[December-14-2025] Daily Cybersecurity Threat Report

This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.

1. Alleged sale of Nashua Botswana internal database

Category: Data Breach
Content: Threat actor claims to be selling internal database of Nashua Botswana containing 21.5GB of sensitive data. The compromised data reportedly contains 2021–2023 reports and job cards, some files updated up to 2025, internet user lists, complete details of registered users, active/inactive, with address and account status.
Date: 2025-12-14T23:35:02Z
Network: openweb
Published URL: https://forum.exploit.in/topic/272071/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/2c7da714-47c8-44f3-8631-3b4b9a7eaef3.png https://d34iuop8pidsy8.cloudfront.net/1a953d03-6229-4a03-8efc-c0dfd464adf7.png
Threat Actors: zestix
Victim Country: Botswana
Victim Industry: Network & Telecommunications
Victim Organization: nashua botswana
Victim Site: ncbw.co.bw

2. Alleged sale of fraudulent or illegal U.S. tax documents (1099 & W-2 Forms)

Category: Data Breach
Content: Threat actor claims to be selling U.S. tax documents (1099 and W-2 forms), which contain highly sensitive personal and financial information.
Date: 2025-12-14T23:08:19Z
Network: openweb
Published URL: https://forum.exploit.biz/topic/272070/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/a8648a6c-97b5-4734-b620-348044f39673.png https://d34iuop8pidsy8.cloudfront.net/3fec0bfc-89b7-4baa-9073-4b890a51afc2.png
Threat Actors: SinCity
Victim Country: USA
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

3. Alleged leak of confidential files related to Jeffrey Epstein

Category: Data Breach
Content: The group claims to have leaked a 121 GB archive containing documents, emails, and recordings tied to Jeffrey Epstein, including FBI files, court documents, and leaked communications.
Date: 2025-12-14T22:34:28Z
Network: telegram
Published URL: https://t.me/talkaboutclassifieddocuments/21729 Screenshots: https://d34iuop8pidsy8.cloudfront.net/5001b84f-262c-48c9-9269-e23d81b2b3a8.png
Threat Actors: jrintel
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

4. Alleged data breach of Australian Real Estate Sector

Category: Data Breach
Content: The threat actor claims to have obtained a dataset allegedly associated with the Australian Real Estate sector. The exposed data reportedly includes homeowner and property-related personal information such as full names, gender, email addresses, phone numbers, dates of birth, and residential address details (street, city, state, and ZIP/postcode).
Date: 2025-12-14T22:26:08Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-%F0%9F%87%A6%F0%9F%87%BA-Australia-Real-Estate-Association-Homeowners-1-200-000 Screenshots: https://d34iuop8pidsy8.cloudfront.net/2e96253d-8bd2-4b69-9f78-8853f16d84c3.png
Threat Actors: Koshyrman
Victim Country: Australia
Victim Industry: Real Estate
Victim Organization: australian real estate sector
Victim Site: aocm.com.au

5. Kier + Wright falls victim to Qilin Ransomware

Category: Ransomware
Content: The group claims to have obtained 1.2 TB of organization’s internal data.
Date: 2025-12-14T22:22:44Z
Network: tor
Published URL: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=f518e52a-bd2a-3272-a165-fb384a2c8b34 Screenshots: https://d34iuop8pidsy8.cloudfront.net/eeff6d1f-5c3f-4c9a-af51-3cb7670a0dc4.png
Threat Actors: Qilin
Victim Country: USA
Victim Industry: Civil Engineering
Victim Organization: kier + wright
Victim Site: kierwright.com

6. Alleged leak of West Java Civil Servant Database

Category: Data Breach
Content: The group claims to have leaked a database containing personal and employment records of government employees in West Java, Indonesia. The dataset reportedly includes around 37,350 individual entries, exposing sensitive details such as names, places and dates of birth, employee ID numbers (NIP), work units and departments, ranks and job titles, employment status and tenure, as well as personal identifiers including gender, religion, marital status, education history, national ID, tax ID, insurance numbers, home addresses, phone numbers, and email contacts.
Date: 2025-12-14T22:20:54Z
Network: telegram
Published URL: https://t.me/c/3487552490/96 Screenshots: https://d34iuop8pidsy8.cloudfront.net/cce5e4f5-37bf-40fb-b73a-3aa6f1b085bd.png
Threat Actors: BABAYO EROR SYSTEM
Victim Country: Indonesia
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

7. Alleged data breach of American Century Investments

Category: Data Breach
Content: The threat actor claims to have obtained a dataset allegedly linked to American Century Investments. The exposed data reportedly includes investor and client-related information such as first and last names, investment details, mutual fund data, ratings, addresses, contact numbers, gender, birth year, and dealer-related information.
Date: 2025-12-14T22:20:36Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-USA-American-Century-Investments-Investment-in-Stocks-Funds-Bonds-2-1-million Screenshots: https://d34iuop8pidsy8.cloudfront.net/31656ea0-2355-4981-b0a7-167f70698c16.png
Threat Actors: Koshyrman
Victim Country: USA
Victim Industry: Financial Services
Victim Organization: american century investments
Victim Site: americancentury.com

8. Alleged Sale of Unauthorized Shell and Admin Access to OpenCart Shops Across Multiple Countries

Category: Initial Access
Content: Threat actor claims to be selling unauthorized shell and admin access to multiple OpenCart shops operating across countries such as Canada, Australia, United States, Germany, and United Kingdom.
Date: 2025-12-14T22:16:21Z
Network: openweb
Published URL: https://forum.exploit.biz/topic/272066/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/6f247fad-b77a-4732-b80c-af9601897d12.png
Threat Actors: bondiana228
Victim Country: Canada
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

9. Alleged Leak of STEALER LOGS AND U.L.P

Category: Data Breach
Content: The threat actor claims to have leaked STEALER LOGS AND U.L.P.
Date: 2025-12-14T22:00:18Z
Network: openweb
Published URL: https://darkforums.hn/Thread-%E2%AD%90%E2%AD%90%E2%AD%90-STEALER-LOGS-AND-U-L-P-14-12-2025 Screenshots: https://d34iuop8pidsy8.cloudfront.net/3d6e39cb-2d51-4305-8e2f-abb92659d582.png
Threat Actors: watercloud
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

