[May-16-2025] Daily Cybersecurity Threat Report

1. Executive Summary

This report provides an analysis of a series of cybersecurity incidents reported on May 16, 2025, highlighting the diverse and persistent threats facing organizations across various sectors and regions. The reported incidents encompass a range of attack types, including initial access attempts, data breaches, website defacements, and malware dissemination, demonstrating the multifaceted nature of the current cyber threat landscape. Targeted sectors include real estate, government, education, e-commerce, banking, health & fitness, retail, non-profit, network & telecommunications, newspapers & journalism, and higher education, illustrating the broad scope of potential victims. Key threat actors identified in these incidents include HelluvaHack, GARUDA ERROR SYSTEM, XSVSHACKER, info_usa, WOLF CYBER ARMY, JABAR ERROR SYSTEM, Machine1337, B4baYega, kill9, Reve, and Brejnev. These actors employ a variety of tactics, from selling unauthorized access on underground forums to claiming large-scale data breaches and leveraging malware for malicious purposes. The analysis reveals ongoing trends such as the active involvement of hacktivist groups, the persistent market for initial access to compromised systems, and the continued targeting of sensitive data held by government and financial institutions. Understanding these incidents and the associated threat actors is crucial for organizations to develop and implement proactive cybersecurity measures to protect their assets and mitigate potential risks.

Category	Threat Actor	Victim Organization	Victim Country	Victim Industry	Summary of Content	Published URL
Initial Access	HelluvaHack	Unidentified Real Estate Company	Israel	Real Estate	Alleged sale of VPN and RDP access	https://forum.exploit.in/topic/259222/?tab=comments#comment-1565901
Alert	GARUDA ERROR SYSTEM	Cambodia	Cambodia		Claim of targeting Cambodia	https://t.me/GarudaHacktivis/392
Data Breach	GARUDA ERROR SYSTEM	Madhya Pradesh State Co-operative Union Limited	India	Government & Public Sector	Alleged leak of database	https://t.me/GarudaHacktivis/387
Data Breach	XSVSHACKER	Government of India	India	Government Administration	Alleged database leak	https://darkforums.st/Thread-DATABASE-INDIA-GOV-IN
Data Breach	info_usa	Tax Foundation	USA	Non-profit & Social Organizations	Alleged sale of 61 million tax data	https://darkforums.st/Thread-FRESH-USA-TAX-FULL-DB
Defacement	WOLF CYBER ARMY	Universitas Prima Nusantara Bukittinggi	Indonesia	Higher Education/Acadamia	Claim of website defacement	https://t.me/WOLF_CYBER_ARMY_ID/27
Defacement	JABAR ERROR SYSTEM	Transparency Times		Newspapers & Journalism	Claim of website defacement	https://t.me/c/2654264299/5
Defacement	JABAR ERROR SYSTEM	IDUINO	India	Retail Industry	Claim of website defacement	https://t.me/c/2654264299/5
Defacement	JABAR ERROR SYSTEM	BODYFAT – Obesity Treatment Clinics	Israel	Health & Fitness	Claim of website defacement	https://t.me/c/2654264299/5
Defacement	JABAR ERROR SYSTEM	Love Pedagogia	Brazil	Education	Claim of website defacement	https://t.me/c/2654264299/5
Malware	Brejnev	Watchguard	USA	Network & Telecommunications	Alleged leak of brute force for WatchGuard VPN	https://xss.is/threads/137829/
Data Breach	Machine1337	Tokopedia	Indonesia	E-commerce & Online Stores	Alleged data breach of 1 million records	https://xss.is/threads/137845/
Data Breach	B4baYega	Ministry of National Land Use Planning and Housing	Morocco	Government Administration	Alleged data breach	https://darkforums.st/Thread-Morocco-Ministry-of-National-Land-Use-Planning-Leaked-Free-Download
Data Breach	kill9	Multiple banks	Mauritania	Banking & Mortgage	Alleged data breach of multiple banks	https://darkforums.st/Thread-Mauritanian-Banks-Data-Leak
Initial Access	Reve	Unidentified WordPress-based site	South Africa		Alleged sale of admin access	https://forum.exploit.in/topic/259208/
Data Breach	l33tfg	Loliporn			Alleged data leak	https://demonforums.net/Thread-Loliporn-DATA-LEAK-the-largest-CP-site-on-Tor

2. Threat Actor Profiles and Activities

• 2.1. HelluvaHack

• HelluvaHack claimed to be selling VPN and RDP access to an unidentified real estate company in Tel Aviv, Israel, as advertised on the cybercrime forum Exploit.in [User Query]. Exploit.in is a prominent Russian-language forum that has been active for nearly two decades, serving as a key hub for cybercriminals seeking to connect, collaborate, and conduct illicit business.¹ This forum operates on both the dark web and the clear web, and it has established a reputation for attracting experienced cybercriminals involved in various activities, including hacking, fraud, and ransomware operations.¹ Exploit.in is known for its stringent membership policies, often requiring payment or a strong reputation within the cybercrime community to gain access, which helps maintain a level of professionalism and trust among its users.¹ The platform facilitates the sale of initial access to compromised systems, including VPN and RDP credentials, often through auction-based listings.¹
• While the user query identifies “HelluvaHack” in the context of selling initial access, research suggests a potential connection to ransomware. Specifically, snippet ¹⁹⁸ refers to “HelluvaHack ransomware,” potentially linking this actor to the “Helldown” ransomware group. Helldown is a relatively new but active intrusion set that was first documented in August 2024.⁶ This group employs double extortion tactics, exfiltrating sensitive data from victims’ networks before encrypting their systems.⁶ Helldown has been observed exploiting vulnerabilities in various products, including Zyxel firewalls, which are often used as IPSec VPN access points, suggesting a potential method for gaining the initial access that “HelluvaHack” might be selling.⁶ The sectors reportedly targeted by Helldown include IT services, telecommunications, manufacturing, and healthcare, indicating a broad range of potential victims.⁷
• The potential overlap between an initial access broker like “HelluvaHack” and a ransomware operation such as “Helldown” underscores a concerning trend in the cybercrime ecosystem. This model allows for specialization, with some actors focusing on gaining initial entry into networks while others, like ransomware groups, capitalize on this access for financial gain through extortion. The targeting of specific vulnerabilities in VPN devices highlights the importance of proactive security measures, including timely patching and robust configuration of remote access systems.
• 2.2. GARUDA ERROR SYSTEM

• GARUDA ERROR SYSTEM claimed to be targeting Cambodia, as indicated by a Telegram post on May 16, 2025.⁸ However, the content of this specific Telegram post was inaccessible at the time of review.⁸
• The group also claimed responsibility for a data breach of Madhya Pradesh State Co-operative Union Limited, announcing this on their Telegram channel.⁹ Similar to the Cambodia claim, this specific Telegram post was also inaccessible for review.⁹
• Prior to these claims, GARUDA ERROR SYSTEM was involved in coordinated Distributed Denial of Service (DDoS) attacks against high-profile Indian government websites between May 7 and 8, 2025.¹⁰ Despite the group’s claims of a well-organized operation, verification analysis indicated that the targeted websites experienced negligible downtime, suggesting the attacks had minimal significant or sustained impact.¹⁰
• GARUDA ERROR SYSTEM has been identified as one of the top 10 pro-Pakistan hacktivist groups actively engaged in a sustained cyber offensive targeting various Indian institutions between April 22 and May 8, 2025, following the attack in Pahalgam.¹¹ Their tactics primarily involve DDoS attacks, website defacements, and selective data leaks, often coordinated through platforms like Telegram.¹¹ This indicates that the group’s primary focus and motivation appear to be ideologically driven, likely linked to the ongoing tensions between India and Pakistan.¹⁰
• Notably, GARUDA ERROR SYSTEM may have established an alliance with the pro-Russian hacktivist group NoName057(16) in December 2024.¹³ This potential collaboration could signify a broadening of GARUDA ERROR SYSTEM’s geopolitical interests or an expansion of their operational capabilities through cooperation with other like-minded threat actors.
• It is important to note that the name “Garuda” is also associated with legitimate entities, such as a cyber defense academy in India ¹⁴ and a Linux distribution ¹⁵, highlighting the challenges in attributing cyber activities solely based on a group’s chosen name.
• The activities of GARUDA ERROR SYSTEM exemplify the nature of hacktivist groups, which are often driven by geopolitical events and ideological beliefs. Their claims of targeting Cambodia and the Indian cooperative, while unverified due to inaccessible sources, suggest a potentially expanding scope beyond their primary focus on India-Pakistan cyber conflicts. The discrepancy between claimed data breaches and the reported minimal impact of their DDoS attacks underscores the importance of critically evaluating the actual damage caused by such groups. The potential alliance with a pro-Russian entity indicates a fluid and potentially evolving landscape of hacktivist affiliations.
• 2.3. XSVSHACKER

• XSVSHACKER claimed to have leaked the database of the Government of India, including details such as name, email, phone number, state, and zip code, as announced on the dark web forum darkforums.st.¹⁸ The specific post on darkforums.st where this claim was made was inaccessible for review.¹⁸
• This alleged data leak aligns with a well-documented history of data breaches and leaks involving Indian government entities and the personal information of Indian citizens.¹⁹ These incidents have exposed vast amounts of sensitive data, including national identification numbers (Aadhaar), COVID-19 testing information, and other personally identifiable details.
• The Government of India has been actively engaged in developing and implementing a more robust data protection framework to address these persistent threats, including the enactment of the Digital Personal Data Protection Act, 2023, and the drafting of its accompanying rules.²⁹
• The claimed database leak by XSVSHACKER underscores the continuing challenges faced by the Indian government in safeguarding sensitive digital information. Despite ongoing efforts to strengthen cybersecurity and data protection laws, the recurrence of such alleged incidents suggests that vulnerabilities persist or that threat actors are finding new ways to compromise government systems. The nature of the data reportedly leaked, encompassing a wide range of personal identifiers, could have significant consequences for the affected individuals, increasing their risk of identity theft, financial fraud, and other malicious activities.
• 2.4. info_usa

