I. Executive Summary
The past 24 hours have underscored a dynamic and increasingly complex cybersecurity landscape, marked by a notable convergence of traditional cybercriminal activities and politically motivated hacktivism. A review of recent breach incidents reveals a broad spectrum of attack types, from sophisticated data exfiltrations and ransomware deployments to disruptive defacements and the illicit sale of sensitive information on dark web marketplaces.
A significant observation is the blurring of lines between financially driven cybercrime and geopolitical hacktivism. Groups historically associated with ideological agendas are increasingly adopting tactics that yield monetary gain, such as offering “DDoS-for-hire” services or selling compromised access and data. This shift indicates that threat actors are embracing hybrid models, where political objectives may be intertwined with, or even funded by, traditional criminal enterprises.1 This evolution means organizations can no longer compartmentalize threats into purely “criminal” or “ideological” categories. A politically motivated attack might still result in data exfiltration for financial gain or the sale of compromised access, thereby increasing the overall risk profile across all sectors, not solely those directly involved in geopolitical disputes. This necessitates a defense strategy that anticipates both disruptive and financially exploitative outcomes from a single adversary.
Furthermore, critical infrastructure continues to emerge as a primary battleground in the cyber domain. Multiple threat actors, ranging from ransomware groups like Ghost (Cring) and Medusa to state-sponsored entities such as OilRig (APT34) and specialized groups like Z-Pentest, are consistently targeting vital sectors including energy, water, financial services, and government agencies.1 This consistent targeting underscores a strategic shift towards disrupting essential services and national capabilities. Organizations operating critical infrastructure must significantly elevate their cybersecurity posture, extending robust protections beyond traditional IT networks to include their Operational Technology (OT) and Industrial Control Systems (ICS) environments. This requires specialized security measures, continuous monitoring, and a deep understanding of the unique vulnerabilities and potentially catastrophic impacts associated with industrial control systems. These attacks represent a direct threat to national security and public safety, demanding a proactive and resilient defense.
II. Daily Incident Overview
The incidents observed over the last 24 hours highlight a diverse array of cyber threats impacting various sectors globally. This section provides a summary of these events, offering a quick reference to the scope of malicious activity. The range of attack types and targeted sectors signifies a broad threat surface that organizations must contend with. The daily threat landscape is highly diverse, with no single attack type or target sector universally dominating. This implies that defenders face a multi-faceted threat landscape demanding a comprehensive, multi-layered cybersecurity strategy. Organizations cannot afford to focus defenses on a single threat vector or assume immunity based on their sector. Instead, they must implement a broad range of defensive capabilities designed to counter diverse attack methodologies and motivations.
Below is a summary of the reported cybersecurity incidents:
III. Detailed Incident Log
This section provides a comprehensive, contextualized narrative for each reported incident, integrating available intelligence on the involved threat actors and their typical tactics, techniques, and procedures (TTPs).
INC001: Data Leak at The Habitats Trust (India)
- Victim/Target Profile: The Habitats Trust, an organization based in India, likely operating within the non-profit or environmental sector.
- Incident Type: Data Breach, specifically a data leak.
- Threat Actor(s) Identified: Arabian Ghosts.
- Incident Description & Context: The Arabian Ghosts hacktivist group has claimed responsibility for a data leak impacting The Habitats Trust. This claim was disseminated via their Telegram channel. Arabian Ghosts is recognized as one of several prominent hacktivist groups, including Anonymous VNLBN, Bangladesh Civilian Force, SPIDER-X, and RuskiNet, that have been actively coordinating cyberattacks, particularly amidst escalating tensions between India and Pakistan.3 These groups frequently employ various methods, including Distributed Denial of Service (DDoS) attacks, website defacements, and data leaks, with the objective of disrupting services and undermining public confidence.3 The group’s involvement in broader hacktivist alliances highlights a growing pattern of collaboration among groups with different ideological motivations, uniting in coordinated campaigns to target perceived adversaries.3 Such public claims and evidence, while serving as valuable initial intelligence, require critical evaluation for accuracy, as some hacktivist groups have been observed making false claims for notoriety or marketing.2
- Associated Resources:
- Published URL: https://t.me/ARABIAN_GHOSTS/964
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/1ae60d10-c40c-438b-bf3b-0ef8b09f23c0.png
INC002: Website Defacement of dav.8bar.us
- Victim/Target Profile: dav.8bar.us, an unidentified website. The nature of the domain suggests it could be a personal or small business site, or potentially a test/development server.