10. Alleged leak of of Social Assistance Recipient Data from Indonesia

Category: Data Breach
Content: The group claims to have leaked images and identification details of Bansos recipients in Juntikebon village, Indramayu. The post includes personal photographs and ID cards of Indonesian citizens.
Date: 2025-12-14T21:55:40Z
Network: telegram
Published URL: https://t.me/c/3487552490/70 Screenshots: https://d34iuop8pidsy8.cloudfront.net/f7248d07-6033-476b-b040-04b0ed914984.png https://d34iuop8pidsy8.cloudfront.net/0b93ac71-7bea-41b4-b017-f73a0ad39824.png https://d34iuop8pidsy8.cloudfront.net/b0700514-0b05-497e-9b33-34cfe82ad786.png
Threat Actors: BABAYO EROR SYSTEM
Victim Country: Indonesia
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

11. Alleged Sale of Unauthorized Admin Access to Media Conglomerate

Category: Initial Access
Content: A threat actor claims to be selling unauthorized admin access to an media conglomerate with reported revenues exceeding $810 million.The listing alleges access to five cloud storage buckets containing over 20 GB of internal documents.
Date: 2025-12-14T21:17:03Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-810m-Indian-Media-Conglomerate Screenshots: https://d34iuop8pidsy8.cloudfront.net/7088a746-eab1-44de-8996-49843174547b.png
Threat Actors: isellaccess
Victim Country: India
Victim Industry: Entertainment & Movie Production
Victim Organization: media conglomerate
Victim Site: Unknown

12. H3xV0id claims to target Eitaa Messenger

Category: Vulnerability
Content: A recent post by the group claims that they have exploited multiple zero‑day vulnerabilities to gain deep access to the platform’s core infrastructure.
Date: 2025-12-14T21:14:59Z
Network: telegram
Published URL: https://t.me/H3xV0id_Official/382 Screenshots: https://d34iuop8pidsy8.cloudfront.net/5502ca71-16b0-4c9c-9b25-8cd395b9a17d.png
Threat Actors: H3xV0id
Victim Country: Iran
Victim Industry: Social Media & Online Social Networking
Victim Organization: eitaa
Victim Site: eitaa.com

13. Cyb3r Drag0nz claims to target Channel 8

Category: Alert
Content: A recent post by the group claims that they’ve taken down both live television and radio broadcasts of Channel 8.
Date: 2025-12-14T20:47:12Z
Network: telegram
Published URL: https://t.me/c/2508606000/133 Screenshots: https://d34iuop8pidsy8.cloudfront.net/4076dc8b-6f2f-431e-86ee-b73c8e5e49cd.png https://d34iuop8pidsy8.cloudfront.net/034a6fe5-6c37-4052-9787-981b3b107f2a.png https://d34iuop8pidsy8.cloudfront.net/eb8700e5-1171-4a84-be10-4cafa16443b1.png
Threat Actors: Cyb3r Drag0nz
Victim Country: Iraq
Victim Industry: Media Production
Victim Organization: channel 8
Victim Site: channel8.com

14. Alleged unauthorized access to Iran’s Shad system

Category: Alert
Content: A recent post by the group claims that they have gained full access to Shad system, the central infrastructure supporting millions of students and teachers across Iran.
Date: 2025-12-14T20:25:57Z
Network: telegram
Published URL: https://t.me/H3xV0id_Official/374 Screenshots: https://d34iuop8pidsy8.cloudfront.net/2abae921-0e21-4f9a-936e-8ed219784aa5.png
Threat Actors: H3xV0id
Victim Country: Iran
Victim Industry: Education
Victim Organization: shad
Victim Site: shad.ir

15. AySA falls victim to SAFEPAY Ransomware

Category: Ransomware
Content: The group claims to obtained the organization’s data and they intend to publish it within 2-3 days.
Date: 2025-12-14T20:15:33Z
Network: tor
Published URL: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/aysacomar/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/4ddadd89-56da-4985-a6a9-32aca67f7c56.png
Threat Actors: SAFEPAY
Victim Country: Argentina
Victim Industry: Energy & Utilities
Victim Organization: aysa
Victim Site: aysa.com.ar

16. InTTrust S.A. falls victim to SAFEPAY Ransomware

Category: Ransomware
Content: The group claims to obtained the organization’s data and they intend to publish it within 2-3 days.
Date: 2025-12-14T20:10:56Z
Network: tor
Published URL: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/inttrustgr/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/88bc8c4f-1e32-4977-9b5e-e65bcee035d0.png
Threat Actors: SAFEPAY
Victim Country: Greece
Victim Industry: Information Technology (IT) Services
Victim Organization: inttrust s.a.
Victim Site: inttrust.gr

17. R.I. Lampus Company falls victim to SAFEPAY Ransomware

Category: Ransomware
Content: The group claims to obtained the organization’s data and they intend to publish it within 2-3 days.
Date: 2025-12-14T20:01:45Z
Network: tor
Published URL: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/lampuscom/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/6871cfd4-4654-4dd7-91c7-8a61dd60d1b2.png
Threat Actors: SAFEPAY
Victim Country: USA
Victim Industry: Building and construction
Victim Organization: r.i. lampus company
Victim Site: lampus.com

18. Teccart Institute falls victim to SAFEPAY Ransomware

Category: Ransomware
Content: The group claims to have obtained the organization’s internal data and intends to publish it within 2-3days.
Date: 2025-12-14T19:55:33Z
Network: tor
Published URL: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/teccartqcca/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/076c1994-0648-4023-bb3a-749208aab760.png
Threat Actors: SAFEPAY
Victim Country: Canada
Victim Industry: Education
Victim Organization: teccart institute
Victim Site: teccart.qc.ca