• info_usa claimed to be selling 61 million records of tax data from the Tax Foundation (taxfoundation.org).³² This claim was reportedly made on the dark web forum darkforums.st, but the specific post was inaccessible for review.³²
• The Tax Foundation is a non-profit organization in the United States that conducts research and analysis on tax policy at the federal and state levels.³³
• Historically, the email address “[email protected]” has been linked to the threat actor “FLYING KITTEN” (also known as Charming Kitten, APT42).⁴⁶ FLYING KITTEN is an Iranian state-sponsored cyber espionage group that has been active since at least 2014 and has been known to target U.S.-based defense contractors and political dissidents.⁴⁶
• The alleged sale of a large dataset of tax records from a U.S. non-profit organization by an actor potentially linked to an Iranian state-sponsored group presents an intriguing scenario. While large-scale data sales are typically associated with financially motivated cybercriminals, the potential involvement of a state-sponsored actor raises the possibility of a more targeted intelligence-gathering operation. It is unclear whether the Tax Foundation itself was directly compromised or if the data was obtained through other means. The sheer volume of records claimed to be for sale, if accurate, could have significant implications for the privacy and security of the individuals whose data is included.
• 2.5. WOLF CYBER ARMY

• WOLF CYBER ARMY claimed to have defaced the website of Universitas Prima Nusantara Bukittinggi (cbtfkkm.upnb.ac.id), an Indonesian university, as announced via a Telegram post.⁵¹ The specific Telegram post was inaccessible for review ⁵¹, and the targeted website was also inaccessible at the time of this report.⁵²
• WOLF CYBER ARMY reportedly formed an alliance with the pro-Russian hacktivist group NoName057(16) in December 2024.¹³ This alliance suggests a potential alignment of interests or coordination of activities between the two groups.
• The claimed website defacement of an Indonesian educational institution by a group allied with a pro-Russian hacktivist entity could indicate a politically motivated cyber activity. Website defacement is a common tactic employed by hacktivist groups to disseminate messages or express their ideologies. The alliance with NoName057(16) hints at a possible connection to broader geopolitical agendas or cyber campaigns. The inaccessibility of the claimed defaced website and the Telegram post limits the ability to verify the specifics of the incident.
• 2.6. JABAR ERROR SYSTEM

• JABAR ERROR SYSTEM claimed responsibility for defacing four different websites: Transparency Times (transparencytimes.com), IDUINO (iduino.co.in), BODYFAT – Obesity Treatment Clinics (bodyfatbootcamp.co.il), and Love Pedagogia (lovepedagogia.com).⁵⁹ These claims were made in a single Telegram post on May 16, 2025, which was inaccessible at the time of review.⁵⁹ Similarly, all four targeted websites were also inaccessible.⁶⁰
• The name “JABAR ERROR SYSTEM” strongly suggests that this is an Indonesian hacktivist group, as “Jabar” is a common abbreviation for West Java, a province in Indonesia.
• Indonesian hacktivist groups are known to be active in the cyber domain, often driven by religious or nationalistic motivations and frequently using website defacement as a tactic.¹²
• The simultaneous claiming of multiple website defacements across a diverse range of industries and countries (Transparency Times – Newspapers & Journalism, IDUINO – Retail Industry, BODYFAT – Health & Fitness, Love Pedagogia – Education) indicates a potentially broad and opportunistic targeting approach by JABAR ERROR SYSTEM. The Indonesian origin of the group suggests that their motivations might be tied to specific events or ideologies relevant to Indonesia, or they could be engaging in these defacements for broader visibility or recognition within the hacktivist community. The inaccessibility of the claimed websites and the Telegram post prevents direct confirmation of the defacements and any specific messages left by the group.
• 2.7. Machine1337

• Machine1337 claimed to have breached the data of Tokopedia (tokopedia.com), a major Indonesian e-commerce platform, with an alleged compromise of 1 million records.⁷⁸ This claim was reportedly posted on the cybercrime forum xss.is, but the specific thread was inaccessible for review.⁷⁸
• Tokopedia has been a target of cyberattacks in the past, most notably a significant data breach in 2020 that affected millions of user accounts.⁷⁹
• The threat actor “Machine1337” has also been linked to an alleged data leak of Steam user data in May 2025, indicating a pattern of targeting large online platforms.⁸⁸
• The claimed data breach of Tokopedia by Machine1337, an actor also associated with the alleged Steam data leak, suggests a focus on compromising large-scale user databases from prominent online services. The recurrence of data breach claims targeting Tokopedia indicates that e-commerce platforms remain attractive targets for cybercriminals, likely due to the vast amounts of personal and potentially financial data they hold. The inaccessibility of the specific forum post limits the details available regarding the nature of the compromised data and the actor’s intentions.
• 2.8. B4baYega

• B4baYega claimed to have breached the data of the Ministry of National Land Use Planning and Housing in Morocco.⁹⁸ This claim was reportedly posted on the dark web forum darkforums.st, but the specific thread was inaccessible for review.⁹⁸
• Morocco has been increasingly targeted by cyberattacks, including a significant data breach affecting the National Social Security Fund (CNSS) in April 2025, which was allegedly carried out by Algerian hackers.⁹⁹ These cyber activities are often linked to the ongoing geopolitical tensions between Morocco and Algeria.⁹⁹
• The claimed data breach of a Moroccan government ministry by B4baYega could be another instance of cyber activity stemming from the regional tensions between Morocco and Algeria. Government entities are often targeted in politically motivated cyberattacks, with the aim of disrupting services, stealing sensitive information, or making a political statement. The timing of this claimed breach, following the CNSS incident, suggests a potential pattern of targeting Moroccan government infrastructure. The inaccessibility of the specific forum post limits the available details about the nature and extent of the alleged data compromise.
• 2.9. kill9

• kill9 claimed to be selling data from multiple banks in Mauritania, including names, client IDs, passwords, and card details, as posted on the dark web forum darkforums.st.¹⁰⁹ The specific post on darkforums.st was inaccessible for review.¹⁰⁹
• One of the banks mentioned in the compromised data is Banque Al-Wava Mauritanienne Islamique (BAMIS).¹¹⁰ The website for BAMIS was inaccessible at the time of review.¹²¹
• Mauritania’s financial sector faces various cybersecurity challenges, and the country has established a national cybersecurity strategy to address these risks.¹²²
• The alleged sale of highly sensitive financial data, including passwords and card details, from multiple banks in Mauritania poses a significant threat to the financial security of individuals and institutions in the country. The targeting of the banking sector strongly suggests a financially motivated cybercriminal activity. The availability of such sensitive information on dark web forums can lead to widespread financial fraud and identity theft. The inaccessibility of the specific forum post limits further details about the scope and authenticity of the claimed data leak.
• 2.10. Reve

• Reve claimed to be selling administrative access to a WordPress-based website in South Africa, with plugin support enabled.¹³³ This offer was reportedly posted on the forum exploit.in, but the specific thread was inaccessible for review.¹³³
• Selling administrative access to a WordPress site carries substantial security risks. With admin privileges, an attacker gains complete control over the website, enabling them to install malware, steal sensitive data, deface the site, or even use it as a platform for launching further attacks.¹³⁴ The fact that plugin support is enabled further increases the potential attack surface, as vulnerabilities in WordPress plugins are a common entry point for malicious actors.¹³⁸
• The attempted sale of WordPress admin access highlights the ongoing market for compromised website credentials within the cybercrime ecosystem. Threat actors often seek administrative access to WordPress sites due to their widespread use and the potential for exploitation. The presence of plugin support makes the site even more attractive, as attackers can leverage known vulnerabilities in plugins to further their malicious objectives.
• 2.11. Brejnev

• Brejnev claimed to have leaked a brute force tool for WatchGuard VPN, describing it as a Windows x64-compatible tool with features like multithreading, proxy support, auto proxy updates, and combo-list attacks.¹⁵¹ This claim was reportedly made on the forum xss.is, but the specific thread was inaccessible for review.¹⁵¹
• WatchGuard VPN has been a known target of brute-force attacks, and several security advisories have been issued regarding vulnerabilities in WatchGuard products.¹⁵² Furthermore, ransomware groups have also been observed developing and using automated brute-forcing frameworks to target VPNs for initial access to networks.¹⁹³
• The alleged leak of a specialized brute-force tool for WatchGuard VPN poses a significant risk to organizations utilizing this VPN solution for secure remote access. The features described indicate a tool designed to efficiently and effectively attempt to guess login credentials, potentially bypassing basic security measures. This underscores the critical need for strong, unique passwords and the implementation of multi-factor authentication for all VPN accounts to mitigate the risk of successful brute-force attacks.

