This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. Alleged access sale to an unidentified U.S.-based law firm
- Category: Initial Access.
- Content: The threat actor claims to be selling access to an unidentified U.S.-based law firm, providing a shell-level access to its network. The compromised environment reportedly includes 1,000+ hosts and is classified as Domain Admin (DA) access.
- Date: 2025-08-19T14:01:27Z.
- Network: openweb.
- Published URL: (https://ramp4u.io/threads/2b-corp-access.3365/).
- Screenshots:
- Threat Actors: soup.
- Victim Country: USA.
- Victim Industry: Law Practice & Law Firms.
- Victim Organization: Unknown.
- Victim Site: Unknown.
2. Alleged leak of Canada Data
- Category: Data Leak.
- Content: The threat actor claims to have leaked data from Canada.
- Date: 2025-08-19T13:49:19Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-Canadian-data%E2%9C%85).
- Screenshots:
- Threat Actors: Anoswantstobatte1.
- Victim Country: Canada.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
3. Holy league claims to target Saudi Arabia
- Category: Alert.
- Content: A recent post by the group indicated that they are targeting Saudi Arabia.
- Date: 2025-08-19T12:40:14Z.
- Network: telegram.
- Published URL: (https://t.me/Mhwear96/29).
- Screenshots:
- Threat Actors: Holy league.
- Victim Country: Saudi Arabia.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
4. Alleged sale of Xleak Bot
- Category: Malware.
- Content: The threat actor claims to be selling Xleak Bot (“THE ULP LINE BOT”), a Telegram-based tool for quickly searching and retrieving leaked credentials from both private and public sources. The bot allows users to search URLs, reveal usernames and emails, and access exposed passwords.
- Date: 2025-08-19T12:17:45Z.
- Network: openweb.
- Published URL: (https://forum.exploit.in/topic/264563/).
- Screenshots:
- Threat Actors: Akagi.
- Victim Country: Unknown.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
5. Night Owll targets multiple websites
- Category: Defacement.
- Content: The group claims to have defaced multiple websites.
- Date: 2025-08-19T11:58:13Z.
- Network: telegram.
- Published URL: (https://t.me/c/2702757113/75).
- Screenshots:
- Threat Actors: Night Owll.
- Victim Country: UAE.
- Victim Industry: Building and construction.
- Victim Organization: al nahdha overseas contracting llc anoc.
- Victim Site: bedscapes.in.
6. Alleged sale of mail access to Kleinanzeigen
- Category: Initial Access.
- Content: The threat actor claims to be selling access to German email accounts from providers like @t-online.de, @freenet.de, @web.de, @mail.de, GMX to Kleinanzeigen.
- Date: 2025-08-19T11:21:53Z.
- Network: openweb.
- Published URL: (https://forum.exploit.in/topic/264556/).
- Screenshots:
- Threat Actors: Kleinandealer.
- Victim Country: Germany.
- Victim Industry: E-commerce & Online Stores.
- Victim Organization: kleinanzeigen.
- Victim Site: kleinanzeigen.de.
7. Alleged Data Breach of FBI Internal Mail and Messenger Systems
- Category: Data Breach.
- Content: A threat actor claims to have breached the FBI’s internal mail and messenger systems, allegedly exposing confidential data of over 3,000 employees and licensed stores. The compromised information reportedly includes employee details (name, position, phone number, email, and Social Security Numbers), as well as store licensing records containing license names, store IDs, federal license numbers (FFL), contact details, and addresses.
- Date: 2025-08-19T11:20:20Z.
- Network: telegram.
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/810).
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad.
- Victim Country: USA.
- Victim Industry: Law Enforcement.
- Victim Organization: federal bureau of investigation.
- Victim Site: fbi.gov.
8. Alleged leak of Israel government data
- Category: Data Leak.
- Content: The threat actor claims to have leaked an Israeli government database, allegedly containing 202 records.
- Date: 2025-08-19T10:33:29Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-israeli-Gov-database-https-files-catbox-moe-pj9vgw-zip).
- Screenshots:
- Threat Actors: Katuru.
- Victim Country: Israel.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
9. Alleged leak of Israeli mall’s customer data
- Category: Data Leak.