- Incident Type: Website Defacement.
- Threat Actor(s) Identified: Cyb3r Drag0nz Team.
- Incident Description & Context: The Cyb3r Drag0nz Team has claimed responsibility for defacing the website dav.8bar.us. This group is a hacktivist team with a documented history of launching DDoS attacks, cyber defacements, and engaging in data leak activities.8 Their actions are driven by political or ideological agendas, often reflected in the nature of their attacks and chosen targets.9 While historically composed of low-skilled individuals, hacktivist groups like Cyb3r Drag0nz have evolved into more capable teams, increasing the risks they pose to organizations.9 They are known for leveraging social media platforms such as Instagram, Twitter, Telegram, Facebook, and YouTube to announce their targeting and intrusions, using these channels to amplify their impact and gain notoriety.8 The act of defacing a website aims to undermine public trust in the targeted organization or government while promoting the group’s political stance.10
- Associated Resources:
- Published URL: https://t.me/Cyb3rDrag0nz_Team/127
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/84d125d4-94d9-4b0c-badd-d564a969a984.png
INC003: Alleged Data Leak from Ministry of Road Transport and Highways Division (Bangladesh)
- Victim/Target Profile: Ministry of Road Transport and Highways Division, a government entity in Bangladesh. Government organizations are frequently high-profile targets for state-sponsored or hacktivist groups.11
- Incident Type: Data Leak.
- Threat Actor(s) Identified: OneERA.
- Incident Description & Context: A threat actor identified as OneERA has allegedly leaked data pertaining to the Ministry of Road Transport and Highways Division in Bangladesh. While specific details about OneERA are limited in the provided intelligence, the incident aligns with the broader trend of hacktivist and cybercriminal groups targeting government institutions for data exfiltration.8 The sale or public release of such data on forums like XSS, where this claim was made, is a common tactic for threat actors to gain reputation or financial benefit.12 This type of activity contributes to the interconnectedness and escalation of attack types, where an initial compromise can lead to multiple forms of impact, including reputational damage and potential follow-on attacks. Incident response plans must therefore be dynamic and comprehensive, accounting for the potential escalation of an initial breach into multi-faceted attacks.
- Associated Resources:
- Published URL: https://xss.is/threads/138524/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/b77f98e8-d193-41c5-b286-302316e6d19e.png
INC004: Unauthorized Access to Unidentified Water Supply Station (Russia)
- Victim/Target Profile: An unidentified water supply station in Russia, categorized as critical infrastructure. Critical infrastructure, particularly water and energy sectors, are high-value targets due to their potential for widespread disruption.1
- Incident Type: Unauthorized Access, specifically targeting Operational Technology (OT).
- Threat Actor(s) Identified: Z-PENTEST ALLIANCE.
- Incident Description & Context: The Z-PENTEST ALLIANCE has claimed unauthorized access to an unidentified water supply station in Russia. This group is distinguished by its ability to penetrate operational control systems (OT) in critical infrastructures, primarily targeting the energy (oil and gas) and water sectors.1 Their TTPs include exploiting vulnerabilities in ICS/SCADA systems and demonstrating their ability to manipulate critical functions such as water pumping.1 This incident exemplifies the strategic importance of critical infrastructure as a target, where attacks go beyond data theft to directly impact physical processes and potentially public safety. The group also releases videos showing their access to critical systems to instill fear and uncertainty in victims.1 The specialized capabilities required to penetrate OT environments highlight the need for sector-specific risk profiles and tailored defense strategies.
- Associated Resources:
- Published URL: https://t.me/c/2503473563/196
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/719f8402-66fe-4f8c-87b6-31e3691d0503.png
INC005: Data Breach at LiquidatorPro (Ukraine)
- Victim/Target Profile: LiquidatorPro, a Ukrainian bankruptcy service company. This target may be chosen due to its financial or governmental ties, making it relevant for actors with geopolitical or financial motivations.
- Incident Type: Data Breach.
- Threat Actor(s) Identified: KEDIRISECTEAM.
