[August-26-2025] Daily Cybersecurity Threat Report

Posted on

This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.

  1. Alleged data leak of Xtudia
  • Category: Data Breach
  • Content: The threat actor claims to have leaked a database from Xtudia, containing approximately 1 million records. The leaked data include crud users with sensitive fields like usernames, hashed passwords, emails, user roles, and access settings, as well as crud histories capturing user activity logs with actions, timestamps, and modified data.
  • Date: 2025-08-26T13:25:48Z
  • Network: openweb
  • Published URL: https://darkforums.st/Thread-DATABASE-DO-XTUDIA-SRL-COMPANY-1-MILLION-DATA
  • Screenshots:
  • Threat Actors: MrAxSiKucingHitam
  • Victim Country: Dominican Republic
  • Victim Industry: Information Technology (IT) Services
  • Victim Organization: xtudia
  • Victim Site: xtudia.com
  1. Alleged Sale of Hong Kong Citizen Phone Number and Email Database
  1. Alleged leak of Germany’s high income data
  1. Alleged Sale of High-Income Individuals Database in India
  1. Alleged Access Sale Chinese Business Services
  • Category: Initial Access
  • Content: The threat actor claims to be selling FortiVPN access valued at $430 million to a company in China’s business services sector, which also provides custom software and IT services. The actor states that the compromised environment includes 385 hosts.
  • Date: 2025-08-26T13:06:27Z
  • Network: openweb
  • Published URL: https://forum.exploit.in/topic/264996/
  • Screenshots:
  • Threat Actors: SantaAd
  • Victim Country: China
  • Victim Industry: Information Technology (IT) Services
  • Victim Organization: Unknown
  • Victim Site: Unknown
  1. Alleged Sale of U.S. Credit Cards Data from Sniffer Logs
  • Category: Data Leak
  • Content: The threat actor claims to be selling a set of 570 U.S.-based credit card records obtained from sniffer logs, with a validity rate of over 90%. The dataset reportedly includes sensitive information such as card number, expiration date, CVV, cardholder name, address, city, state, ZIP code, phone, and email.
  • Date: 2025-08-26T13:03:16Z
  • Network: openweb
  • Published URL: https://forum.exploit.in/topic/264993/
  • Screenshots:
  • Threat Actors: infamous
  • Victim Country: USA
  • Victim Industry: Financial Services
  • Victim Organization: Unknown
  • Victim Site: Unknown
  1. Alleged Sale of Indian Dairy Sector Access
  • Category: Initial Access
  • Content: The threat actor claims to be selling access valued at $35 million belonging to a company in India’s dairy sector, which produces milk and milk-based food products. The actor states that the compromised infrastructure includes 520 hosts.
  • Date: 2025-08-26T13:00:24Z
  • Network: openweb
  • Published URL: https://forum.exploit.in/topic/264988/
  • Screenshots:
  • Threat Actors: SantaAd
  • Victim Country: India
  • Victim Industry: Dairy
  • Victim Organization: Unknown
  • Victim Site: Unknown
  1. Alleged data leak of Camilla Borges Courses and Educational Activities Ltd
  1. Alleged data leak of Garena Free Fire
  1. Alleged data breach of Sika Footwear A / S
  1. Alleged data breach of Motor Controls, Inc.
  1. Alleged data breach of Springs Christian Academy
  1. Alleged data breach of SNEG Propreté
  1. Alleged data leak of West Manggarai Regency
  1. Alleged Access to Unidentified Thermal Power Plant in Romania
  1. Z-ALLIANCE targets the website of ugodaplus.com.ua
  1. Alleged data leak of Shiran Tours (Netanya) Ltd
  1. Alleged data leak of Grupo Hasar
  • Category: Data Breach
  • Content: The threat actor claims to have leaked a database of Grupo Hasar. The leak reportedly includes 2,690 rows of lead data, compromising sensitive information such as full names, last names, dates, message subjects, mobile and work phone numbers, emails, roles, company and industry information, websites, products and services, addresses (street, city, country, ZIP), fax numbers, user agents, IPs, form and audit logs.
  • Date: 2025-08-26T10:44:36Z
  • Network: openweb
  • Published URL: https://darkforums.st/Thread-DATABASE-Grupo-Hasar-Data-Breach-Leaked-Download
  • Screenshots:
  • Threat Actors: N1KA
  • Victim Country: Argentina
  • Victim Industry: Information Technology (IT) Services
  • Victim Organization: grupo hasar
  • Victim Site: grupohasar.com
  1. Alleged Sale of NATO Network Access
  1. Alleged Sale of Access to Mexican Holding Company Systems
  • Category: Initial Access
  • Content: The threat actor claims to be selling unauthorized access to systems in Mexico belonging to a major holding company. The listing specifies that the targeted organization operates in the energy and food industries. The actor states that access covers 282 hosts.
  • Date: 2025-08-26T10:31:05Z
  • Network: openweb
  • Published URL: https://forum.exploit.in/topic/264985/
  • Screenshots:
  • Threat Actors: SantaAd
  • Victim Country: Mexico
  • Victim Industry: Energy & Utilities
  • Victim Organization: Unknown
  • Victim Site: Unknown
  1. Alleged data leak of SMA Negeri 5 Surabaya
  1. Alleged data leak of an Unidentified Turkish Illegal Drugstore
  1. Alleged data leak of People Matters S.L
  1. Alleged data leak of Indonesian Non-ASN PPPK applicants
  1. Alleged data leak of Aristotle University of Thessaloniki
  1. Alleged Sale of U.S. Credit Card Records with AVS Data
  • Category: Data Leak