Threat Actor	Claimed Activities	Potential Motivations	Known Affiliations	Typical Tactics & Techniques
HelluvaHack	Selling VPN/RDP access	Financial gain, providing access for further attacks (e.g., ransomware)	Possibly linked to Helldown ransomware	Selling initial access via Exploit.in forum
GARUDA ERROR SYSTEM	Targeting Cambodia, data breach of Madhya Pradesh cooperative	Ideological (anti-India, potentially pro-Russian)	Possible alliance with NoName057(16)	DDoS attacks, website defacement, selective data leaks, Telegram for coordination
XSVSHACKER	Database leak of Government of India	Not specified, potentially ideological or financial	Unknown	Data breach, posting on dark web forums
info_usa	Selling tax data from Tax Foundation	Not specified, potentially espionage or financial gain	Historically linked to Iranian APT FLYING KITTEN	Data breach, selling on dark web forums
WOLF CYBER ARMY	Website defacement of Universitas Prima Nusantara Bukittinggi	Not specified, potentially geopolitical alignment	Alliance with NoName057(16)	Website defacement, Telegram for announcements
JABAR ERROR SYSTEM	Website defacements (Transparency Times, IDUINO, BODYFAT, Love Pedagogia)	Likely ideological (Indonesian hacktivist)	Unknown	Website defacement, Telegram for announcements
Machine1337	Data breach of Tokopedia	Financial gain	Unknown	Data breach, posting on cybercrime forums (xss.is)
B4baYega	Data breach of Ministry of National Land Use Planning and Housing (Morocco)	Likely political (Morocco-Algeria cyber conflict)	Unknown	Data breach, posting on dark web forums
kill9	Selling data from multiple banks in Mauritania	Financial gain	Unknown	Data breach, selling on dark web forums
Reve	Selling WordPress admin access	Financial gain	Unknown	Selling compromised access on exploit.in forum
Brejnev	Leaking brute force for WatchGuard VPN	Not specified, potentially to facilitate attacks by others	Unknown	Malware dissemination on cybercrime forums (xss.is)

3. Categorized Incident Analysis

• 3.1. Initial Access:

• The alleged sale of VPN and RDP access to a real estate company in Tel Aviv, Israel by HelluvaHack on Exploit.in [User Query] highlights the critical role of initial access brokers in the cybercrime ecosystem. These brokers specialize in gaining unauthorized entry into organizational networks and then selling this access to other malicious actors, such as ransomware groups or those seeking to conduct espionage.³ The real estate sector, while not always considered a primary target, holds valuable data that could be of interest to various threat actors. The fact that the sale was advertised on Exploit.in, a forum known for its professional cybercriminal user base ¹, suggests that the access being sold is likely intended for sophisticated attacks. The potential link between HelluvaHack and the Helldown ransomware group ⁶ indicates a possible chain of attack where the initial access could be leveraged to deploy ransomware within the compromised real estate company’s network.
• The claimed sale of admin access to a WordPress-based site in South Africa by Reve on exploit.in [User Query] further illustrates the market for compromised credentials. WordPress, being one of the most popular content management systems globally, is a frequent target for attackers.¹⁴⁶ Administrative access to a WordPress site grants the buyer complete control over the website, allowing them to install malware, steal data, deface the site, or use it for other malicious activities like distributing spam or hosting phishing pages.¹³⁴ The fact that the site reportedly has plugin support enabled increases the potential attack surface, as vulnerabilities in WordPress plugins are a common entry point for attackers.¹³⁸
• 3.2. Alert:
• The claim by GARUDA ERROR SYSTEM of targeting Cambodia, announced via Telegram [User Query], likely represents hacktivist activity. Hacktivist groups often use cyberattacks to promote political or social causes.⁶⁵ GARUDA ERROR SYSTEM’s primary focus appears to be on targets related to India-Pakistan tensions ¹¹, so a claimed targeting of Cambodia could indicate a broadening of their operational scope or an opportunistic claim for attention. It is important to note that the actual impact of such alerts can vary significantly, and further verification would be needed to assess the credibility and consequences of this claimed targeting.¹⁰
• 3.3. Data Breach:

• The alleged data breach of Madhya Pradesh State Co-operative Union Limited by GARUDA ERROR SYSTEM [User Query] follows the group’s pattern of claiming data leaks, often announced on their Telegram channel.¹¹ While the specifics of this alleged breach are unavailable due to the inaccessibility of the Telegram post, it aligns with the group’s ideologically motivated cyber operations, primarily targeting Indian entities.¹¹
• The claimed database leak of the Government of India by XSVSHACKER [User Query] is a significant incident, given the sensitive nature of government data. The alleged compromise of details such as name, email, phone number, state, and zip code could have far-reaching implications for the privacy and security of Indian citizens. This incident is consistent with a history of data breaches targeting Indian government databases, highlighting the ongoing challenges in protecting citizen information.¹⁹
• The alleged sale of 61 million tax data records from the Tax Foundation in the USA by info_usa [User Query] is notable due to the potential link between the email address used by the actor and the Iranian state-sponsored group FLYING KITTEN.⁴⁶ If this connection is accurate, it raises questions about the motivations behind the alleged data sale, as it could be related to espionage or intelligence gathering rather than purely financial motives. Tax data is highly sensitive and valuable, making it an attractive target for various threat actors.¹⁹⁹
• The claimed data breach of Tokopedia, an Indonesian e-commerce platform, by Machine1337 [User Query] is concerning given Tokopedia’s large user base and the history of data breaches targeting the platform.⁷⁹ The alleged compromise of 1 million records could expose sensitive personal information of users, increasing their risk of fraud and other malicious activities. The same threat actor has also been linked to an alleged Steam data leak ⁸⁸, suggesting a pattern of targeting large online services.
• The claimed data breach of the Ministry of National Land Use Planning and Housing in Morocco by B4baYega [User Query] occurs within the context of heightened cyber tensions between Morocco and Algeria.⁹⁹ Government entities are frequent targets in politically motivated cyberattacks, and this incident could be part of a broader campaign aimed at disrupting Moroccan government operations or stealing sensitive information.
• The alleged sale of data from multiple banks in Mauritania by kill9 [User Query] poses a significant threat to the financial sector of Mauritania. The claimed compromise of names, client IDs, passwords, and card details could lead to widespread financial fraud and identity theft for the affected bank customers. Mauritania’s banking sector faces cybersecurity challenges ¹²², making it a potential target for financially motivated cybercriminals. One of the banks reportedly affected is Banque Al-Wava Mauritanienne Islamique (BAMIS).¹¹⁰
• The alleged data leak of Loliporn by l33tfg [User Query] indicates the continued targeting of online platforms, regardless of their nature. The leak reportedly includes a database of individuals affiliated with the site’s operations and backend code, suggesting a significant compromise of the platform’s data and infrastructure.
• 3.4. Defacement:

• The claimed defacement of the website of Universitas Prima Nusantara Bukittinggi by WOLF CYBER ARMY [User Query] aligns with the group’s potential pro-Russian affiliations ¹³ and the broader trend of hacktivist groups targeting educational institutions.⁶⁵ Website defacement is a common tactic used to publicize a group’s activities or express their ideological views.
• The claimed defacements of Transparency Times, IDUINO, BODYFAT, and Love Pedagogia by JABAR ERROR SYSTEM [User Query] demonstrate the group’s active targeting of various organizations across different sectors and countries. As a likely Indonesian hacktivist group ⁶⁴, their motivations could be tied to specific regional or global events, or they might be conducting these defacements for broader recognition within the hacktivist community.
• 3.5. Malware:
• The alleged leak of a brute force tool for WatchGuard VPN by Brejnev [User Query] highlights the ongoing development and dissemination of offensive tools within the cybercrime ecosystem. VPNs are critical for secure remote access, making them prime targets for threat actors seeking to gain unauthorized entry into organizational networks.¹⁷³ The features of the leaked tool, such as multithreading and proxy support, suggest an attempt to create an efficient and evasive method for compromising WatchGuard VPN connections.

4. Industry and Regional Impact Assessment

• 4.1. Industries:
• The reported incidents on May 16, 2025, impacted a diverse range of industries. The Real Estate sector was targeted for initial access in Israel. The Government & Public Sector, including Government Administration, faced data breach attempts in India and Morocco. The Non-profit & Social Organizations sector saw the Tax Foundation in the USA as a target of an alleged tax data sale. Higher Education/Academia was affected by the claimed defacement of Universitas Prima Nusantara Bukittinggi in Indonesia. Newspapers & Journalism saw Transparency Times targeted for defacement. The Retail Industry had IDUINO in India as a claimed victim of defacement. The Health & Fitness sector was impacted by the claimed defacement of BODYFAT in Israel. Education saw Love Pedagogia in Brazil as a claimed defacement target. The Network & Telecommunications sector was involved with the alleged leak of a brute force tool for WatchGuard in the USA. The E-commerce & Online Stores industry had Tokopedia in Indonesia as the victim of a claimed data breach. The Banking & Mortgage sector in Mauritania was targeted by a claimed data breach affecting multiple banks. This wide distribution of incidents across various industries underscores the pervasive nature of cyber threats and the need for organizations in all sectors to prioritize cybersecurity.
• 4.2. Regions:
• The geographical distribution of the reported cybersecurity incidents spans multiple continents, highlighting the global reach of cyber threats. Israel was targeted for initial access and website defacement. Cambodia was the subject of a targeting claim by a hacktivist group. India saw data breach and website defacement attempts, and is also the likely origin of the GARUDA ERROR SYSTEM and JABAR ERROR SYSTEM hacktivist groups. The USA was involved in the alleged sale of tax data and the leaking of a brute force tool for a US-based VPN provider. Indonesia experienced a website defacement and a claimed data breach of a major e-commerce platform. Morocco was targeted by a claimed data breach affecting a government ministry. Mauritania‘s banking sector was the target of a claimed data breach. South Africa was the location of a WordPress site where admin access was allegedly being sold. Brazil had an educational website reportedly defaced. This global spread illustrates that cyber threats are not confined to any single region and that organizations worldwide are at risk.