- Incident Description & Context: KEDIRISECTEAM has allegedly breached LiquidatorPro, a Ukrainian bankruptcy service company, and leaked approximately 1,600 records. While specific details on KEDIRISECTEAM are limited in the provided intelligence, the incident aligns with the broader landscape of cybercriminals and hacktivists targeting organizations for data exfiltration. Threat actors often exploit weaknesses in systems to carry out disruptive attacks.13 The focus on a Ukrainian entity suggests potential geopolitical motivations, which can be intertwined with financial gain. The presence of such data on dark web forums like DarkForums.st indicates the commercialization of stolen data, where information is traded or sold to other cybercriminals.12
- Associated Resources:
- Published URL: https://darkforums.st/Thread-1-6k-Ukrainian-bankruptcy-service-company-liquidatorpro-com-ua
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/09934bf5-9852-4735-8a70-cddc1f44d213.png
INC006: Data Breach at Libya Education Management System
- Victim/Target Profile: Libya Education Management System, an educational institution. Educational institutions are frequently targeted by various threat actors, including ransomware groups and hacktivists.4
- Incident Type: Data Breach.
- Threat Actor(s) Identified: wh6ami.
- Incident Description & Context: The threat actor “wh6ami” has claimed a data breach affecting the Libya Education Management System. While “wh6ami” is a generic term for an unidentified threat actor, the incident highlights the vulnerability of educational institutions to data breaches. Threat actors, whether cybercriminals or ideologically motivated, often seek to exploit weaknesses to gain access to sensitive information.13 The data from educational systems can be valuable for identity theft or further social engineering attacks. The lack of specific attribution for “wh6ami” emphasizes the challenge of identifying threat actors, particularly when they operate anonymously or without a distinct group identity. Cyber threat profiling is crucial for understanding how threats are likely to materialize and impact organizations.15
- Associated Resources:
- Published URL: https://t.me/c/2602447593/235
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/c9796e58-9947-41ad-8330-59da81720cb1.png
INC007: Alleged Data Leak from Municipal Chamber of Cacique Doble (Brazil)
- Victim/Target Profile: Municipal Chamber of Cacique Doble, a local government entity in Brazil. Government agencies are common targets for data breaches, often driven by political motives or the desire to expose sensitive information.
- Incident Type: Data Leak.
- Threat Actor(s) Identified: RATNICK.
- Incident Description & Context: A threat actor named RATNICK has allegedly leaked data from the Municipal Chamber of Cacique Doble in Brazil. While “RATNICK” is not a known, profiled threat actor in the provided intelligence, the incident follows a common pattern of data exfiltration from government entities. The motivation behind such attacks can vary, from hacktivism seeking to disrupt or expose, to cybercriminals looking to monetize stolen information. The severity of a data leak is often assessed by a CVE rating or CVSS score, which quantifies the potential impact of a vulnerability.16 However, these scores are limited as they do not provide real-time insight into the probability of an attack or the intent of threat actors.16 This underscores the importance of proactive threat intelligence that goes beyond static vulnerability assessments to understand the dynamic threat landscape.
- Associated Resources:
- Published URL: https://xss.is/threads/138500/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/60761f0a-42e5-4ab5-b5c5-a536ecc939b7.png
INC008: Sale of Database from Provincial Police Region 1 (Thailand)
- Victim/Target Profile: Provincial Police Region 1 in Thailand, a law enforcement agency. Such targets are highly attractive for threat actors seeking sensitive personal data, intelligence, or leverage.
- Incident Type: Data Sale (Database).
- Threat Actor(s) Identified: offshoree.
- Incident Description & Context: The threat actor “offshoree” is advertising the sale of a database allegedly belonging to Provincial Police Region 1 in Thailand on a dark web forum. While “offshoree” is not a specific group, the term often refers to individuals or entities operating from offshore locations, sometimes leveraging remote hiring processes to infiltrate organizations as insider threats, as seen with groups like Famous Chollima.17 The sale of stolen databases is a core component of the cybercrime ecosystem on the dark web, where forums like XSS facilitate the buying and selling of illicit goods and stolen data.12 This commercialization of stolen data is a significant trend, with marketplaces like BidenCash actively leaking large datasets as marketing tools to attract buyers.12 This incident highlights the continuous industrialization of stolen data, where data breaches are not merely isolated events but feed a continuous, highly profitable underground economy.
- Associated Resources:
- Published URL: https://xss.is/threads/138502/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/52c0a06d-1bf0-47ef-be06-9297bec60324.png
INC009: Sale of Unauthorized Domain User Access to Unidentified Organization (Indonesia)
- Victim/Target Profile: An unidentified organization in Indonesia. The sale of domain user access suggests a high-value target, as such access can provide extensive control over a network.