- Content: The threat actor claims to have leaked 259GB of records allegedly stolen from an Israeli mall’s customer database. The compromised data includes ID, category, company name, email, address, state, ZIP code, phone number, and more.
- Date: 2025-08-19T10:20:04Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-259GB-Mall-Israel-Costumer-Database).
- Screenshots:
- Threat Actors: DigitalGhostt.
- Victim Country: Israel.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
10. Alleged sale of personal identifiable documents
- Category: Data Leak.
- Content: The threat actor claims to be selling a wide range of personally identifiable documents, including ID cards, driver’s licenses, passports accompanied by selfies, scans, utility bills, financial statements, medical reports, and PSD templates. The data allegedly covers individuals from all European countries, the United States, Canada, and parts of Asia.
- Date: 2025-08-19T10:19:56Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-Sale-of-ID-DL-Selfie-Scans-Bills-PSD-templates-proof).
- Screenshots:
- Threat Actors: Reclottoo.
- Victim Country: Unknown.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
11. Alleged leak of Uzbekistan medical data
- Category: Data Leak.
- Content: The threat actor claims to have leaked a 30,000 record Uzbekistan medical database, which includes doctor, service, and hospital information.
- Date: 2025-08-19T10:04:20Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-DATABASE-UZBEKISTAN-MEDICAL-DATABASE-DOCTOR-INFORMATION).
- Screenshots:
- Threat Actors: elnurdxb.
- Victim Country: Uzbekistan.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
12. Nullsec Philippines targets the website of Tire-Lire
- Category: Defacement.
- Content: The group claims to have defaced the website of Tire-Lire.
- Date: 2025-08-19T09:59:51Z.
- Network: telegram.
- Published URL: (https://t.me/nullsechackers/75).
- Screenshots:
- Threat Actors: Nullsec Philippines.
- Victim Country: Belgium.
- Victim Industry: Library.
- Victim Organization: tire-lire.
- Victim Site: tire-lire.be.
13. Nullsec Philippines targets the website of Public Libraries Network of the Province of Namur (Belgium)
- Category: Defacement.
- Content: The group claims to have defaced the website of Public Libraries Network of the Province of Namur (Belgium).
- Date: 2025-08-19T09:59:38Z.
- Network: telegram.
- Published URL: (https://t.me/nullsechackers/75).
- Screenshots:
- Threat Actors: Nullsec Philippines.
- Victim Country: Belgium.
- Victim Industry: Library.
- Victim Organization: public libraries network of the province of namur (belgium).
- Victim Site: vsmart.province.namur.be.
14. Alleged data breach of Regional Institute of Education, Bhopal
- Category: Data Breach.
- Content: The threat actor claims to have leaked a database from the Regional Institute of Education, Bhopal. The compromised data includes first names, last names, mobile numbers, and email addresses.
- Date: 2025-08-19T08:14:00Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-First-Name-Last-Name-Mobile-Number-Email-Actionitepriebhopalcounselling).
- Screenshots:
- Threat Actors: darknessX404.
- Victim Country: India.
- Victim Industry: Education.
- Victim Organization: regional institute of education.
- Victim Site: itepriebhopalcounselling.in.
15. Alleged Sale of WordPress Exploit
- Category: Vulnerability.
- Content: The group claims to be selling a private WordPress exploit that enables high-speed administrator access.
- Date: 2025-08-19T07:55:53Z.
- Network: telegram.
- Published URL: (https://t.me/LearnExploit/8580).
- Screenshots:
- Threat Actors: 0Day.Today Learn Exploit Zero World Dark Web.
- Victim Country: Unknown.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
16. Alleged data breach of Synergy Group of Institutions
- Category: Data Breach.
- Content: The threat actor claims to have leaked a database from the Synergy Group of Institutions. The compromised data includes names, usernames, passwords, and email addresses.
- Date: 2025-08-19T07:36:27Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-name-username-password-email-site-net).
- Screenshots:
- Threat Actors: darknessX404.
- Victim Country: India.
- Victim Industry: Education.
- Victim Organization: synergy group of institutions.
- Victim Site: synergyinstitute.net.
17. Alleged sale of Russian Government mail addresses data
- Category: Data Leak.
- Content: The threat actor claims to be selling 18,000 email addresses, allegedly stolen from the Russian government.
- Date: 2025-08-19T07:25:42Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-Russian-Government-Mail-Addresses-Database).