Industry	Number of Incidents	Examples of Targeted Organizations	Predominant Attack Categories Observed
Real Estate	1	Unidentified Real Estate Company	Initial Access
Government & Public Sector	2	Madhya Pradesh State Co-operative Union Limited, Government of India	Data Breach
Government Administration	2	Government of India, Ministry of National Land Use Planning and Housing	Data Breach
Non-profit & Social Organizations	1	Tax Foundation	Data Breach
Higher Education/Acadamia	1	Universitas Prima Nusantara Bukittinggi	Defacement
Newspapers & Journalism	1	Transparency Times	Defacement
Retail Industry	1	IDUINO	Defacement
Health & Fitness	1	BODYFAT – Obesity Treatment Clinics	Defacement
Education	1	Love Pedagogia	Defacement
Network & Telecommunications	1	Watchguard	Malware
E-commerce & Online Stores	1	Tokopedia	Data Breach
Banking & Mortgage	1	Multiple banks (including BAMIS)	Data Breach

5. Focus on Key Incidents

• 5.1. Alleged Sale of Unauthorized Access to a Real Estate Company in Israel: The claimed sale of VPN and RDP access to an Israeli real estate company by HelluvaHack on Exploit.in highlights the critical role of initial access brokers in facilitating cyberattacks. This type of access can be a valuable commodity for ransomware operators or other threat actors looking to gain a foothold within an organization’s network. The fact that the real estate company reportedly has $29 million in revenue and 57 employees suggests that even mid-sized organizations are targets for such brokers. The potential for lateral movement from the initial access to backup servers, as mentioned in the user query, underscores the need for organizations to secure all segments of their network and implement robust backup security measures. The link between HelluvaHack and the Helldown ransomware group, if confirmed, would illustrate the interconnectedness of the cybercrime ecosystem, where specialized actors collaborate to carry out complex attacks.
• 5.2. Alleged Data Breach of Government Of India: The claimed database leak of the Government of India by XSVSHACKER, involving sensitive personal information, is a significant incident that follows a concerning pattern of data breaches targeting Indian government entities. The compromise of details such as name, email, phone number, state, and zip code could have severe consequences for the affected individuals, increasing their vulnerability to identity theft, phishing attacks, and other forms of fraud. The repeated occurrence of such breaches, despite ongoing efforts by the Indian government to strengthen its data protection framework, indicates the persistent challenges in securing the vast amounts of citizen data held by government agencies. This incident underscores the urgent need for enhanced cybersecurity practices, stricter access controls, and robust data encryption measures within government organizations.
• 5.3. Alleged Sale of 61 Million Tax Data from the USA: The claimed sale of a massive dataset of tax information from the Tax Foundation by info_usa is notable due to the potential link of the actor’s email address to the Iranian state-sponsored group FLYING KITTEN. While the motives remain unclear, the targeting of a non-profit organization focused on tax policy could suggest an intelligence-gathering operation aimed at understanding U.S. tax policies or identifying individuals associated with the foundation. Alternatively, a financially motivated actor might be using the “info_usa” moniker for notoriety or misdirection. The sheer volume of 61 million records, if accurate, represents a substantial breach of personal and financial data that could be exploited for various illicit purposes.
• 5.4. Alleged Brute Force for WatchGuard VPN: The claimed leak of a brute force tool specifically designed for WatchGuard VPN by Brejnev poses a direct threat to organizations relying on this VPN solution for secure remote access. The features of the tool, including multithreading and proxy support, indicate a sophisticated attempt to automate and scale attacks aimed at guessing login credentials. VPNs are a critical component of many organizations’ security infrastructure, providing secure connections for remote workers. The availability of a tool designed to compromise WatchGuard VPN underscores the importance of implementing strong, unique passwords and enabling multi-factor authentication for all VPN accounts. Organizations should also ensure their WatchGuard VPN infrastructure is regularly updated with the latest security patches to address any known vulnerabilities that could be exploited through brute-force attacks.

6. Recommendations and Mitigation Strategies

• 6.1. For Organizations Across All Sectors:

• Implement strong and unique passwords for all accounts, adhering to complexity requirements and avoiding default or easily guessable credentials.¹³⁴ Enforce the use of multi-factor authentication (MFA) for all critical accounts, especially those with administrative privileges and for remote access solutions like VPNs and RDP.¹³⁴ MFA adds an additional layer of security, making it significantly harder for attackers to gain unauthorized access even if they manage to obtain a valid password.
• Establish a rigorous patch management process to ensure all software, including operating systems, applications, web browsers, plugins, themes, and firmware on all devices, is updated promptly with the latest security patches.³ Many cyberattacks exploit known vulnerabilities in outdated software, so timely patching is crucial for mitigating these risks.
• Conduct regular and comprehensive security awareness training for all employees.³ This training should cover topics such as identifying phishing emails, recognizing social engineering tactics, the importance of strong passwords, and safe browsing habits. Educating employees is a vital aspect of a strong security posture, as human error is often a contributing factor in successful cyberattacks.
• Implement robust network segmentation to divide the network into isolated zones.¹⁷⁸ This limits the extent of damage and lateral movement an attacker can achieve if they breach one segment of the network. Proper segmentation can prevent attackers from easily accessing critical assets from less secure areas.
• Develop and regularly test a comprehensive incident response plan.³ This plan should outline the procedures for identifying, containing, eradicating, and recovering from cybersecurity incidents. Regular testing ensures that the team is prepared to respond effectively and minimize the impact of an attack.
• Establish and maintain a reliable backup strategy for all critical data.¹³⁵ Backups should be performed regularly and stored securely in an offsite or offline location to protect them from being compromised during an attack. Regularly test the restoration process to ensure data can be recovered effectively when needed.
• Implement continuous monitoring of network traffic and system logs for any unusual or suspicious activity.³ Security Information and Event Management (SIEM) systems can help automate this process, alerting security teams to potential threats in real-time.
• Consider subscribing to threat intelligence services to stay informed about the latest threats, threat actors, and their tactics, techniques, and procedures (TTPs).² This information can help organizations proactively adjust their security defenses and better understand the evolving threat landscape.
• 6.2. For Government and Public Sector Organizations:

• Prioritize the security of databases containing sensitive citizen data, implementing stringent access controls based on the principle of least privilege.²⁰⁸ Employ robust data encryption techniques both at rest and in transit to protect the confidentiality of this information.
• Conduct regular and thorough security audits and penetration testing of all systems and applications that handle sensitive data.³ These assessments should be performed by independent third parties to identify and address vulnerabilities proactively.
• Foster enhanced collaboration and information sharing on cybersecurity threats and incidents between different government agencies and with relevant private sector partners. Establishing clear channels for communication and intelligence sharing can improve the overall national cybersecurity posture.
• 6.3. For Financial Institutions:

• Implement advanced fraud detection and prevention systems that leverage behavioral analytics and machine learning to identify and block suspicious financial transactions.²⁰⁹
• Enforce strong, multi-layered authentication measures for all online banking and financial transactions, going beyond passwords to include biometrics, one-time passcodes, and other advanced authentication methods.²⁰⁹
• Establish proactive monitoring of dark web forums and marketplaces for any compromised credentials or data related to the institution or its customers.² Take immediate action to invalidate any compromised credentials and notify affected customers.
• Ensure strict compliance with all relevant regulations and industry best practices for cybersecurity, such as PCI DSS for payment card information and other applicable financial sector guidelines.
• 6.4. For E-commerce Platforms:

• Implement robust security measures to protect all user data, particularly sensitive information such as payment details and personal identifiers.⁸⁴ Employ strong encryption for data at rest and in transit, and ensure compliance with relevant data security standards.
• Conduct regular security assessments and penetration testing to identify and address vulnerabilities in the platform’s infrastructure and applications. Stay informed about emerging threats and adapt security protocols accordingly.
• Provide clear and user-friendly guidance to customers on best practices for password security and account protection, including the importance of strong, unique passwords and enabling two-factor authentication.
• 6.5. For Organizations Using VPNs:

• Mandate the use of strong, unique passwords for all VPN accounts and enforce regular password changes.¹⁷⁵ Implement multi-factor authentication (MFA) for all VPN logins to prevent unauthorized access even if passwords are compromised.¹³⁴
• Ensure that the VPN software and firmware on all devices are kept up to date with the latest security patches provided by the vendor.¹⁸⁶ Regularly check for and apply updates to address any known vulnerabilities.
• Implement connection rate limiting and account lockout policies to automatically block IP addresses or user accounts after a certain number of failed login attempts, mitigating the risk of brute-force attacks.¹⁵⁵
• Where feasible, consider implementing allowlists of trusted IP addresses for VPN access, restricting connections to only those IP ranges that are known and authorized to connect to the VPN.¹⁷³

7. Conclusion

The cybersecurity incidents reported on May 16, 2025, provide a snapshot of the diverse and persistent threats that organizations face in the digital age. The range of attack types, targeted industries, and threat actors involved underscores the dynamic and evolving nature of the cyber threat landscape. From initial access brokers facilitating entry for ransomware attacks to hacktivist groups engaging in politically motivated defacements and state-sponsored actors potentially involved in data sales, the cyber domain remains a complex and challenging environment to secure. The repeated targeting of sensitive data held by government and financial institutions, along with the increasing availability of offensive tools like VPN brute-forcers, highlights the critical need for organizations of all sizes and across all sectors to prioritize cybersecurity. Continuous monitoring, proactive implementation of robust security measures, and ongoing adaptation to the evolving threat landscape are essential for mitigating risks and protecting valuable digital assets. Collaboration and information sharing within the cybersecurity community remain crucial in the ongoing fight against cyber threats.