- Incident Type: Unauthorized Access (Sale of Access).
- Threat Actor(s) Identified: kovalidis.
- Incident Description & Context: A threat actor identified as “kovalidis” is offering the sale of 15.7 million domain user access credentials for an unidentified organization in Indonesia. While “kovalidis” is not a known, profiled threat actor, the sale of unauthorized access is a critical initial access vector for many sophisticated attacks. This type of access can be leveraged by ransomware groups, data exfiltration teams, or even state-sponsored actors for espionage. The provided intelligence mentions SocGholish (also known as FakeUpdates, tracked by Trend Micro as Water Scylla) as a malware-as-a-service (MaaS) framework whose activities lead to ransomware deployment, often through compromised legitimate websites that trick users into downloading malicious files.18 Medusa ransomware actors also use legitimate remote access software for lateral movement and execution.6 The offering of such extensive domain user access on a dark web forum indicates a significant compromise, potentially leading to further exploitation and payload deployment.18
- Associated Resources:
- Published URL: https://ramp4u.io/threads/indonesia-15-7kk-15-7-million.3122/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/5fbc6eae-d3b6-40cb-a6ea-9c3aa20ec28e.png
INC010: Document Database Leak from Pejabat Pengelola Informasi dan Dokumentasi (Indonesia)
- Victim/Target Profile: Pejabat Pengelola Informasi dan Dokumentasi (PPID) in Indonesia, likely a government or public information management agency. Such entities hold sensitive documents and are attractive targets for data leaks.
- Incident Type: Data Breach (Document Database Leak).
- Threat Actor(s) Identified: offshoree.
- Incident Description & Context: The threat actor “offshoree” has claimed a document database leak from Pejabat Pengelola Informasi dan Dokumentasi in Indonesia. As noted previously, “offshoree” often implies operations from remote locations, sometimes leveraging deceptive hiring practices to gain insider access.17 The leak of a document database suggests a focus on sensitive records, potentially for intelligence gathering, financial exploitation, or public exposure. Dark web forums like DarkForums.st, where this claim was made, are central hubs for trading stolen data.14 This incident further underscores the industrialization and commercialization of stolen data, where compromised information from various sectors is quickly brought to market for sale or public dissemination.
- Associated Resources:
- Published URL: https://darkforums.st/Thread-Document-DATABASE-APLIKASI-SITOMAS-SURABAYA–11149
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/d117c85a-ddd9-4f89-9475-793ea63ca483.png
INC011: Data Breach at Istanbul Senin (Turkey)
- Victim/Target Profile: Istanbul Senin, an entity in Turkey, with a claim of 3.7 million people’s data being leaked. This suggests a large-scale data breach impacting a significant number of individuals, potentially from a public service, e-commerce, or similar large-scale data holder.
- Incident Type: Data Breach.
- Threat Actor(s) Identified: offshoree (claiming to be by “Powerful Greek Army”).
- Incident Description & Context: The threat actor “offshoree” has claimed a data breach affecting Istanbul Senin, asserting the leak of 3.7 million people’s data, attributed to a group named “Powerful Greek Army.” This incident, again involving “offshoree,” highlights the common practice of threat actors operating from remote or obscured locations, potentially using “laptop farms” to disguise their true origin.17 The scale of the claimed data leak is substantial, indicating a significant compromise of personal information. The attribution to a “Powerful Greek Army” suggests a potential hacktivist motivation, possibly linked to geopolitical tensions, even if the primary actor “offshoree” might be financially motivated. The sale of such large datasets on dark web forums like DarkForums.st demonstrates the continued commercialization of stolen data and the resilience of these illicit markets.14
- Associated Resources:
- Published URL: https://darkforums.st/Thread-IstanbulSenin-Database-3-7m-people-by-Powerful-Greek-Army
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/7b058fba-74b8-4bb6-9507-7d923345acc5.png
INC012: Sale of Credit Card Records from Global Financial Institutions
- Victim/Target Profile: Global Financial Institutions. This targets the financial sector, a high-value target for cybercriminals seeking direct monetary gain.
- Incident Type: Data Sale (Credit Card Records).
- Threat Actor(s) Identified: offshoree.
