industry: Luxury Goods & Jewelry
- Victim Organization: david yurman
- Victim Site: davidyurman.com
34. HEZI RASH targets the website of bluediamondresearch.com
- Category: Defacement
- Content: The group claims to have deface the website of bluediamondresearch.com
- Date: 2025-10-25T00:19:59Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/170)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/6221a311-1fb7-4876-a920-cd62a3f7508c.png
- Threat Actors: HEZI RASH
- Victim Country: Japan
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: bluediamondresearch.com
Conclusion
The incidents detailed in this report highlight a diverse and active landscape of cyber threats, strictly based on the provided data. Ransomware attacks were notably frequent, with groups like Qilin and akira impacting organizations in the USA, Denmark, and the Netherlands. Data Breaches continued to be prominent, with incidents exposing large datasets from various countries, including Spain (38 million rows of citizen data) , Indonesia (4 billion PII data) , and a mobile healthcare platform in Kenya (17 million records). Sensitive intelligence data was also allegedly offered for sale by the actor jrintel.
Significant activity in Initial Access sales was observed, with threat actors offering unauthorized administrative access to websites and networks in Italy, India, Lithuania, and a Brazilian police system. Defacement attacks primarily targeted websites in the Middle East and South Asia.
These incidents collectively demonstrate that organizations across various industries and geographies face persistent threats from data exfiltration, ransomware, unauthorized network access, and the proliferation of malicious tools like the compact web-shell system offered by DieNet.