Works cited

1. Exploit – Searchlight Cyber, accessed May 16, 2025, https://slcyber.io/dark-web/exploit/
2. Top 10 Dark Web Forums Dominating Cybercrime – Threat Intelligence Lab, accessed May 16, 2025, https://threatintelligencelab.com/blog/top-10-dark-web-forums-dominating-cybercrime/
3. Exploit Forum, Initial Access Brokers, and Cybercrime on the Dark Web – Flare, accessed May 16, 2025, https://flare.io/learn/resources/blog/exploit-forum/
4. Dynamics on Hacking Forums: How do Threat Actors Trust Each Other? – Searchlight Cyber, accessed May 16, 2025, https://slcyber.io/blog/dynamics-on-hacking-forums-how-do-threat-actors-trust-each-other/
5. Exploit Forum Initial Access Broker Landscape for NATO Countries – Flare, accessed May 16, 2025, https://flare.io/learn/resources/blog/initial-access-broker-landscape-in-nato-member-states-on-exploit-forum/
6. Helldown Ransomware: an overview of this emerging threat – Sekoia.io Blog, accessed May 16, 2025, https://blog.sekoia.io/helldown-ransomware-an-overview-of-this-emerging-threat/
7. New ‘Helldown’ Ransomware Variant Expands Attacks to VMware and Linux Systems, accessed May 16, 2025, https://thehackernews.com/2024/11/new-helldown-ransomware-expands-attacks.html
8. accessed January 1, 1970, https://t.me/GarudaHacktivis/392
9. accessed January 1, 1970, https://t.me/GarudaHacktivis/387
10. Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge | CloudSEK, accessed May 16, 2025, https://www.cloudsek.com/blog/brief-disruptions-bold-claims-the-tactical-reality-behind-the-india-pakistan-hacktivist-surge
11. Pro-Pak hackers launched sustained cyber attacks post Pahalgam; BSNL, Railways among targets: Study | Kerala news | Onmanorama, accessed May 16, 2025, https://www.onmanorama.com/news/kerala/2025/05/11/operation-sindoor-cyber-offensive-target-indian-organisations.html
12. Amid G20 Summit, Indonesian Hacker Groups Target Indian Organisations And Digital Infrastructure – Outlook Business, accessed May 16, 2025, https://www.outlookbusiness.com/news/amid-g20-summit-indonesian-hacker-groups-target-indian-organisations-and-digital-infrastructure
13. The Rise of Alliances: NoName057(16)’s Transformation in 2024 – Radware, accessed May 16, 2025, https://www.radware.com/security/threat-advisories-and-attack-reports/the-rise-of-alliances-noname057-16-transformation-in-2024/
14. Garuda – Fourth Command, accessed May 16, 2025, https://thefourthcommand.com/garuda/
15. Type in os_info – Rust – Docs.rs, accessed May 16, 2025, https://docs.rs/os_info/latest/os_info/enum.Type.html
16. So what is the story behind Garuda Linux, accessed May 16, 2025, https://forum.garudalinux.org/t/so-what-is-the-story-behind-garuda-linux/32387
17. Deciding between Garuda and Endeavour : r/EndeavourOS – Reddit, accessed May 16, 2025, https://www.reddit.com/r/EndeavourOS/comments/z33e9l/deciding_between_garuda_and_endeavour/
18. accessed January 1, 1970, https://darkforums.st/Thread-DATABASE-INDIA-GOV-IN
19. Data breaches in India – Wikipedia, accessed May 16, 2025, https://en.wikipedia.org/wiki/Data_breaches_in_India
20. Recent Data Breaches: Major Cybersecurity Threats & Indian Cases – The Legal School, accessed May 16, 2025, https://thelegalschool.in/blog/recent-data-breaches
21. Top 25 Biggest Cyber Attacks in India: Major Data Breaches & Cybercrime – Sattrix, accessed May 16, 2025, https://www.sattrix.com/blog/biggest-cyber-attacks-in-india/
22. Top 10 Data Breaches in India: The Nation’s Struggle With Cybercrime – The Cyber Express, accessed May 16, 2025, https://thecyberexpress.com/top-10-data-breaches-in-india-cybercrime/
23. Aadhaar Data Breach – Data of 81 Crore Indians Exposed – Logix InfoSecurity, accessed May 16, 2025, https://logix.in/blog/massive-aadhaar-data-breach/
24. Top 5 Recent Data Breaches in India (2024) – DPDP Consultants, accessed May 16, 2025, https://www.dpdpconsultants.com/blog/top-5-recent-data-breaches-in-india-2024-2.php
25. Top 10 Biggest Data Breaches of All Time – Termly, accessed May 16, 2025, https://termly.io/resources/articles/biggest-data-breaches/
26. The Aadhaar Card: Cybersecurity Issues with India’s Biometric Experiment, accessed May 16, 2025, https://jsis.washington.edu/news/the-aadhaar-card-cybersecurity-issues-with-indias-biometric-experiment/
27. India’s biggest data breach? Hacking gang claims to have stolen 815 million people’s personal information – Bitdefender, accessed May 16, 2025, https://www.bitdefender.com/en-au/blog/hotforsecurity/indias-biggest-data-breach-hacking-gang-claims-to-have-stolen-815-million-peoples-personal-information
28. Government probing ‘data breach’ of 8 crore Indians from ICMR Covid site – Times of India, accessed May 16, 2025, https://timesofindia.indiatimes.com/india/government-probing-data-breach-of-8-crore-indians-from-icmr-covid-site/articleshow/104835828.cms
29. Breach notification in India – Data Protection Laws of the World, accessed May 16, 2025, https://www.dlapiperdataprotection.com/?t=breach-notification&c=IN
30. India Proposes Digital Data Rules with Tough Penalties and Cybersecurity Requirements, accessed May 16, 2025, https://thehackernews.com/2025/01/india-proposes-digital-data-rules-with.html
31. Government of India takes action to protect Citizens’ Data: Websites Exposing Aadhaar and PAN Details blocked – PIB, accessed May 16, 2025, https://pib.gov.in/PressReleseDetailm.aspx?PRID=2059179
32. accessed January 1, 1970, https://darkforums.st/Thread-FRESH-USA-TAX-FULL-DB
33. Federal Tax Data – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/data/federal-tax/
34. Social Security Archives – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/tags/social-security/
35. All Research and Data – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/all-research-data/
36. Tax Foundation | Principled, Insightful, Engaged, accessed May 16, 2025, https://taxfoundation.org/
37. Research – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/research/
38. Tax Policy Blog – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/blog/
39. Center for Federal Tax Policy – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/research/federal-tax/
40. Social Security: Lessons for Reform – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/research/all/federal/social-security-reform-options/
41. Tariffs & Trade Policy | Biden Tariffs & Trump Trade War – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/topics/tariffs-and-trade/
42. The Unsustainable U.S. Debt Course and Impacts of Potential Tax Changes, accessed May 16, 2025, https://taxfoundation.org/research/all/federal/us-debt-budget-taxes-spending-social-security-medicare/
43. Donald Trump Tax Plan Ideas: Details and Analysis – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/research/all/federal/donald-trump-tax-plan-2024/
44. The Tax Foundation – PolitiFact, accessed May 16, 2025, https://www.politifact.com/personalities/tax-foundation/
45. House GOP bill proposes a number of new tax cuts. Here’s how that could impact your money. – CBS News, accessed May 16, 2025, https://www.cbsnews.com/news/trump-tax-cuts-overtime-social-security-senior-deduction/
46. CrowdStrike Tracks Reported Iranian Actor as FLYING KITTEN, accessed May 16, 2025, https://www.crowdstrike.com/en-us/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/
47. Welcome to New York: Exploring TA453’s Foray into LNKs and Mac Malware | Proofpoint US, accessed May 16, 2025, https://www.proofpoint.com/us/blog/threat-insight/welcome-new-york-exploring-ta453s-foray-lnks-and-mac-malware
48. Best Laid Plans: TA453 Targets Religious Figure with Fake Podcast Invite Delivering New BlackSmith Malware Toolset | Proofpoint UK, accessed May 16, 2025, https://www.proofpoint.com/uk/blog/threat-insight/best-laid-plans-ta453-targets-religious-figure-fake-podcast-invite-delivering
49. APT42: Crooked Charms, Cons, and Compromises | Google Cloud Blog, accessed May 16, 2025, https://cloud.google.com/blog/topics/threat-intelligence/apt42-charms-cons-compromises
50. Top Threat Actors on the Dark Web | 2023 Recap – CybelAngel, accessed May 16, 2025, https://cybelangel.com/top-threat-actors-on-the-dark-web-recap/
51. accessed January 1, 1970, https://t.me/WOLF_CYBER_ARMY_ID/27
52. accessed January 1, 1970, cbtfkkm.upnb.ac.id
53. Website Sistem Penerimaan Mahasiswa Baru – Universitas Prima Nusantara Bukittinggi, accessed May 16, 2025, https://pmb.upnb.ac.id/
54. Universitas Prima Nusantara Bukittinggi, accessed May 16, 2025, https://upnb.ac.id/
55. Jurnal Kesehatan – SINTA – Science and Technology Index, accessed May 16, 2025, https://sinta.kemdikbud.go.id/journals/profile/4786
56. Penajajakan Pembukaan Prodi Kedokteran, Universitas Prima Nusantara Studi Banding ke FK UNAND, accessed May 16, 2025, https://fk.unand.ac.id/penajajakan-pembukaan-prodi-kedokteran-universitas-prima-nusantara-studi-banding-ke-fk-unand/
57. MAGENTA – Platform Cari Kerja dan Magang, accessed May 16, 2025, https://magenta.bumn.go.id/
58. SISTER | Beranda, accessed May 16, 2025, https://sister.kemdikbud.go.id/
59. accessed January 1, 1970, https://t.me/c/2654264299/5