- Incident Description & Context: The threat actor “offshoree” is offering credit card records for sale, allegedly sourced from global financial institutions, on the Exploit.in forum. This directly aligns with the industrialization of cybercrime, where stolen payment information is a highly sought-after commodity on dark web marketplaces.12 These platforms facilitate the buying and selling of stolen payment cards, often with specialized vendors.19 The BidenCash dark web market, for example, recently leaked nearly one million credit card records as a marketing tactic, demonstrating the aggressive promotion of stolen financial data.12 The methods for obtaining such data have evolved from physical skimming to sophisticated e-skimming (Magecart attacks) and direct cyberattacks on financial institutions.19 This incident underscores the persistent threat of financial fraud and the need for continuous monitoring of the dark web for leaked customer or payment data.12
- Associated Resources:
- Published URL: https://forum.exploit.in/topic/259751/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/84d125d4-94d9-4b0c-badd-d564a969a984.png
IV. Threat Actor Spotlight: Profiles & Tactics
Understanding the adversaries is paramount to effective cybersecurity. This section provides detailed intelligence on the specific threat actors involved in the day’s incidents, offering a deeper understanding of their capabilities, motivations, and operational methods. The consistent presence of aliases, alliances, and splinter groups across multiple threat actor profiles indicates that many significant cyber operations are not conducted by isolated entities. Instead, they are often the result of interconnected networks that share resources, expertise, and potentially even TTPs. This means defense strategies must move beyond a narrow focus on individual threat groups to understanding the broader ecosystem of alliances and shared methodologies.
| Threat Actor Name | Primary Motivation | Key TTPs (Summary) | Primary Target Sectors | Noteworthy Alliances/Characteristics |
| Arabian Ghosts | Political/Ideological (Hacktivism) | DDoS attacks, website defacements, data leaks, social media propaganda | Government, Critical Infrastructure, Various (indiscriminate) | Part of broader hacktivist alliances amidst geopolitical tensions (e.g., India-Pakistan) 3 |
| Cyb3r Drag0nz Team | Political/Ideological (Hacktivism) | DDoS attacks, cyber defacements, data leaks, social media announcements | Israeli targets, various (indiscriminate) | Evolved into medium- to high-skill team; active on multiple social media platforms 8 |
| OneERA | Unconfirmed (Likely Hacktivism/Financial) | Data leaks, potentially exploiting vulnerabilities | Government, unspecified | Details limited, but aligns with broader data exfiltration trends 20 |
| Z-PENTEST ALLIANCE | Political/Disruptive (Pro-Russian ties) | OT/ICS penetration, zero-day exploitation, social engineering, fear exploitation, sale of access | Energy (oil/gas), Water (Critical Infrastructure) | Close ties to pro-Russian actors; confirmed splinter faction of Peoples Cyber Army (PCA); works with SECTOR16, OverFlame, PCA 1 |
| KEDIRISECTEAM | Unconfirmed (Likely Financial/Political) | Data breaches, exploitation of system weaknesses | Unspecified, potentially government/financial | Generic term for threat actor; cyber threat profiling is crucial to understand their methods 13 |
| wh6ami | Unconfirmed (Likely Financial/Political) | Data breaches, exploiting system weaknesses | Unspecified, potentially education | Generic term for threat actor; focuses on vulnerabilities rather than specific people 13 |
| RATNICK | Unconfirmed (Likely Financial/Political) | Data leaks, exploitation of system weaknesses | Unspecified, potentially government | Generic term for threat actor; CVE ratings help prioritize vulnerabilities but lack real-time context 16 |
| offshoree | Financial (Data Sales) | Data breaches, credit card sales, document leaks, potentially insider threats via remote hiring | Financial, Government, various | Often implies operations from remote locations; leverages dark web marketplaces for illicit trade 12 |
| kovalidis | Financial (Access Sales) | Sale of unauthorized access (e.g., domain user access), potentially leveraging malware-as-a-service | Unspecified, potentially large organizations | May be associated with MaaS frameworks like SocGholish or Medusa RaaS affiliates 6 |
Arabian Ghosts
- Aliases & Affiliations: Arabian Ghosts is a hacktivist group that operates alongside other prominent groups such as Anonymous VNLBN, Bangladesh Civilian Force, SPIDER-X, RuskiNet, AnonPioneers, Rabbit Cyber Team, and Red Wolf Cyber. They are part of broader hacktivist alliances that have been observed coordinating efforts, particularly amidst geopolitical tensions like those between India and Pakistan.3
- Origin & Motivation: This group is primarily politically, socially, and religiously motivated, aligning with hacktivist agendas. Their actions are driven by a desire to disrupt services and undermine public confidence related to specific geopolitical causes.3
- Typical TTPs: Arabian Ghosts employs various methods, including Distributed Denial of Service (DDoS) attacks, website defacements, and data leaks. They utilize social media platforms, notably Telegram, to claim responsibility for attacks and amplify their impact.3 Some hacktivist groups, including those in alliances, have evolved to offer “DDoS-as-a-service,” indicating a commercialization of their disruptive capabilities.3
- Targeting Patterns: They target critical infrastructure and government-related sites, often high-profile targets in regions affected by geopolitical conflicts.3
- Notable Activities/Characteristics: Arabian Ghosts is recognized for its participation in coordinated campaigns, demonstrating a growing pattern of collaboration among ideologically diverse groups to target shared perceived adversaries.3
Cyb3r Drag0nz Team
- Aliases & Affiliations: The group is known as Cyb3r Drag0nz Team. While not explicitly linked to broader alliances in the provided material, their activities align with other hacktivist groups engaged in similar operations.