19. Alleged Sale of macOS Safari Password Stealing Exploit

Category: Malware
Content: Threat Actor claims to be selling a macOS exploit capable of extracting saved Safari browser passwords in cleartext. The exploit is advertised as compatible with macOS 15 through macOS 26 and reportedly outputs credentials, URLs, and login data into a CSV file. The actor states the exploit can be stealthily executed on a victim’s device and integrated into stealer malware, posing a significant risk of credential theft within the Apple ecosystem.
Date: 2025-12-14T19:53:48Z
Network: openweb
Published URL: https://forum.exploit.biz/topic/272060/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/f2502c0c-6a3b-447b-bfdc-a283a318696c.png
Threat Actors: notzull
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

20. Alleged Leak of Turkey Mini Advanced Phone Database

Category: Data Breach
Content: The threat actor claims to have sale a “Turkey Mini Advanced Phone Database” containing 12,872 records. The dataset allegedly includes first names, last names, email addresses, and mobile phone numbers, targeting the general public and university students in Turkey.
Date: 2025-12-14T19:51:10Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Turkey-Mini-Advanced-Phone-Database Screenshots: https://d34iuop8pidsy8.cloudfront.net/3c21df94-6449-43b4-a2a4-445ae4a982be.png
Threat Actors: phanes
Victim Country: Turkey
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

21. falls victim to SAFEPAY Ransomware

Category: Ransomware
Content: The group claims to have obtained the organization’s internal data and intends to publish it within 2-3 days.
Date: 2025-12-14T19:47:56Z
Network: tor
Published URL: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/sbwsorgsg/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/27ccd17b-cbc8-40dc-81b6-73f0d4eb053e.png
Threat Actors: SAFEPAY
Victim Country: Singapore
Victim Industry: Non-profit & Social Organizations
Victim Organization: singapore buddhist welfare services
Victim Site: sbws.org.sg

22. Alleged data breach of PlayTicket

Category: Data Breach
Content: The threat actor claims to have leaked a data from playticket. The dataset reportedly contains 64,114 records with 59,018 unique email addresses which includes personal and account-related information such as names, usernames, email addresses, IP addresses, dates of birth, phone numbers, addresses, login activity, and membership details.
Date: 2025-12-14T19:40:46Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-playticket-co-kr-210k Screenshots: https://d34iuop8pidsy8.cloudfront.net/36083e78-828e-4192-8215-d180b6385d06.png
Threat Actors: siege
Victim Country: South Korea
Victim Industry: Consumer Services
Victim Organization: playticket
Victim Site: playticket.co.kr.

23. Solo targets the website of Works4U

Category: Defacement
Content: The Group claims to have defaced the website of Works4U.
Date: 2025-12-14T19:40:34Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216796 Screenshots: https://d34iuop8pidsy8.cloudfront.net/3ebd821a-3ef3-4850-a361-37f5a5a4a05b.png
Threat Actors: solo
Victim Country: India
Victim Industry: Professional Services
Victim Organization: works4u
Victim Site: works4u.in

24. VFM Systems and Services (P) Ltd falls victim to BlackShrantac Ransomware

Category: Ransomware
Content: The group claims to have obtained 70 GB of organization’s data. The data consist of Financial information, Customers information, Employee information and Internal Communication Database.
Date: 2025-12-14T19:40:23Z
Network: tor
Published URL: http://jvkpexgkuaw5toiph7fbgucycvnafaqmfvakymfh5pdxepvahw3xryqd.onion/targets/36 Screenshots: https://d34iuop8pidsy8.cloudfront.net/402be3ba-17f5-4ea1-a3b3-f19553270b5a.png https://d34iuop8pidsy8.cloudfront.net/b5b838d9-0199-49c2-833c-4915c2e09ad4.png https://d34iuop8pidsy8.cloudfront.net/fbfe671a-4f86-4193-b93e-b4ba4b5c7dd8.png https://d34iuop8pidsy8.cloudfront.net/c7f9d4ad-65c4-4a9e-85e8-151fafa1ec90.png
Threat Actors: BlackShrantac
Victim Country: India
Victim Industry: Information Technology (IT) Services
Victim Organization: vfm systems and services (p) ltd
Victim Site: vfmindia.biz

25. FEST GmbH falls victim to SAFEPAY Ransomware

Category: Ransomware
Content: The group claims to have obtained the organization’s internal data and intends to publish it within 2-3 days.
Date: 2025-12-14T19:40:07Z
Network: tor
Published URL: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/fest-groupde/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/9f4456d0-84aa-4098-a8db-a3220838e1a5.png
Threat Actors: SAFEPAY
Victim Country: Germany
Victim Industry: Manufacturing
Victim Organization: fest gmbh
Victim Site: fest-group.de

26. Solo targets the website of R.S. Sunshine Public School

Category: Defacement
Content: The Group claims to have defaced the website of R.S. Sunshine Public School.
Date: 2025-12-14T19:35:29Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216785 Screenshots: https://d34iuop8pidsy8.cloudfront.net/11264e90-2c99-49a2-aaab-b0b58b31b409.png
Threat Actors: solo
Victim Country: India
Victim Industry: Education
Victim Organization: r.s. sunshine public school
Victim Site: rssunshinepublicschool.in

27. Solo targets the website of Neeldeep Academy

Category: Defacement
Content: The Group claims to have defaced the website of Neeldeep Academy.
Date: 2025-12-14T19:31:51Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216777 Screenshots: https://d34iuop8pidsy8.cloudfront.net/87a0a538-6516-4d15-8f31-ca5048ec40cb.png
Threat Actors: solo
Victim Country: India
Victim Industry: Education
Victim Organization: neeldeep academy
Victim Site: p.acrevu.com

28. Solo targets the website of Abhyuday Public School

Category: Defacement
Content: The Group claims to have defaced the website of Abhyuday Public School.
Date: 2025-12-14T19:25:44Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216781 Screenshots: https://d34iuop8pidsy8.cloudfront.net/55fe37c3-1c82-4250-9927-c604b8a0ebe7.png
Threat Actors: solo
Victim Country: India
Victim Industry: Education
Victim Organization: abhyuday public school
Victim Site: rajgarh.apsgkp.com

29. Solo targets the website of Udgam School for Children

Category: Defacement
Content: The Group claims to have defaced the website of Udgam School for Children.
Date: 2025-12-14T19:21:08Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216795 Screenshots: https://d34iuop8pidsy8.cloudfront.net/a3002922-e4d9-4906-86b5-1d0b72f000fd.png
Threat Actors: solo
Victim Country: India
Victim Industry: Education
Victim Organization: udgam school for children
Victim Site: udgam.acrevu.com