60. accessed January 1, 1970, transparencytimes.com
61. accessed January 1, 1970, iduino.co.in
62. accessed January 1, 1970, bodyfatbootcamp.co.il
63. accessed January 1, 1970, lovepedagogia.com
64. Cyberwarfare: Indian Cyber Mafia Targeting Indonesia Triggers Reactions, accessed May 16, 2025, https://thecyberexpress.com/indian-cyber-mafia-targeting-indonesia/
65. Hacktivism Roundup Q1 2024: Warfare in the Digital World – CYJAX, accessed May 16, 2025, https://www.cyjax.com/resources/blog/hacktivism-roundup-q1-2024-warfare-in-the-digital-world/
66. Cyber Threat Intelligence Update: New Claims of Attacks Against Israeli SCADA Systems, accessed May 16, 2025, https://securityscorecard.com/research/claims-of-attacks-against-israeli-scada-systems/
67. The Hamas-Israel Cyber War: A Complex Web of Lies, accessed May 16, 2025, https://thecyberexpress.com/complex-web-of-lies-in-hamas-israel-cyber-war/
68. Reflections of the Israel-Palestine Conflict on the Cyber World – SOCRadar, accessed May 16, 2025, https://socradar.io/reflections-of-the-israel-palestine-conflict-on-the-cyber-world/
69. Threat Actors in the war between Israel and Palestine by SOCRadar, accessed May 16, 2025, https://israelvshamas-threatactors.streamlit.app/
70. Mr.Krypton – Hacked By, accessed May 16, 2025, http://www.drmc.gov.et/-.htm
71. GEOPOLITICAL CONFLICTS AND THE UNPREDICTABLE NATURE OF HACKTIVIST OPERATIONS – CYFIRMA, accessed May 16, 2025, https://www.cyfirma.com/research/geopolitical-conflicts-and-the-unpredictable-nature-of-hacktivist-operations/
72. Asia Hacktivist Threat Landscape – SOCRadar® Cyber Intelligence Inc., accessed May 16, 2025, https://socradar.io/asia-hacktivist-threat-landscape/
73. IS-Supporting Hacktivists in Southeast Asia – International Institute for Counter-Terrorism, accessed May 16, 2025, https://ict.org.il/UserFiles/IS-supporting%20Hacktivists%20in%20SE%20Asia%20v1.pdf
74. INDOHAXSEC – Emerging Indonesian Hacking Collective – Arctic Wolf, accessed May 16, 2025, https://arcticwolf.com/resources/blog-uk/indohaxsec-indonesian-hacking-collective/
75. ‘Hacktivist Indonesia’ claims to attack 12000 Indian govt websites: Cybersecurity alert, accessed May 16, 2025, https://ciso.economictimes.indiatimes.com/news/grc/hacktivist-indonesia-claims-to-attack-12000-indian-govt-websites-cybersecurity-alert/99509357
76. Government of India Issues Alert on Possible Cyberattack by Indonesian Hackers, accessed May 16, 2025, https://www.indusface.com/news/government-of-india-issues-alert-on-possible-cyberattack-by-indonesian-hackers/
77. Indian Government Websites Under Attack by Indonesian Hackers – ANA Cyber, accessed May 16, 2025, https://www.anacyber.com/blogs/indian-government-websites-under-attack-by-indonesian-hackers
78. accessed January 1, 1970, https://xss.is/threads/137845/
79. What happened in the Tokopedia data breach? – Twingate, accessed May 16, 2025, https://www.twingate.com/blog/tips/tokopedia-data-breach
80. Tokopedia notifies authorities of third party over data breach – ANTARA News, accessed May 16, 2025, https://en.antaranews.com/news/151854/tokopedia-notifies-authorities-of-third-party-over-data-breach
81. Indonesian e-commerce giant probes reported breach of 91 million credentials, accessed May 16, 2025, https://cyberscoop.com/indonesian-e-commerce-giant-probes-reported-breach-91-million-credentials/
82. Data breach jeopardizes more than 15 million Tokopedia users, report finds – Business, accessed May 16, 2025, https://www.thejakartapost.com/news/2020/05/03/data-breach-jeopardizes-more-than-15-million-tokopedia-users-report-finds.html
83. Tokopedia Breach: 91 Million Records for Sale on Dark Web – Infosecurity Magazine, accessed May 16, 2025, https://www.infosecurity-magazine.com/news/tokopedia-breach-91-million/
84. Tokopedia Security Rating, Vendor Risk Report, and Data Breaches – UpGuard, accessed May 16, 2025, https://www.upguard.com/security-report/tokopedia
85. List of data breaches – Wikipedia, accessed May 16, 2025, https://en.wikipedia.org/wiki/List_of_data_breaches
86. START Women in Tech 2023 With this summit, empower yourself to be an insightful woman-in-tech and contribute through technology. – Tokopedia Academy, accessed May 16, 2025, https://academy.tokopedia.com/programs/start-wit-2023/20
87. Jual Transformational Security Awareness by Perry Carpenter(Softcover B5) – Kota Tangerang Selatan – Galatican Bookstore | Tokopedia, accessed May 16, 2025, https://www.tokopedia.com/galaticanbookstore/transformational-security-awareness-by-perry-carpenter-softcover-b5
88. Details of 89 million Steam accounts for sale on the dark web – Computing UK, accessed May 16, 2025, https://www.computing.co.uk/news/2025/security/details-89-million-steam-accounts-for-sale
89. Were Steam user records leaked? Here’s what you need to know | CBC News, accessed May 16, 2025, https://www.cbc.ca/news/steam-data-leak-1.7535715
90. 89 million Steam accounts not hacked, confirms Valve – The Indian Express, accessed May 16, 2025, https://indianexpress.com/article/technology/tech-news-technology/89-million-steam-accounts-not-hacked-confirms-valve-10007770/
91. 89 million Steam accounts reportedly leaked. Change your password now. – DPEX Network, accessed May 16, 2025, https://www.dpexnetwork.org/news/view/T8Zm83sdBHdiEXVT3oH6tn
92. 89 million Steam accounts leaked on dark web – Perplexity, accessed May 16, 2025, https://www.perplexity.ai/discover/top/89-million-steam-accounts-leak-gtbijhSPQkGSE4AZtEt4AA
93. Data breach dismissed by Twilio after alleged Steam records leak | SC Media, accessed May 16, 2025, https://www.scworld.com/brief/data-breach-dismissed-by-twilio-after-alleged-steam-records-leak
94. Valve Responds to Alleged Steam Data Breach Reports: What Users Need to Know, accessed May 16, 2025, https://devoriales.com/post/390/valve-responds-to-alleged-steam-data-breach-reports-what-users-need-to-know
95. 89 million Steam accounts reportedly leaked. Change your password now. [Updated], accessed May 16, 2025, https://mashable.com/article/89-million-steam-accounts-leaked-change-your-password
96. Massive Twitter data leak purportedly done by insider – SC Media, accessed May 16, 2025, https://www.scworld.com/brief/massive-twitter-data-leak-purportedly-done-by-insider
97. Valve denies Steam data breach | Digital Watch Observatory, accessed May 16, 2025, https://dig.watch/updates/valve-denies-steam-data-breach
98. accessed January 1, 1970, https://darkforums.st/Thread-Morocco-Ministry-of-National-Land-Use-Planning-Leaked-Free-Download
99. Morocco investigates major data breach allegedly by Algerian hackers, accessed May 16, 2025, https://therecord.media/morocco-investigates-breach-hackers-algeria
100. Our Investigation of the CNSS Data Leak [Flash Report] – CybelAngel, accessed May 16, 2025, https://cybelangel.com/our-investigation-of-the-cnss-data-leak-flash-report/
101. Cyberwar in the Sahara: How Morocco’s Data Breach Exposes U.S. Vulnerabilities, accessed May 16, 2025, https://www.meforum.org/mef-online/cyberwar-in-the-sahara-how-moroccos-data-breach-exposes-u-s-vulnerabilities
102. Morocco data breach sparks wave of cyber retaliations | iZOOlogic, accessed May 16, 2025, https://izoologic.com/data-breach/morocco-data-breach-sparks-wave-of-cyber-retaliations/
103. Transparency Maroc: CNSS Data Breach Exposes Critical Flaws in Morocco’s Cybersecurity, accessed May 16, 2025, https://www.moroccoworldnews.com/2025/04/193104/transparency-maroc-cnss-data-breach-exposes-critical-flaws-in-moroccos-cybersecurity/
104. Hackers Breach Morocco’s Social Security Database in Unprecedented Cyberattack, accessed May 16, 2025, https://www.insurancejournal.com/news/international/2025/04/14/819643.htm
105. Cybercriminals Attacked National Social Security Fund of Morocco – Millions of Digital Identities at Risk of Data Breach – Resecurity, accessed May 16, 2025, https://www.resecurity.com/blog/article/cybercriminals-attacked-national-social-security-fund-of-morocco-millions-of-digital-identities-at-risk-of-data-breach
106. Cyberattack on Government Websites and Leakage of Sensitive Data of Two Million Citizens in Morocco. – Alawla Iraqi Channel, accessed May 16, 2025, https://en.alawla.tv/1842-cyberattack-on-government-websites-and-leakage-of-sensitive-data-of-two-million-citizens-in-morocco..html
107. Hackers breach Morocco’s social security database in an unprecedented cyberattack, accessed May 16, 2025, https://apnews.com/article/morocco-cyberattack-security-database-breach-753ce01484ceb8d1ec02459910285235
108. Decoding Cyberattacks on Morocco – CYFIRMA, accessed May 16, 2025, https://www.cyfirma.com/research/decoding-cyberattacks-on-morocco/
109. accessed January 1, 1970, https://darkforums.st/Thread-Mauritanian-Banks-Data-Leak
110. BANQUE AL WAVA MAURITANIENNE ISLAMIQUE (BAMIS) – OpenSanctions, accessed May 16, 2025, https://www.opensanctions.org/entities/bic-BAAWMRMR/
111. interactive banking reports & global finance rankings :: Banque Al Wava Mauritanienne Islamique (BAMIS) Financial Records – The Banker Database, accessed May 16, 2025, https://www.thebankerdatabase.com/index.cfm?fuseaction=bank_details.financials&bank_id=1111