- Origin & Motivation: Cyb3r Drag0nz Team is a hacktivist group driven by political or ideological agendas. Their actions are reflected in the nature of their attacks and their chosen targets.9 They do not typically seek financial gain, though overlaps with cybercrime can occur.9
- Typical TTPs: This group has a history of launching DDoS attacks, cyber defacements, and engaging in data leak activities.8 They are known for exploiting various social media platforms, including Instagram, Twitter, Telegram, Facebook, and YouTube, to announce their targeting and intrusions, and to post updates.8 Their methods have evolved, indicating a shift from low-skilled individuals to more capable teams.9
- Targeting Patterns: They have specifically targeted Israeli entities, including a DDoS attack against the official website of the Israeli Air Force.8 They also claim to have leaked data on over a million Israeli citizens.8
- Notable Activities/Characteristics: The Cyb3r Drag0nz Team has been observed taking full advantage of social media to announce their intrusions and disseminate claims, a common tactic for hacktivist groups to amplify their impact and gain notoriety.8 They have claimed to steal and leak large datasets of personal information.8
OneERA
- Aliases & Affiliations: Details on aliases and specific affiliations for OneERA are not extensively provided in the snippets. However, the context of threat actor profiles suggests that groups often have multiple handles and may be part of larger networks.20
- Origin & Motivation: The motivation for OneERA is unconfirmed, but based on the incident (data leak from a government entity), it could be hacktivism (political/ideological) or financially motivated cybercrime.
- Typical TTPs: As a threat actor involved in a data leak, their TTPs likely involve gaining unauthorized access to systems, exfiltrating data, and then publicly releasing or selling it on dark web forums.12
- Targeting Patterns: The incident indicates a focus on government entities. Threat intelligence platforms like SOCRadar provide profiles on various threat groups, including those focused on intelligence gathering or industrial espionage.21
- Notable Activities/Characteristics: The name “OneERA” itself is not a widely profiled group in the provided intelligence, suggesting it might be a new or less-documented entity, or an alias for a known group.
Z-PENTEST ALLIANCE
- Aliases & Affiliations: The group is known as Z-Pentest. It has probable origins in Serbia but maintains close ties to pro-Russian actors.1 Notably, the Peoples Cyber Army (PCA) confirmed Z-Pentest as a splinter faction in February 2025.10 Z-Pentest also works in tandem with groups like SECTOR16, OverFlame, and the Peoples Cyber Army (PCA) to coordinate attacks and share resources.1 This interconnectedness of cyber adversaries indicates that many significant operations are the result of networks that share resources and expertise.
- Origin & Motivation: First appearing in October 2023, Z-Pentest is likely politically motivated due to its ties to pro-Russian actors. Their primary motivation appears to be disruption and influence, particularly targeting critical infrastructure.1 They may also be funded by state or non-state third parties, though this is unconfirmed.1
- Typical TTPs: Z-Pentest is highly skilled in penetrating Operational Technology (OT) systems in critical infrastructures. They exploit vulnerabilities in ICS/SCADA systems, including zero-day vulnerabilities, often using information obtained from the dark web.1 They employ social engineering techniques to gain sensitive information or system access. The group disseminates selective or manipulated information to influence perceptions and releases videos showing their access to critical systems to instill fear and uncertainty.1 They are also known to sell access to industrial systems and zero-day vulnerabilities on the dark web.1 The hybridization and sophistication of their TTPs, blending advanced capabilities with social engineering, make detection challenging.