30. AXXEL MARKETING falls victim to LOCKBIT 5.0 Ransomware

Category: Ransomware
Content: The group claims to have obtained the organization’s data and intends to publish it within 14-15 days.
Date: 2025-12-14T18:59:08Z
Network: tor
Published URL: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion/post/4b1bb59c782c5494b7250e9eeadb38c3 Screenshots: https://d34iuop8pidsy8.cloudfront.net/9b5eb2f7-be80-4057-bc14-14f0c7f71ab0.png
Threat Actors: LOCKBIT 5.0
Victim Country: Singapore
Victim Industry: Marketing, Advertising & Sales
Victim Organization: axxel marketing
Victim Site: axxel.biz

31. Alleged Sale of Unauthorized Admin Access to Canadian Finance Banking Organization

Category: Initial Access
Content: Threat actor claims to be selling unauthorized admin-level RDWeb access to a Canada-based finance banking organization with an estimated revenue of $7 million.. The access allegedly includes domain controller privileges and exposure of approximately 3 TB of sensitive data, including backups, billing, and tax-related information.
Date: 2025-12-14T18:55:03Z
Network: openweb
Published URL: https://forum.exploit.biz/topic/272059/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/23a30224-fe00-4bf0-9283-713450c7c13d.png
Threat Actors: thugstage
Victim Country: Canada
Victim Industry: Banking & Mortgage
Victim Organization: Unknown
Victim Site: Unknown

32. Mega Alfalfa Argentina S.A. falls victim to LOCKBIT 5.0

Category: Ransomware
Content: The group claims to have obtained the organization’s data and intends to publish it within 14-15 days.
Date: 2025-12-14T18:49:21Z
Network: tor
Published URL: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion/post/8556c4702eba6de55e0d4f0885c1ccbd Screenshots: https://d34iuop8pidsy8.cloudfront.net/8d36a354-02ea-4ce5-875c-8b6a7e41b77a.png
Threat Actors: LOCKBIT 5.0
Victim Country: Argentina
Victim Industry: Agriculture & Farming
Victim Organization: mega alfalfa argentina s.a.
Victim Site: maasa.com.ar

33. Alleged Sale of Unauthorized Linux Server Access

Category: Initial Access
Content: Threat actor claims to be selling unauthorized access to 750 Linux servers, including 229 root-level and 521 user-level accounts.
Date: 2025-12-14T18:47:28Z
Network: openweb
Published URL: https://forum.exploit.biz/topic/272056/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/af2e643e-9797-4156-b867-1b53d4d431d3.png
Threat Actors: BuyChara
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

34. Alleged data breach of St. John Lee Korean Catholic Church

Category: Data Breach
Content: The group claims to have gained access and leaked internal data from St. John Lee Korean Catholic Church.
Date: 2025-12-14T18:40:29Z
Network: telegram
Published URL: https://t.me/c/2878397916/277 Screenshots: https://d34iuop8pidsy8.cloudfront.net/c6336ca9-6b38-4624-a0ab-88848ee51c72.png https://d34iuop8pidsy8.cloudfront.net/5c212070-abcd-4572-ba03-65a12ba6ba83.png
Threat Actors: Hider_Nex
Victim Country: USA
Victim Industry: Religious Institutions
Victim Organization: st. john lee korean catholic church
Victim Site: charlottekoreancatholic.org

35. Hider_Nex claims to target USA

Category: Alert
Content: A recent post by the group indicates that they’re targeting USA.
Date: 2025-12-14T18:09:06Z
Network: telegram
Published URL: https://t.me/c/2878397916/275 Screenshots: https://d34iuop8pidsy8.cloudfront.net/c7b94362-ee67-432a-87a0-e7e835687721.png
Threat Actors: Hider_Nex
Victim Country: USA
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

36. SYLHET GANG-SG claims to target Canada

Category: Alert
Content: A recent post by the group indicates that they’re targeting Canada.
Date: 2025-12-14T18:04:16Z
Network: telegram
Published URL: https://t.me/SylhetGangSG1/7179 Screenshots: https://d34iuop8pidsy8.cloudfront.net/4a32d798-8930-46cb-a354-912a7ea711ce.png
Threat Actors: SYLHET GANG-SG
Victim Country: Canada
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

37. Alleged Sale of Unauthorized phpMyAdmin Access to U.S Based Native Form Shops

Category: Initial Access
Content: Threat Actor claims to be selling unauthorized phpMyAdmin database access to a U.S. based custom CMS hosting multiple online shops, allowing checkout data modification and JavaScript injection that could lead to payment data compromise on sites using Authorize.Net Native Forms.
Date: 2025-12-14T17:19:15Z
Network: openweb
Published URL: https://forum.exploit.biz/topic/272054/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/cda2f2ca-2930-4013-ae18-a7b44c2a26dd.png
Threat Actors: rassvettt
Victim Country: USA
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

38. Alleged data breach of Bizbook

Category: Data Breach
Content: The threat actor claims to have leaked a data from Bizbook. which including full names, email addresses, job titles, phone and mobile numbers, postal codes, residential and mailing addresses, IP addresses, and other related contact details.
Date: 2025-12-14T17:08:06Z
Network: openweb
Published URL: https://darkforums.hn/Thread-DATABASE-%E2%AD%90%C2%A0-South-Korea-Database%C2%A0bizbook-co-kr%C2%A0%E2%AD%90 Screenshots: https://d34iuop8pidsy8.cloudfront.net/4be3fb9e-0b87-4c17-99ba-b494f1b5cfe0.png
Threat Actors: AshleyWood2022
Victim Country: South Korea
Victim Industry: Online Publishing
Victim Organization: bizbook
Victim Site: bizbook.co.kr