112. BAAWMRMR XXX BIC / SWIFT Code – BANQUE AL WAVA MAURITANIENNE ISLAMIQUE (BAMIS) Mauritania – Wise, accessed May 16, 2025, https://wise.com/us/swift-codes/BAAWMRMRXXX
113. SWIFT code for BANQUE AL WAVA MAURITANIENNE ISLAMIQUE (BAMIS) – Remitly, accessed May 16, 2025, https://www.remitly.com/us/en/swift-codes/mauritania/baawmrmrxxx/banque-al-wava-mauritanienne-islamique-bamis
114. List of Islamic Banks in Mauritania – Global Banking | Finance | Review, accessed May 16, 2025, https://www.globalbankingandfinance.com/list-of-islamic-banks-in-mauritania
115. Branches for BANQUE AL WAVA MAURITANIENNE ISLAMIQUE (BAMIS) in Mauritania, accessed May 16, 2025, https://wise.com/us/swift-codes/countries/mauritania/banque-al-wava-mauritanienne-islamique-bamis
116. International – Banque Al wava Mauritanienne ISlamique – BAMIS, accessed May 16, 2025, https://bamis.mr/international.php
117. SWIFT Codes for banks in Mauritania – Bank Codes, accessed May 16, 2025, https://bank.codes/swift-code/mauritania/
118. Get A Mastercard, accessed May 16, 2025, https://mea.mastercard.com/en-region-mea/personal/find-a-card/get-mastercard.html
119. Bank SWIFT/BIC Codes in MAURITANIA, accessed May 16, 2025, https://trackmyswift.com/es/country/MAURITANIA
120. Security alert – BAMIS EBanking, accessed May 16, 2025, https://bamisdirect.bamis.mr/index.ebk?p=FLwoEAeSq%2BLA3DredWisjvH9rUulCFZFe6o3vDJKIDuVsZihagMCl1c2wB%2F3TWzR
121. accessed January 1, 1970, bamis.mr
122. Islamic Republic of Mauritania: Staff Report for the 2024 Article IV Consultation, Third Reviews Under the Arrangements Under the Extended Credit Facility and Extended Fund Facility, Request for Modification of Quantitative Performance Criteria, and Second Review Under the Resilience and Sustainability Facility Arrangement—Debt Sustainability Analysis in: IMF Staff Country Reports Volume 2024 Issue 362 (2024 – IMF eLibrary, accessed May 16, 2025, https://www.elibrary.imf.org/view/journals/002/2024/362/article-A002-en.xml
123. Islamic Republic of Mauritania: Selected Issues in: IMF Staff Country Reports Volume 2024 Issue 363 (2024) – IMF eLibrary, accessed May 16, 2025, https://www.elibrary.imf.org/view/journals/002/2024/363/article-A001-en.xml
124. Islamic Republic of Mauritania – IMF eLibrary, accessed May 16, 2025, https://www.elibrary.imf.org/downloadpdf/view/journals/002/2024/362/002.2024.issue-362-en.pdf
125. BCI Mauritania – About us, accessed May 16, 2025, https://bci-banque.com/en/mauritanie/nous-connaitre/
126. Cyber Threats to the Financial Sector in Africa : An Assessment of the Current Threat and an Analysis of Emerging Trends on the Future Threat Landscape – World Bank Documents and Reports, accessed May 16, 2025, https://documents.worldbank.org/en/publication/documents-reports/documentdetail/099830405172214598/p16477000601530760af01093740e385fe8
127. Mauritanian Cybersecurity Strategy – Digital Watch Observatory, accessed May 16, 2025, https://dig.watch/resource/mauritanian-cybersecurity-strategy
128. Continental Cyber Security Policymaking: Implications of the Entry Into Force of the Malabo Convention for Digital Financial Systems in Africa, accessed May 16, 2025, https://carnegieendowment.org/events/2023/07/continental-cyber-security-policymaking-implications-of-the-entry-into-force-of-the-malabo-convention-for-digital-financial-systems-in-africa
129. Tidum Security and BeamSec Establish Game- Changing Partnership, Boosting the Mauritania and West-African Cybersecurity Landscape, accessed May 16, 2025, https://beamsec.com/tidum-security-and-beamsec-establish-game-changing-partnership-boosting-the-mauritania-and-west-african-cybersecurity-landscape/
130. Mauritania Central Bank contracts G+D to foster digital currency, accessed May 16, 2025, https://www.privatebankerinternational.com/news/mauritania-central-bank-contracts-gd-to-foster-digital-currency/
131. Algeria, Mauritania Join Forces for Data Protection – We Are Tech Africa, accessed May 16, 2025, https://www.wearetech.africa/en/fils-uk/news/tech/algeria-mauritania-join-forces-for-data-protection
132. Mauritania | MFW4A – Making Finance Work for Africa, accessed May 16, 2025, https://www.mfw4a.org/country/mauritania
133. accessed January 1, 1970, https://forum.exploit.in/topic/259208/
134. WordPress security best practices — WordPress Admin Panel – Liquid Web, accessed May 16, 2025, https://www.liquidweb.com/wordpress/security/best-practices-admin/
135. How to Safely Grant WordPress Access to Your Developer or Support Team – Wooninjas, accessed May 16, 2025, https://wooninjas.com/wordpress-access/
136. 6 reasons why your WordPress website can be vulnerable to hackers, accessed May 16, 2025, https://updraftplus.com/6-reasons-why-your-wordpress-website-can-be-vulnerable-to-hackers/
137. 7 Ways to Protect Your WordPress Admin Area – ManageWP, accessed May 16, 2025, https://managewp.com/blog/protect-wordpress-admin-area
138. 5 WordPress Plugins Compromised; Millions of Websites at Risk – eSecurity Planet, accessed May 16, 2025, https://www.esecurityplanet.com/trends/wordpress-plugins-security-issues/
139. Is it safe to hand over the admin rights? – WordPress Stack Exchange, accessed May 16, 2025, https://wordpress.stackexchange.com/questions/121674/is-it-safe-to-hand-over-the-admin-rights
140. Managing WordPress and WooCommerce Threats With Attack Surface Intelligence, accessed May 16, 2025, https://securitytrails.com/blog/wordpress-woocommerce-risks-attack-surface
141. For the security experts around here, are there core WordPress features that pose security risks? – Reddit, accessed May 16, 2025, https://www.reddit.com/r/Wordpress/comments/1hj1kil/for_the_security_experts_around_here_are_there/
142. What kinds of security issues do WordPress sites have trouble with? – Reddit, accessed May 16, 2025, https://www.reddit.com/r/Wordpress/comments/mr5t71/what_kinds_of_security_issues_do_wordpress_sites/
143. 30+ of the Most Common WordPress Security Issues & Vulnerabilities – Jetpack, accessed May 16, 2025, https://jetpack.com/resources/wordpress-security-issues-and-vulnerabilities/
144. WordPress Vulnerabilities: Common Issues & How to Fix Them – SiteLock, accessed May 16, 2025, https://www.sitelock.com/blog/how-to-fix-wordpress-vulnerabilities/
145. What security issues does WordPress have? | Kaspersky official blog, accessed May 16, 2025, https://usa.kaspersky.com/blog/wordpress-security-issues/29460/
146. Is WordPress Secure? Here’s What the Data Says – Kinsta, accessed May 16, 2025, https://kinsta.com/blog/is-wordpress-secure/
147. State of WordPress Security In 2024 – Patchstack, accessed May 16, 2025, https://patchstack.com/whitepaper/state-of-wordpress-security-in-2024/
148. How the Latest WordPress Security Issue Is Impacting Enterprises – dotCMS, accessed May 16, 2025, https://www.dotcms.com/blog/how-the-latest-wordpress-security-issue-is-impacting-enterprises
149. Open Source Vulnerability Database – Patchstack, accessed May 16, 2025, https://patchstack.com/database/
150. WordPress Vulnerability Database – Wordfence, accessed May 16, 2025, https://www.wordfence.com/threat-intel/vulnerabilities
151. accessed January 1, 1970, https://xss.is/threads/137829/
152. Global SSL VPN Brute-Force Activity and AuthPoint Service Disruptions – WatchGuard, accessed May 16, 2025, https://www.watchguard.com/wgrd-blog/global-ssl-vpn-brute-force-activity-and-authpoint-service-disruptions
153. SSLVPN issue with AuthPoint today : r/WatchGuard – Reddit, accessed May 16, 2025, https://www.reddit.com/r/WatchGuard/comments/1g8vcue/sslvpn_issue_with_authpoint_today/
154. Brute Force Attacks Against Watchguard VPN Endpoints – SANS Internet Storm Center, accessed May 16, 2025, https://isc.sans.edu/diary/30984
155. Block source IPs for brute-force login attacks – WatchGuard Community, accessed May 16, 2025, https://community.watchguard.com/watchguard-community/discussion/3747/block-source-ips-for-brute-force-login-attacks
156. CVE-2025-2781 Detail – NVD, accessed May 16, 2025, https://nvd.nist.gov/vuln/detail/CVE-2025-2781
157. WatchGuard Mobile VPN with SSL Local Privilege Escalation via Non-Standard Installation Directory, accessed May 16, 2025, https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00004
158. Public Proof-of-Concept for WatchGuard Vulnerabilities Affecting Firebox SSO Gateway and Client – NHS Digital, accessed May 16, 2025, https://digital.nhs.uk/cyber-alerts/2024/cc-4555
159. Security Advisories | WatchGuard Technologies, accessed May 16, 2025, https://www.watchguard.com/wgrd-psirt/advisories
160. Mobile VPN with SSL Local Privilege Escalation Vulnerability | WatchGuard Technologies, accessed May 16, 2025, https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00010
161. Security Bulletins – Atomic Data, accessed May 16, 2025, https://www.atomicdata.com/security-bulletins/
162. CVE-2024-3661 Impact of TunnelVision Vulnerability | WatchGuard Technologies, accessed May 16, 2025, https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009
