[November-4-2025] Daily Cybersecurity Threat Report

Posted on

This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.

1. Alleged sale of RDP access to a U.S. corp

2. Alleged Unauthorized Access to Italian Smart Home Control System

3. Alleged sale of unauthorized admin access to Yental

4. Payouts King Ransomware group adds an unknown victim (I****r)

5. Alleged sale of unauthorized admin access to an unidentified online store in France

6. Sellars Absorbent Materials falls victim to PLAY ransomware

7. ConvExx falls victim to PLAY ransomware

8. American PowerNet falls victim to PLAY ransomware

9. Alleged sale of unauthorized admin access to an unidentified online stores

10. Yibirin Law Group falls victim to INC RANSOM ransomware

11. Alleged leak of Argentina Corporate User Database

12. Alleged data sale of University of Sharjah

13. Alleged leak of Algeria Telecom Customer Records

14. Alleged data breach of Papa Johns

15. Alleged data breach of Property Finder

16. Mango’s Tropical Cafe, Inc falls victim to Qilin ransomware

17. PROVA

18. Alleged data breach of MGBX EXCHANGE

19. Alleged data breach of PlaneWave Instruments

20. Elliott Tax Service falls victim to Akira Ransomware

  • Category: Ransomware
  • Content: The group claims to have obtained 82 GB of the organization’s data. The compromised data includes Client personal documents scans, employee personal information and other HR information. Clients financials and other files, NDA, credit card details, payment details, confidentiality agreements, legal and court documents, police reports, and so on.
  • Date: 2025-11-04T15:38:00Z
  • Network: tor
  • Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
  • Screenshots:
  • Threat Actors: akira
  • Victim Country: USA
  • Victim Industry: Accounting
  • Victim Organization: elliott tax service
  • Victim Site: elliotttaxservice.com

21. Alleged Sale of Unauthorised CRM access to an unidentified Electronics retailer in Spain

22. Benda Grace Stulz falls victim to Akira Ransomware

23. Palacios Marine Industrial falls victim to akira ransomware

24. GHOST’S OF GAZA targets the website of Associação dos Concessionários do Distrito de Irrigação de Neópolis

25. GHOST’S OF GAZA targets the website of Mar & Ar Mergulho e Turismo

26. Alleged data breach of TOP7

27. RASHTRIYA CYBER SENA targets the website of Realup

28. General Micro Systems falls victim to akira ransomware

29. HEZI RASH targets the website of Cokdron

30. NCT [NTB CYBER TEAM] targets the website of Design Internal

31. LEAKS DATABASE CYBER TEAM INDONESIA targets the website of RegionLogistic

32. Alleged data breach of New York State

33. Alleged data sale of Anka

34. LN Dinbolig falls victim to BEAST Ransomware

35. Invacare International Holdings Corp. falls victim to RHYSIDA ransomware

36. TwoNet claims to target Belgium

37. TwoNet Team claims to target Belgium

38. Alleged leak of admin credentials of White ICE Cottages

40. RÍOS ESPINOSA falls victim to Space Bears Ransomware

41. Dovern Import falls victim to Space Bears Ransomware

42. BABAYO EROR SYSTEM targets multiple websites

43. HellR00ters Team claims to target India and Israel

44. Alleged leak of Indonesian Telecom Customer Database

45. LV= falls victim to CL0P Ransomware

46. Alleged data breach of Robinhood

  • Category: Data Breach
  • Content: The threat actor claims to have leaked a database of Robinhood Markets, Inc., a U.S.-based financial services company. The dataset reportedly contains 4.6 million records from the USA, including details such as names, addresses, contact numbers, gender, birth dates, credit scores, assets, investments, and emails The threat actor AlphaLeadsCapital, previously reported as a victim on September 21, 2025.
  • Date: 2025-11-04T02:41:21Z
  • Network: openweb
  • Published URL: (https://leakbase.la/threads/robinhood-markets-us-financial-service-db-avilable.45226/)
  • Screenshots:
  • Threat Actors: Cayenne22
  • Victim Country: USA
  • Victim Industry: Financial Services
  • Victim Organization: robinhood
  • Victim Site: robinhood.com

47. RÍOS ESPINOSA falls victim to Space Bears Ransomware

48. Alleged Leak of 5,000 Lines of Chinese Data in USA mobile

49. Alleged unauthorized access to Russian Construction Services Administrative Panel

  • Category: Initial Access
  • Content: he group claims they accessed an admin panel for a Russian construction and waterproofing company, exposing client names, phone numbers, addresses, revenue and order details, and the system’s communication settings (including a Telegram bot), which could be used to view or manipulate company notifications and internal infrastructure.
  • Date: 2025-11-04T02:14:28Z
  • Network: telegram
  • Published URL: (https://t.me/n2LP_wVf79c2YzM0/2271)
  • Screenshots:
  • Threat Actors: Infrastructure Destruction Squad
  • Victim Country: Russia
  • Victim Industry: Building and construction
  • Victim Organization: Unknown
  • Victim Site: Unknown

50. Alleged Leak of 2,000 Lines of Chinese Data in Australia

51. Alleged Leak of 2k Lines of Chinese Data in Canada

52. Alleged Leak of 2k Lines of Chinese Data in France

53. Alleged Leak of 5k Lines of Chinese Data in USA

54. Crown Automotive Sales Co., Inc. falls victim to Sinobi Ransomware

55. Alleged data breach of BlueEast

Conclusion

The incidents detailed in this report highlight a diverse and active landscape of cyber threats in a single 24-hour period. Ransomware attacks, particularly against organizations in the USA (Manufacturing, Accounting, Energy & Utilities, etc.) by groups like Akira, PLAY, Qilin, and Space Bears, remain a prominent threat. The compromised data often includes sensitive personal information of employees and clients, and confidential financial and operational documents.

Data breaches and leaks were reported across various geographies, including major incidents affecting users in Argentina, Indonesia, UAE, and leaks of corporate data from companies like Papa John’s and the New York State government.

Furthermore, the underground market for Initial Access remains robust, with threat actors selling RDP access and admin panel credentials for targets in the USA, India, Spain, and Russia, including access to a smart home automation system in Italy.

The activity shows that organizations across various industries and geographies face persistent threats from data exfiltration, unauthorized network access, and the use of malicious tools like ransomware.

Related Posts