39. Alleged leak of login access to National Research Council of Thailand (NRCT)

Category: Initial Access
Content: The group claims to have gained login access to National Research Council of Thailand (NRCT)
Date: 2025-12-14T16:42:59Z
Network: telegram
Published URL: https://t.me/exados_khmer/150 Screenshots: https://d34iuop8pidsy8.cloudfront.net/383587f2-2a65-464f-abfc-1b3f62717b12.png
Threat Actors: EXADOS
Victim Country: Thailand
Victim Industry: Research Industry
Victim Organization: national research council of thailand (nrct)
Victim Site: dric.nrct.go.th

40. Alleged leak of administrator credential to Chai Si Noodle Dumpling Company Limited

Category: Initial Access
Content: The group claims to have leaked administrator login credential to Chai Si Noodle Dumpling Company Limited.
Date: 2025-12-14T16:25:04Z
Network: telegram
Published URL: https://t.me/exados_khmer/152 Screenshots: https://d34iuop8pidsy8.cloudfront.net/8b5926ea-459f-4827-939d-142ef5749d49.png
Threat Actors: EXADOS
Victim Country: Thailand
Victim Industry: Food & Beverages
Victim Organization: chai si noodle dumpling company limited
Victim Site: chaixi.co.th

41. Pharaoh’s Team Channel targets Abhishek’s E-Commerce Website

Category: Defacement
Content: The group claims to have defaced Abhishek’s E-Commerce Website
Date: 2025-12-14T15:21:59Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/472 Screenshots: https://d34iuop8pidsy8.cloudfront.net/de42c43c-79bd-47ff-bea0-a185f5d03415.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Unknown
Victim Industry: E-commerce & Online Stores
Victim Organization: Unknown
Victim Site: [suspicious link removed]

42. Alleged leak of web shell access to All Smart

Category: Initial Access
Content: The group claims to have gained unauthorized web shell access to All Smart and intends to publish it sooner.
Date: 2025-12-14T15:01:56Z
Network: telegram
Published URL: https://t.me/c/2552217515/179 Screenshots: https://d34iuop8pidsy8.cloudfront.net/90caf0dd-3595-4890-a8f5-0594ac43b797.png
Threat Actors: Z-SH4DOWSPEECH
Victim Country: Indonesia
Victim Industry: Unknown
Victim Organization: all smart
Victim Site: admin.allsmart.id

43. Alleged data leak of REVSCENENET

Category: Data Breach
Content: The threat actor claims to have leaked 110,000 users records from REVSCENENET. The compromised data reportedly includes email addresses, IP addresses, hashed passwords, and usernames.
Date: 2025-12-14T14:37:44Z
Network: openweb
Published URL: https://darkforums.hn/Thread-DATABASE-Revscene-net-110k-2025-Databse-Leaked-Download Screenshots: https://d34iuop8pidsy8.cloudfront.net/c184bc4f-ce00-4688-9331-369dd79169e2.png
Threat Actors: darkso
Victim Country: Canada
Victim Industry: Industrial Automation
Victim Organization: revscenenet
Victim Site: revscene.net

44. Pharaoh’s Team Channel targets the website of Ganpatram Dulichand Soni

Category: Defacement
Content: The group claims to have defaced the website of Ganpatram Dulichand Soni
Date: 2025-12-14T14:17:11Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/471 Screenshots: https://d34iuop8pidsy8.cloudfront.net/7dcd0838-136c-4295-9858-400ceec9214d.JPG
Threat Actors: Pharaoh’s Team Channel
Victim Country: India
Victim Industry: Luxury Goods & Jewelry
Victim Organization: ganpatram dulichand soni
Victim Site: ganpatraydulichandsoni.com

45. Pharaoh’s Team Channel targets the website of The legacy silver

Category: Defacement
Content: The group claims to have defaced the website of The legacy silver.
Date: 2025-12-14T14:10:09Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/471 Screenshots: https://d34iuop8pidsy8.cloudfront.net/1b0a8773-87de-4e3c-b434-96db06952315.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: India
Victim Industry: Luxury Goods & Jewelry
Victim Organization: the legacy silver
Victim Site: thelegacysilver.com

46. Alleged data breach of Wavenet

Category: Data Breach
Content: Group claims to have obtained organization’s data and intent to publish it within 1-2 days.
Date: 2025-12-14T14:00:03Z
Network: tor
Published URL: https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies/5982962779/overview Screenshots: https://d34iuop8pidsy8.cloudfront.net/e8ec2c03-21b4-4d72-8466-a44f9534f9fe.jpg https://d34iuop8pidsy8.cloudfront.net/8d4470b4-987e-475b-a394-70ad26344394.jpg
Threat Actors: Worldleaks
Victim Country: UK
Victim Industry: Information Technology (IT) Services
Victim Organization: wavenet
Victim Site: wavenet.co.uk

47. Alleged unauthorized access to R. STAHL TRANBERG

Category: Initial Access
Content: The group claims to have gained unauthorized access to R. STAHL TRANBERG in Norway. The claimed that they have control over electric heating loops, liquids in pipelines and critical equipment, automatic system, monitoring and many more.
Date: 2025-12-14T13:43:14Z
Network: telegram
Published URL: https://t.me/n2LP_wVf79c2YzM0/2875 Screenshots: https://d34iuop8pidsy8.cloudfront.net/74ea9fab-501f-4946-996f-e70578f9f940.jpg https://d34iuop8pidsy8.cloudfront.net/772b6d8a-e61b-4805-8a68-c735e80b2cb5.jpg
Threat Actors: Infrastructure Destruction Squad
Victim Country: Norway
Victim Industry: Electrical & Electronic Manufacturing
Victim Organization: r. stahl tranberg
Victim Site: stahl-tranberg.com

48. Alleged sale of china citienz’s data

Category: Data Breach
Content: A threat actor claims to be selling over 50 million lines of data of Chinese Citienz’s . The compromised data includes names, phone numbers, addresses, postal codes, and ID numbers.
Date: 2025-12-14T13:37:13Z
Network: openweb
Published URL: https://xss.pro/threads/144804/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/b038156e-1746-4f63-9704-d109e3cfb131.png https://d34iuop8pidsy8.cloudfront.net/264c14d7-4edc-47d1-9fba-fb7cb5b2bcfd.png
Threat Actors: Kraxs
Victim Country: China
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