- Screenshots:
- Threat Actors: elnurdxb.
- Victim Country: Russia.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
18. BABAYO EROR SYSTEM targets the website of Akademi Tata Boga Bandung
- Category: Defacement.
- Content: The group claims to have defaced the website of Akademi Tata Boga Bandung.
- Date: 2025-08-19T07:07:30Z.
- Network: telegram.
- Published URL: (https://t.me/c/2706542927/383).
- Screenshots:
- Threat Actors: BABAYO EROR SYSTEM.
- Victim Country: Indonesia.
- Victim Industry: Education.
- Victim Organization: akademi tata boga bandung.
- Victim Site: spmi.atb-bandung.ac.id.
19. Alleged data breach of WaitWhatWeb
- Category: Data Breach.
- Content: The threat actor claims to be selling a database allegedly taken from WaitWhatWeb, a web development company based in Bandung, Indonesia. The actor states the leak contains 17,468 records (around 4.5 GB) exposing sensitive user account data. Compromised fields include usernames, hashed passwords, emails, registration dates, activation keys, and display names. The post highlights several client websites impacted, including theikatindonesia.com, bigmo.id, myrubylicious.com, jagoankacamata.com, heykama.com, and capslock.id.
- Date: 2025-08-19T05:54:21Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-DATABASE-WaitWhatWeb-Data-Breached-Leaked-Download).
- Screenshots:
- Threat Actors: N1KA.
- Victim Country: Indonesia.
- Victim Industry: Information Technology (IT) Services.
- Victim Organization: waitwhatweb.
- Victim Site: waitwhatweb.com.
20. Alleged sale of RDWeb access to an unidentified Business Services in USA
- Category: Initial Access.
- Content: Threat actor claims to be selling RDWeb access to an unidentified business services company in the USA.
- Date: 2025-08-19T05:38:56Z.
- Network: openweb.
- Published URL: (https://forum.exploit.in/topic/264545/).
- Screenshots:
- Threat Actors: gadji.
- Victim Country: USA.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
21. Alleged leak of login access to DGA Digital ID
- Category: Initial Access.
- Content: A group claims to have leaked the login credentials from a portal operated by Thailand’s Digital Government Development Agency (DGA) that provides digital ID and e-government services.
- Date: 2025-08-19T04:55:15Z.
- Network: telegram.
- Published URL: (https://t.me/nxbbsec/2424).
- Screenshots:
- Threat Actors: NXBB.SEC.
- Victim Country: Thailand.
- Victim Industry: Government & Public Sector.
- Victim Organization: dga digital id.
- Victim Site: connect.egov.go.th.
22. Alleged data breach of Digo
- Category: Data Breach.
- Content: The threat actor claims to have leaked data from Digo SA, a company specializing in digital technology projects. The breach allegedly exposes 11,621 records containing personally identifiable information (PII) and employment-related data. Compromised fields include full names, email addresses, phone numbers, home addresses, job titles, business links (e.g., Behance, Google Drive), and uploaded CV/PDF files, along with timestamps.
- Date: 2025-08-19T03:59:03Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-DATABASE-DIGO-SA-Data-Breach-Leaked-Download).
- Screenshots:
- Threat Actors: N1KA.
- Victim Country: Saudi Arabia.
- Victim Industry: Marketing, Advertising & Sales.
- Victim Organization: digo.
- Victim Site: digo.sa.
23. Alleged unauthorized access to True Internet Co., Ltd.
- Category: Initial Access.
- Content: The group claims to have gained unauthorized access to True Internet Co., Ltd..
- Date: 2025-08-19T03:32:46Z.
- Network: telegram.
- Published URL: (https://t.me/nxbbsec/2423).
- Screenshots:
- Threat Actors: NXBB.SEC.
- Victim Country: Thailand.
- Victim Industry: Information Technology (IT) Services.
- Victim Organization: true internet co., ltd..
- Victim Site: trueinternet.co.th.
24. Alleged unauthorized access to Ubon Ratchathani Rajabhat University
- Category: Initial Access.
- Content: The group claims to have gained unauthorized access to Ubon Ratchathani Rajabhat University.
- Date: 2025-08-19T03:23:09Z.
- Network: telegram.
- Published URL: (https://t.me/nxbbsec/2420).