  • Content: The threat actor claims to be selling 13,500 U.S. credit card records, including card numbers, expiration dates, holder names, and full billing details (address, city, state, ZIP). The actor states that over 60% of the dataset contains AVS (Address Verification System) data, with an advertised valid rate of 30%.
  • Date: 2025-08-26T07:33:06Z
  • Network: openweb
  • Published URL: https://forum.exploit.in/topic/264976/
  • Screenshots:
  • Threat Actors: cashmoneycard
  • Victim Country: USA
  • Victim Industry: Financial Services
  • Victim Organization: Unknown
  • Victim Site: Unknown
  1. Alleged data leak of Department of Public Works and Highways (DPWH)
  1. Alleged Sale of Redline Stealer 2025 Malware Kit
  1. Alleged sale of Silent ETH Miner malware
  1. Alleged sale of AdBot Android Spying
  1. Alleged data breach of Ministry of Public Health of Ecuador
  1. Alleged data breach of Ferplast World
  • Category: Data Breach
  • Content: The threat actor claims to be selling database of Ferplast (ferplast.co.uk), a UK-based company that produces and sells pet products and accessories online. The leaked database includes sensitive customer information such as names, emails, phone numbers, physical addresses, account credentials (hashed/salted passwords), and membership details. The breach exposes data from over 11,000 customers and 13,000 addresses.
  • Date: 2025-08-26T04:44:00Z
  • Network: openweb
  • Published URL: https://darkforums.st/Thread-DATABASE-Ferplast-%C2%A0ferplast-co-uk-Breach-Leaked-Download
  • Screenshots:
  • Threat Actors: N1KA
  • Victim Country: UK
  • Victim Industry: E-commerce & Online Stores
  • Victim Organization: ferplast world
  • Victim Site: ferplast.co.uk
  1. Alleged leak of multiple Chinese databases
  1. Alleged data breach of Arca
  1. Alleged sale of compromised government related social media account.
  1. Alleged data breach of Alcàsser Employment Portal
  • Category: Data Breach
  • Content: The threat actor claims to be selling the database of the Alcàsser Employment Portal, an official job portal run by the City Council of Alcàsser, a municipality in Valencia, Spain. The listing claims to include data of citizens registered on the portal, information on companies posting vacancies, and details of city council workers. Exposed fields include full names, ID numbers, email addresses, registration dates, and worker emails from the council.
  • Date: 2025-08-26T04:10:12Z
  • Network: openweb
  • Published URL: https://darkforums.st/Thread-Selling-SPAIN-Portal-Empleo-Alcasser
  • Screenshots:
  • Threat Actors: scripts
  • Victim Country: Spain
  • Victim Industry: Government Administration
  • Victim Organization: alcàsser employment portal
  • Victim Site: portalemp.alcasser.es
  1. Alleged data breach of Town of Vienna, VA Government
  1. Alleged data breach of Anand Agricultural University
  • Category: Data Breach
  • Content: The threat actor claims to have leaked a massive dataset allegedly containing the personal and employment records of employees at Anand Agricultural University (AAU), India. The breach reportedly involves 1.245 million records from the institution’s internal system, exposing highly sensitive details such as employee names, family details, birth dates, marital status, designations, salary structures, banking information, PAN numbers, contact information (emails, phone numbers), and employment history.
  • Date: 2025-08-26T01:25:02Z
  • Network: openweb
  • Published URL: https://darkforums.st/Thread-Source-Code-DATA-OF-INDIAN-AAU-EMPLOYEES-1245-MILLION
  • Screenshots:
  • Threat Actors: RXY
  • Victim Country: India
  • Victim Industry: Education
  • Victim Organization: anand agricultural university, anand
  • Victim Site: aau.in
  1. Alleged sale of custom-built malware
  1. Alleged sale of crypto seed phrases database
  1. Alleged data breach of Floricultura Silva
  1. Alleged leak of credentials to Karachi American School teacher’s portal account
  1. Alleged sale of unauthorized access to Özel Halk Otobüsü Bilgi Sistemi

Conclusion The incidents detailed in this report highlight a diverse and active landscape of cyber threats. Data breaches and leaks are prominent, affecting various sectors from education, government, and financial services to manufacturing and retail, and impacting countries including the Dominican Republic, China, Germany, India, USA, Brazil, Denmark, France, Indonesia, Romania, Ukraine, Israel, Argentina, Belgium, Mexico, Philippines, Spain, Turkey, and Pakistan. The compromised data ranges from personal user information, credit card records, and sensitive government documents to large customer databases and intellectual property.

Beyond data compromise, the report also reveals significant activity in initial access sales, with threat actors offering unauthorized access to systems in various industries, including government administration, IT services, and energy. The sale of malware, including various Trojans and spyware, further underscores the availability of offensive capabilities in the cyber underground.

The incidents collectively demonstrate that organizations across various industries and geographies face persistent threats from data exfiltration, unauthorized network access, and the proliferation of malicious tools. The nature of these incidents emphasizes the critical importance of robust cybersecurity measures, including strong access controls, data protection strategies, continuous vulnerability management, and proactive threat intelligence to defend against a wide array of sophisticated and opportunistic attacks.

Related Posts