49. Alleged data sale of SpaceX

Category: Data Breach
Content: The threat actor claims to have leaked restricted SpaceX blueprints.
Date: 2025-12-14T12:56:28Z
Network: openweb
Published URL: https://xss.pro/threads/144807/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/dc8a2c1f-93ae-4057-9310-e1b94f4ad3d0.png
Threat Actors: Kraxs
Victim Country: USA
Victim Industry: Airlines & Aviation
Victim Organization: spacex
Victim Site: spacex.com

50. KKG-Z targets the website of PPD Builder Co., Ltd

Category: Defacement
Content: The group claims to have defaced the website of PPD Builder Co., Ltd.
Date: 2025-12-14T12:07:51Z
Network: telegram
Published URL: https://t.me/kkg_z/535 Screenshots: https://d34iuop8pidsy8.cloudfront.net/7e2ba781-1537-4023-a393-5a851e396022.png
Threat Actors: KKG-Z
Victim Country: Thailand
Victim Industry: Building and construction
Victim Organization: ppd builder co., ltd.
Victim Site: ppdbuilder.co.th

51. Alleged leak of login credentials from ssk.in.th

Category: Initial Access
Content: The group claims to have leaked the login credentials of ssk.in.th
Date: 2025-12-14T12:01:21Z
Network: telegram
Published URL: https://t.me/kkg_z/533 Screenshots: https://d34iuop8pidsy8.cloudfront.net/a79e4405-3f36-466d-b3ec-a7d7dbfd229f.jpg https://d34iuop8pidsy8.cloudfront.net/bec79521-fb1f-4509-b6ba-3e0d28f7dbdf.jpg https://d34iuop8pidsy8.cloudfront.net/7efb4007-4bcd-4ff5-b3bc-91d32f9044a3.jpg https://d34iuop8pidsy8.cloudfront.net/9a0ad9d5-f4a8-47f1-8bd6-87d641c2e1b8.jpg
Threat Actors: KKG-Z
Victim Country: Thailand
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: sqli.ssk.in.th

52. Alleged data sale of TipTop Transport Solutions Pty Ltd.

Category: Data Breach
Content: The threat actor claims to be selling 1.39 GB of data from TipTop Transport Solutions Pty Ltd.
Date: 2025-12-14T11:22:43Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Australian-ride-hailing-website-site-https-tiptopride-com-au-data-size-1-39Go Screenshots: https://d34iuop8pidsy8.cloudfront.net/2f84bd8c-8fb8-456c-856f-d5bbf5b1c039.png
Threat Actors: Lehackerrusse
Victim Country: Australia
Victim Industry: Transportation & Logistics
Victim Organization: tiptop transport solutions pty ltd
Victim Site: tiptopride.com.au

53. Alleged data sale of Center for Advanced Eye Care

Category: Data Breach
Content: The threat actor claims to be selling data from the Center for Advanced Eye Care, allegedly containing ID, number, name, sex, date of birth, location, and more.
Date: 2025-12-14T11:15:45Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Eye-Care-company-https-www-centerforeyes-com-DB-avilablr Screenshots: https://d34iuop8pidsy8.cloudfront.net/36371246-4693-464a-bab8-74b54ebc796b.png
Threat Actors: Frenshyny
Victim Country: USA
Victim Industry: Hospital & Health Care
Victim Organization: center for advanced eye care
Victim Site: centerforeyes.com

54. Alleged data sale of Robinhood

Category: Data Breach
Content: The threat actor claims to be selling 5 million records of data from Robinhood . The compromised data reportedly includes user IDs, names, email addresses, phone numbers, addresses, and more.
Date: 2025-12-14T11:14:40Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-PREMIUM-EXCLUSIVE-Robinhood-Crypto-October-2025-Database-Leak-5M-Record-CCs-KYC Screenshots: https://d34iuop8pidsy8.cloudfront.net/9e45da6f-5b9d-4df3-9c3a-be0f46bfa758.png https://d34iuop8pidsy8.cloudfront.net/b690bbb2-b725-49a7-8353-0a1a39b087d1.png
Threat Actors: Breachdatabase
Victim Country: USA
Victim Industry: Financial Services
Victim Organization: robinhood
Victim Site: robinhood.com

55. Alleged sale of Android 16 0-day exploit

Category: Vulnerability
Content: The threat actor claims to be selling an Android 16 exploit targeting versions 12-16, exploiting a memory corruption bug on ARM (32/64-bit) devices. It enables remote code execution, full privilege escalation (root access), and sandbox escape.
Date: 2025-12-14T11:10:27Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-0day-Android-16-Exploit-Exploit-Chain-Selling Screenshots: https://d34iuop8pidsy8.cloudfront.net/ced23d9b-1946-4a25-8c0a-31ebd5ef36ff.png
Threat Actors: ResearcherX
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

56. XmrAnonye.id targets the website of Smk Ma’arif Kota Magelang

Category: Defacement
Content: The group claims to have defaced the website of Smk Ma’arif Kota Magelang
Date: 2025-12-14T11:03:35Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216721 Screenshots: https://d34iuop8pidsy8.cloudfront.net/5d3436d4-d436-4f34-b1d2-c97a0f4d387c.JPG
Threat Actors: XmrAnonye.id
Victim Country: Indonesia
Victim Industry: Unknown
Victim Organization: smk ma’arif kota magelang
Victim Site: kelulusanew.smkmaarifkotamgl.sch.id

57. Alleged leak of login credentials from PSDD Royal Irrigation Department in Thailand

Category: Initial Access
Content: The group claims to have leaked the login credentials of PSDD Royal Irrigation Department
Date: 2025-12-14T10:15:51Z
Network: telegram
Published URL: https://t.me/black_bulletttt/659 Screenshots: https://d34iuop8pidsy8.cloudfront.net/23ed7f83-d4cf-41f9-970a-1334c8a61e0d.jpg
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Government Administration
Victim Organization: psdd royal irrigation department
Victim Site: psdd.rid.go.th