- Screenshots:
- Threat Actors: NXBB.SEC.
- Victim Country: Thailand.
- Victim Industry: Higher Education/Acadamia.
- Victim Organization: ubon ratchathani rajabhat university.
- Victim Site: ubru.ac.th.
25. Alleged leak of login access to Kids Plus
- Category: Initial Access.
- Content: The group claims to have leaked the login credentials belonging to Kids Plus.
- Date: 2025-08-19T03:15:33Z.
- Network: telegram.
- Published URL: (https://t.me/nxbbsec/2421).
- Screenshots:
- Threat Actors: NXBB.SEC.
- Victim Country: Thailand.
- Victim Industry: Education.
- Victim Organization: kids plus.
- Victim Site: member.kidsplus.co.th.
26. Alleged leak of admin access to unidentified financial company in china
- Category: Data Leak.
- Content: A threat actor is claiming to have gained admin-level access to the China Financial Services Admin Banking portal. According to the post, the access includes complete control over website functions, user accounts, system integrations, bank operations, and card approvals.
- Date: 2025-08-19T03:08:24Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-China-Financial-Services-Admin).
- Screenshots:
- Threat Actors: Sanguine.
- Victim Country: China.
- Victim Industry: Financial Services.
- Victim Organization: Unknown.
- Victim Site: Unknown.
27. Alleged leak of login access to Dhurakij Pundit University
- Category: Initial Access.
- Content: The group claims to have leaked the login credentials belonging to Student Life Cycle Management, a system used by Dhurakij Pundit University (DPU) in Thailand.
- Date: 2025-08-19T03:04:47Z.
- Network: telegram.
- Published URL: (https://t.me/nxbbsec/2419).
- Screenshots:
- Threat Actors: NXBB.SEC.
- Victim Country: Thailand.
- Victim Industry: Higher Education/Acadamia.
- Victim Organization: dhurakij pundit university.
- Victim Site: slcm.dpu.ac.th.
28. Alleged leak of Instagram Critical Glitch
- Category: Vulnerability.
- Content: The threat actor claims to have leaked a critical Instagram glitch exploit that allows takeover of any username, including numeric-only, restricted, or already-taken handles.
- Date: 2025-08-19T02:44:52Z.
- Network: openweb.
- Published URL: (https://darkforums.st/Thread-Document-Instagram-Critical-Glitch-%E2%80%93-Username-Takeover-Method-2025).
- Screenshots:
- Threat Actors: tomy.
- Victim Country: Unknown.
- Victim Industry: Unknown.
- Victim Organization: Unknown.
- Victim Site: Unknown.
29. Alleged leak of unauthorized access to Taiwan Saneast Enterprise, Inc.
- Category: Initial Access.
- Content: The group claims to have hacked and gained access to the supply and mixing control systems of Taiwan Saneast Enterprise, Inc., with full control over operational modes, flow settings, and alarms.
- Date: 2025-08-19T00:57:26Z.
- Network: telegram.
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/809).
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad.
- Victim Country: Australia.
- Victim Industry: Food & Beverages.
- Victim Organization: taiwan saneast enterprise, inc..
- Victim Site: saneast.com.tw.
Conclusion
The incidents detailed in this report highlight a diverse and active landscape of cyber threats. Data breaches and leaks are prominent, affecting various sectors from law enforcement and education to IT services and financial services, and impacting countries including the USA, Canada, Saudi Arabia, Germany, India, Uzbekistan, Belgium, Indonesia, and Thailand. The compromised data ranges from personal identifiable documents and email accounts to government records, internal system credentials, and customer databases.
Beyond data compromise, the report also reveals significant activity in initial access sales, with threat actors offering unauthorized access to corporate networks (including RDWeb access to a US firm), and government and educational infrastructure. The sale of malware and exploits, including a WordPress exploit and a Telegram bot for searching leaked credentials, further underscores the availability of offensive capabilities in the cyber underground.
The incidents collectively demonstrate that organizations across various industries and geographies face persistent threats from data exfiltration, unauthorized network access, and the proliferation of malicious tools. The nature of these incidents emphasizes the critical importance of robust cybersecurity measures, including strong access controls, data protection strategies, continuous vulnerability management, and proactive threat intelligence to defend against a wide array of sophisticated and opportunistic attacks.