163. CVE-2024-4944 Detail – NVD, accessed May 16, 2025, https://nvd.nist.gov/vuln/detail/CVE-2024-4944
164. Diving Deeper into WatchGuard Pre-Auth RCE – CVE-2022-26318 – Assetnote, accessed May 16, 2025, https://www.assetnote.io/resources/research/diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318
165. Firewall Security Services | WatchGuard Technologies, accessed May 16, 2025, https://www.watchguard.com/wgrd-products/security-services
166. Unified Security Platform® | WatchGuard Technologies, accessed May 16, 2025, https://www.watchguard.com/wgrd-solutions/unified-security-platform
167. Confidently Protect Your Endpoints – WatchGuard, accessed May 16, 2025, https://www.watchguard.com/wgrd-resource-center/video/confidently-protect-your-endpoints
168. How Unified Security Works – WatchGuard, accessed May 16, 2025, https://www.watchguard.com/wgrd-resource-center/video/see-watchguards-unified-security-platform-action
169. Video – The Power of Security Automation | WatchGuard Technologies, accessed May 16, 2025, https://www.watchguard.com/wgrd-resource-center/video/power-security-automation
170. Video – Automation Core | WatchGuard Technologies, accessed May 16, 2025, https://www.watchguard.com/wgrd-resource-center/video/automation-core
171. Video – WatchGuard Cloud Security Services Help Grow MSP Businesses, accessed May 16, 2025, https://www.watchguard.com/wgrd-resource-center/video/watchguard-cloud-security-services-help-grow-msp-businesses
172. WatchGuard Video: Network Security Overview, accessed May 16, 2025, https://www.watchguard.com/wgrd-resource-center/video/network-security-overview
173. Massive brute force attack uses 2.8 million IPs to target VPN devices – Bleeping Computer, accessed May 16, 2025, https://www.bleepingcomputer.com/news/security/massive-brute-force-attack-uses-28-million-ips-to-target-vpn-devices/
174. ‘Next level’ brute-force attack uses 2.8 million IPs to target VPNs | SC Media, accessed May 16, 2025, https://www.scworld.com/news/next-level-brute-force-attack-uses-28-million-ips-to-target-vpns
175. What is a Brute Force Attack? – Ericom Software, accessed May 16, 2025, https://www.ericom.com/glossary/what-is-a-brute-force-attack/
176. Black Basta uses brute-forcing tool to attack edge devices – Cybersecurity Dive, accessed May 16, 2025, https://www.cybersecuritydive.com/news/black-basta-uses-brute-forcing-tool-to-attack-edge-devices/742672/
177. How to defend against brute force attacks – GoodAccess, accessed May 16, 2025, https://www.goodaccess.com/blog/brute-force-attack-what-is
178. Brute-Force Operations Targeting VPNs Across Critical Industrial Sectors – Dragos, accessed May 16, 2025, https://www.dragos.com/resources/datasheet/brute-force-operations-targeting-vpns-across-critical-industrial-sectors/
179. VPN brute force login attempts : r/sysadmin – Reddit, accessed May 16, 2025, https://www.reddit.com/r/sysadmin/comments/1c5uwle/vpn_brute_force_login_attempts/
180. Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials – Cisco Talos Blog, accessed May 16, 2025, https://blog.talosintelligence.com/large-scale-brute-force-activity-targeting-vpns-ssh-services-with-commonly-used-login-credentials/
181. Solved: brute force attack from VPN – Cisco Community, accessed May 16, 2025, https://community.cisco.com/t5/vpn/brute-force-attack-from-vpn/td-p/5037423
182. What Is a Brute Force Attack? | IBM, accessed May 16, 2025, https://www.ibm.com/think/topics/brute-force-attack
183. Brute force attacks explained: types, risks, and how to stay safe – Malwarebytes, accessed May 16, 2025, https://www.malwarebytes.com/cybersecurity/basics/brute-force-attack
184. Brute Force Attacks: Techniques, Types & Prevention – Splunk, accessed May 16, 2025, https://www.splunk.com/en_us/blog/learn/brute-force-attacks.html
185. Technical Vulnerabilities of VPNs – Cyber Security Tribe, accessed May 16, 2025, https://www.cybersecuritytribe.com/articles/technical-vulnerabilities-of-vpns
186. The Risks of Unmanaged Virtual Private Networks (VPNs) – SensCy, accessed May 16, 2025, https://senscy.com/the-risks-of-unmanaged-virtual-private-networks-vpns/
187. Why Adversaries Target VPN Appliances: The Pathway from IT to OT Cyber Attack | Dragos, accessed May 16, 2025, https://www.dragos.com/blog/why-adversaries-target-vpn-appliances-the-pathway-from-it-to-ot-cyber-attack/
188. April ’24 Brute Force Attacks & VPN Vulnerabilities – OpenVPN Blog, accessed May 16, 2025, https://blog.openvpn.net/april-2024-vpn-vulnerabilities
189. Cisco warns actively exploited CVE can lead to DoS attacks against VPN services, accessed May 16, 2025, https://www.cybersecuritydive.com/news/cisco-exploited-cve-vpn/731216/
190. Cisco VPNs Suffer Brute Force Attacks : Here’s Your Shield! – PureID, accessed May 16, 2025, https://www.pureid.io/cisco-warns-of-brute-force-on-vpn/
191. Rocke Evolves Its Arsenal With a New Malware Family Written in Golang | Anomali Labs, accessed May 16, 2025, https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
192. Coin Mining by Opportunistic and Automated Threats – Gigamon Blog, accessed May 16, 2025, https://blog.gigamon.com/2018/01/12/coin-mining-by-opportunistic-and-automated-threats/
193. Ransomware gang creates tool to automate VPN brute-force attacks – Bleeping Computer, accessed May 16, 2025, https://www.bleepingcomputer.com/news/security/black-basta-ransomware-creates-automated-tool-to-brute-force-vpns/
194. Inside BRUTED: Black Basta (RaaS) Members Used Automated Brute Forcing Framework to Target Edge Network Devices – EclecticIQ Blog, accessed May 16, 2025, https://blog.eclecticiq.com/inside-bruted-black-basta-raas-members-used-automated-brute-forcing-framework-to-target-edge-network-devices
195. Automated brute forcing tool leveraged in Black Basta ransomware intrusions – SC Media, accessed May 16, 2025, https://www.scworld.com/brief/automated-brute-forcing-tool-leveraged-in-black-basta-ransomware-intrusions
196. Infamous ransomware hackers reveal new tool to brute-force VPNs – TechRadar, accessed May 16, 2025, https://www.techradar.com/pro/security/infamous-ransomware-hackers-reveal-new-tool-to-brute-force-vpns
197. Hackers create “BRUTED” tool to attack VPNs – how to stay safe | Tom’s Guide, accessed May 16, 2025, https://www.tomsguide.com/computing/vpns/hackers-create-bruted-tool-to-attack-vpns-how-to-stay-safe
198. accessed January 1, 1970, https://forum.exploit.in/topic/259222/?tab=comments#comment-1565901
199. Cybersecurity Firms Fire Fresh Warnings After US Tax Authority Is Hit By Hackers, accessed May 16, 2025, https://www.wealthbriefing.com/html/article.php/cybersecurity-firms-fire-fresh-warnings-after-us-tax-authority-is-hit-by-hackers-
200. IRS Hacked: Thieves Steal Personal Information of 104000 Taxpayers, accessed May 16, 2025, https://www.ciab.com/resources/irs-hacked-thieves-steal-personal-information-of-104000-taxpayers/
201. IRS data leak exposes personal info of 120,000 taxpayers – Bleeping Computer, accessed May 16, 2025, https://www.bleepingcomputer.com/news/security/irs-data-leak-exposes-personal-info-of-120-000-taxpayers/
202. How Hackers Breached the IRS and Stole $50 Million – Tax Foundation, accessed May 16, 2025, https://taxfoundation.org/blog/how-hackers-breached-irs-and-stole-50-million/
203. IRS-Affiliated Site for Charities Hit by Data Breach | Accounting Today News, accessed May 16, 2025, https://www.501c3.org/irs-affiliated-site-for-charities-hit-by-data-breach-accounting-today-news/
204. Unlocking Service Reliability: Exploring SLO as a Service (SLOaaS) with Garuda Platform, accessed May 16, 2025, https://live.paloaltonetworks.com/t5/community-blogs/unlocking-service-reliability-exploring-slo-as-a-service-sloaas/ba-p/577816
205. Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475 | CISA, accessed May 16, 2025, https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a
206. A Deep Dive into the Russian Cybercrime Forums Shaping 2023’s Landscape – Munit.io, accessed May 16, 2025, https://munit.io/a-deep-dive-into-the-russian-cybercrime-forums-shaping-2023s-landscape/
207. Top 10 Dark Web Forums – ThreatMon Blog, accessed May 16, 2025, https://threatmon.io/top-10-dark-web-forums/
208. Threat Actor Leverages Compromised Account of Former Employee to Access State Government Organization | CISA, accessed May 16, 2025, https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-046a
209. 5 cybersecurity weaknesses in the banking and finance industry – Swivel Secure, accessed May 16, 2025, https://swivelsecure.com/solutions/banking-finance/5-cybersecurity-weaknesses-threats-in-banking-and-finance-industry/
210. Dread: The Dark Web’s Reddit-Like Forum – SOCRadar® Cyber Intelligence Inc., accessed May 16, 2025, https://socradar.io/dread-the-dark-webs-reddit-like-forum/
211. Configure Block Failed Login Attempts – WatchGuard, accessed May 16, 2025, https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/WG-Cloud/Devices/managed/auth_firebox_ip_block.html?TocPath=WatchGuard%20Cloud%7CManage%20Fireboxes%20and%20FireClusters%7CConfigure%20Cloud-Managed%20Fireboxes%7CConfigure%20Block%20Failed%20Login%20Attempts%7C_____0