58. Alleged data sale of Muchacomida

Category: Data Breach
Content: The threat actor claims to be selling 6.4 MB of data from Muchacomida, allegedly containing 52,082 names, 45,637 phone numbers, and 52,082 emails.
Date: 2025-12-14T10:03:18Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Spain-52k-Name-Phone-Email-muchacomida-com Screenshots: https://d34iuop8pidsy8.cloudfront.net/dc4e4025-2b18-4b09-a9c0-cd7b9d5953d7.png https://d34iuop8pidsy8.cloudfront.net/9016680d-5086-4738-9c9d-a8dde8cd0309.png
Threat Actors: AgSlowly
Victim Country: Spain
Victim Industry: Food & Beverages
Victim Organization: muchacomida
Victim Site: muchacomida.com

59. JABAR ERROR SYSTEM targets the website of Bahasa Inggris Net

Category: Defacement
Content: The group claims to have defaced the website of Bahasa Inggris Net
Date: 2025-12-14T09:58:03Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216720 Screenshots: https://d34iuop8pidsy8.cloudfront.net/c14edc51-e5a5-456f-9aa3-984f6ff66279.JPG
Threat Actors: JABAR ERROR SYSTEM
Victim Country: Indonesia
Victim Industry: Education
Victim Organization: bahasa inggris net
Victim Site: bahasainggris.ac.id

60. Alleged leak of login credentials from Highway Registry Information System (HRIS)

Category: Initial Access
Content: The group claims to have leaked the login credentials of Highway Registry Information System (HRIS).
Date: 2025-12-14T09:38:06Z
Network: telegram
Published URL: https://t.me/black_bulletttt/658 Screenshots: https://d34iuop8pidsy8.cloudfront.net/f74584ac-5db6-48a9-91a7-93bbaa9cc7fd.png
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Government Administration
Victim Organization: department of highways
Victim Site: hris.doh.go.th

61. 404 CREW CYBER TEAM targets the website of Estilo Plus

Category: Defacement
Content: The group claims to have defaced the website of Estilo Plus
Date: 2025-12-14T09:32:36Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216718 Screenshots: https://d34iuop8pidsy8.cloudfront.net/1d9a7094-53d2-42ab-82f7-72d6651da377.JPG
Threat Actors: 404 CREW CYBER TEAM
Victim Country: Argentina
Victim Industry: Hospitality & Tourism
Victim Organization: estilo plus
Victim Site: estiloplus.tur.ar

62. Alleged data leak of US Department of Defense

Category: Data Breach
Content: The threat actor claims to have leaked data from the U.S. Department of Defense, affecting a large number of Department of Defense employees.
Date: 2025-12-14T09:17:21Z
Network: openweb
Published URL: https://darkforums.hn/Thread-delta-force-master-USA Screenshots: https://d34iuop8pidsy8.cloudfront.net/be3170a4-d7ed-43fb-93bd-1bf54a2271a0.jpg
Threat Actors: Fox_con
Victim Country: USA
Victim Industry: Government Administration
Victim Organization: us department of defense
Victim Site: defense.gov

63. BontenSec targets the website of Matrix of Rap

Category: Defacement
Content: The group claims to have defaced the website of Matrix of Rap

matrixofrap.com MIRROR : https://defacer.id/mirror/id/216716

https://www.google.com/search?q=admin.matrixofrap.com MIRROR : https://defacer.id/mirror/id/216717

Date: 2025-12-14T08:40:55Z
Network: openweb
Published URL: https://defacer.id/archive Screenshots: https://d34iuop8pidsy8.cloudfront.net/9e501b58-aaab-4880-99ed-6d6a8ca718e5.JPG https://d34iuop8pidsy8.cloudfront.net/8b263031-eb80-41ab-84fe-d6e9a73e9605.JPG
Threat Actors: BontenSec
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: matrix of rap
Victim Site: matrixofrap.com

64. 911Team targets the website of SHIMA

Category: Defacement
Content: The group claims to have defaced the website of SHIMA
Date: 2025-12-14T08:23:39Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216714 Screenshots: https://d34iuop8pidsy8.cloudfront.net/155699e3-b1d5-4fc3-8d36-0f96fca4cce3.JPG
Threat Actors: 911Team
Victim Country: Germany
Victim Industry: Fashion & Apparel
Victim Organization: shima
Victim Site: shimaofficial.de

65. Hazardous Cyber Team targets the website of OCA Computer Institute of IT and Management

Category: Defacement
Content: The group claims to have defaced the website of OCA Computer Institute of IT and Management
Date: 2025-12-14T07:54:02Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216713 Screenshots: https://d34iuop8pidsy8.cloudfront.net/7635280c-c4e4-474f-b62c-e1908394ce74.JPG
Threat Actors: Hazardous Cyber Team
Victim Country: India
Victim Industry: Education
Victim Organization: oca computer institute of it and management
Victim Site: ims.ocajajpur.in

66. Liteconn Co., Ltd falls victim to Qilin Ransomware

Category: Ransomware
Content: The group claims to have obtained 37 GB of the organization’s data.
Date: 2025-12-14T07:27:07Z
Network: tor
Published URL: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=23d9dd25-6150-3927-9153-97e5e9a8a7b5 Screenshots: https://d34iuop8pidsy8.cloudfront.net/44beae8c-1e00-4054-a14f-eb57003245fc.png
Threat Actors: Qilin
Victim Country: Taiwan
Victim Industry: Electrical & Electronic Manufacturing
Victim Organization: liteconn co., ltd
Victim Site: liteconn.com

67. Z-BL4CX-H4T targets the website of Shishania coaching center

Category: Defacement
Content: The group claims to have defaced the website of Shishania coaching center
Date: 2025-12-14T07:20:06Z
Network: telegram
Published URL: https://t.me/c/3027611821/195 Screenshots: https://d34iuop8pidsy8.cloudfront.net/8679781a-bf45-416a-8a3d-03b5e465b572.jpeg
Threat Actors: Z-BL4CX-H4T
Victim Country: India
Victim Industry: E-Learning
Victim Organization: shishania coaching center
Victim Site: bhavyastudy.in

68. Alleged data breach of EduArena

Category: Data Breach
Content: The threat actor claims to be leaked a data from EduArena.
Date: 2025-12-14T06:29:30Z
Network: openweb
Published URL: https://breachstars.io/topic/eduarenaai-turingcom-company-vx4lux5yw4kk Screenshots: https://d34iuop8pidsy8.cloudfront.net/83e8dd8b-a0dd-406e-a8da-4f7caaedf125.png
Threat Actors: shellrunners
Victim Country: USA
Victim Industry: Education
Victim Organization: eduarena
Victim Site: eduarena.ai

69. VLP HELLAS S.A. falls victim to Qilin Ransomware

Category: Ransomware
Content: The group clams to have obtained organization’s data
Date: 2025-12-14T06:21:18Z
Network: tor
Published URL: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=d4b7e56a-b167-3806-86c1-d58c01d21a23 Screenshots: https://d34iuop8pidsy8.cloudfront.net/cd323e6d-5ba0-4117-a0bd-bbca9ff4994b.png
Threat Actors: Qilin
Victim Country: Greece
Victim Industry: Transportation & Logistics
Victim Organization: vlp hellas s.a.
Victim Site: vlp.gr

70. Alleged Leak of Voter and National ID Data from Indonesia

Category: Data Breach
Content: The threat actor claims to have leaked Voter and National ID Data from Indonesia. The compromised data reportedly contain 74 million records including Citizen Identification Numbers (NIK), full names, gender, dates of birth, phone numbers.
Date: 2025-12-14T06:19:53Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Indonesia-Voter-ID-Dump-74M-Records-Full-Demographic-Leak-BreachLabs Screenshots: https://d34iuop8pidsy8.cloudfront.net/4c2e7717-b3e6-4e9f-9fd7-30baf9aae111.png
Threat Actors: BreachLaboratory
Victim Country: Indonesia
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

71. Alleged Leak of Government Household Registry Data from Vietnam

Category: Data Breach
Content: The threat actor claims to have leaked Government Household Registry Data from Vietnam. The compromised data reportedly contain 53 million records including Full Name of Head of Household, personal identification numbers, registered family members, household addresses, dates of birth, age and gender details, family structure information.
Date: 2025-12-14T06:14:02Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Vietnam-Gov-Household-Registry-53M-Records-Family-Structure-Leak-BreachLabs Screenshots: https://d34iuop8pidsy8.cloudfront.net/79bc4096-17b0-47b1-b77c-a5d9c37ac90a.png
Threat Actors: BreachLaboratory
Victim Country: Vietnam
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

72. Alleged leak of login credentials from Ubon Ratchathani Rajabhat University

Category: Initial Access
Content: The group claims to have leaked the login credentials of Ubon Ratchathani Rajabhat University
Date: 2025-12-14T06:07:45Z
Network: telegram
Published URL: https://t.me/black_bulletttt/651 Screenshots: https://d34iuop8pidsy8.cloudfront.net/569f5805-3121-4eb9-ba4c-35d2ce6ecdf0.png
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Education
Victim Organization: ubon ratchathani rajabhat university
Victim Site: rrsidcard.ubru.ac.th

73. Alleged data breach of Vietnam Airlines

Category: Data Breach
Content: The threat actor claims to be leaked a data from Vietnam Airlines. The compromised data reportedly contain 23 million records including full names, phone and mobile numbers, dates of birth, age, gender details, residential and mailing addresses.
Date: 2025-12-14T06:05:47Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-vietnamairlines-com-vn-23M-Passenger-Dataset-Vietnam-Airlines-Leak-BreachLabs Screenshots: https://d34iuop8pidsy8.cloudfront.net/f0910196-a1ab-4540-9a1f-e356385f70bd.png
Threat Actors: BreachLaboratory
Victim Country: Vietnam
Victim Industry: Airlines & Aviation
Victim Organization: vietnam airlines
Victim Site: vietnamairlines.com.vn

74. Alleged leak of login credentials from King Chulalongkorn Memorial Hospital

Category: Initial Access
Content: The group claims to have leaked the login credentials of King Chulalongkorn Memorial Hospital.
Date: 2025-12-14T06:00:10Z
Network: telegram
Published URL: https://t.me/exados_khmer/142 Screenshots: https://d34iuop8pidsy8.cloudfront.net/b8992994-50b5-47cb-98bd-abc15bdaa47c.png
Threat Actors: EXADOS
Victim Country: Thailand
Victim Industry: Hospital & Health Care
Victim Organization: king chulalongkorn memorial hospital
Victim Site: jobs.kcmh.or.th

75. Alleged data breach of JPC Trade Ltd

Category: Data Breach
Content: The threat actor claims to be leaked a data from JPC Trade Ltd. The compromised data reportedly contain 152,488 records including Customer ID, Full name, Company name, Full address, Telephone numbers, fax numbers, email addresses, Account passwords.
Date: 2025-12-14T05:54:08Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-jpctrade-com-152K-Car-Owner-Accounts-%F0%9F%87%AF%F0%9F%87%B5-Japan-%F0%9F%87%AC%F0%9F%87%A7-UK-BreachLabs Screenshots: https://d34iuop8pidsy8.cloudfront.net/c1cd185c-121f-494b-b208-28b3de70174e.png
Threat Actors: BreachLaboratory
Victim Country: Japan
Victim Industry: Automotive
Victim Organization: jpc trade ltd
Victim Site: jpctrade.com

Conclusion

The incidents detailed in this report highlight a diverse and active landscape of cyber threats. Data breaches remain a dominant concern, with actors like BreachLaboratory and others leaking massive datasets from government and private sectors in Indonesia, Vietnam, and Japan. Ransomware groups, notably SAFEPAY, Qilin, and LOCKBIT 5.0, continue to target organizations across multiple industries, including healthcare, manufacturing, and finance, in regions such as Greece, the USA, and Singapore. Additionally, there is significant activity in the sale of initial access and defacement campaigns, particularly targeting educational and government institutions in Thailand and India. This persistent threat environment underscores the critical need for robust cybersecurity measures, including enhanced data protection, continuous monitoring, and proactive vulnerability management to mitigate these evolving risks.

Related Posts

[July-08-2025] Daily Cybersecurity Threat Report

[September-15-2025] Daily Cybersecurity Threat Report

[October-20-2025] Daily Cybersecurity Threat Report