- Targeting Patterns: Z-Pentest mainly targets the energy (oil and gas) and water sectors, aiming to disrupt critical systems like oil wells and water treatment plants.1
- Notable Activities/Characteristics: The group operates in a decentralized and fluid manner, with anonymous members, making identification and tracking difficult.1 They coordinate attacks on Telegram and private forums and use X (Twitter) for propaganda and amplification.1 Their ability to cause major disruptions in critical infrastructure highlights the severe, potentially physical, and widespread consequences of their attacks.
KEDIRISECTEAM
- Aliases & Affiliations: KEDIRISECTEAM is a generic term for an unidentified threat actor. No specific aliases or affiliations are provided in the intelligence.
- Origin & Motivation: The motivation for KEDIRISECTEAM is unconfirmed, but as a threat actor involved in a data breach, it could be financially motivated (e.g., selling stolen data) or ideologically driven (e.g., hacktivism). Threat actors generally seek monetary gain or are politically/nationalistically motivated.13
- Typical TTPs: Threat actors like KEDIRISECTEAM exploit weaknesses in computers, networks, and systems to carry out disruptive attacks.13 They may use phishing to gain initial access.13 A cyber threat profile is essential to understand how such threats are likely to materialize and impact an organization.15
- Targeting Patterns: The incident involves a Ukrainian bankruptcy service company, suggesting a target that might be of interest for financial or geopolitical reasons. Threat actors often look for vulnerabilities rather than specific individuals.13
- Notable Activities/Characteristics: The lack of a detailed profile for KEDIRISECTEAM underscores the challenge of identifying and tracking all malicious actors, especially those who may be new or operate with low visibility.
wh6ami
- Aliases & Affiliations: “wh6ami” is a generic term for an unidentified threat actor, often used when specific attribution is not yet possible. No specific aliases or affiliations are provided. Hacker forums like Hack Forums are often populated by individuals who may operate under such generic handles.22
- Origin & Motivation: The motivation for “wh6ami” is unconfirmed. Threat actors can be cybercriminals seeking monetary gain, hacktivists, or even internet trolls.13 The incident involving an education management system could be for data theft (financial) or disruption (ideological).
- Typical TTPs: Threat actors exploit weaknesses in systems to cause harm.13 Many gain access through phishing, using fake login pages or official-looking emails to steal credentials.13 They look for vulnerabilities to exploit rather than individual people.13
- Targeting Patterns: The incident involves an education management system, a sector that is frequently targeted.4 Threat actors can be indiscriminate in choosing targets, often looking for any exploitable vulnerability.13
- Notable Activities/Characteristics: The term “wh6ami” reflects the anonymity prevalent in the cybercrime sphere, particularly on platforms like the dark web, where users can access unindexed content anonymously.24
RATNICK
- Aliases & Affiliations: “RATNICK” is a generic term for an unidentified threat actor, and no specific aliases or affiliations are provided in the intelligence.
- Origin & Motivation: The motivation for RATNICK is unconfirmed. Data leaks from government entities can be driven by political or ideological agendas (hacktivism) or by financial motives (selling the data).
- Typical TTPs: As a threat actor involved in a data leak, their TTPs would include gaining unauthorized access and exfiltrating data. The severity of vulnerabilities exploited by threat actors is often measured by CVE ratings, which guide security teams in prioritizing patches.16 However, these ratings do not reflect the likelihood of a vulnerability being exploited or the intent of threat actors.16
- Targeting Patterns: The target is a municipal chamber, a government entity. Threat actors often target government sectors for various reasons.5
- Notable Activities/Characteristics: The term “RATNICK” does not correspond to a known, profiled group in the provided intelligence, suggesting it may be a new or less-documented entity.
offshoree
- Aliases & Affiliations: “offshoree” is a term that often refers to individuals or groups operating from offshore locations. A notable example is Famous Chollima, a DPRK state-sponsored threat actor that exploits remote hiring processes to infiltrate organizations as insider threats, disguising their location using “laptop farms”.17
- Origin & Motivation: The primary motivation for “offshoree” activities appears to be financial gain, specifically through the sale of stolen data, including credit card records and databases.12 This aligns with the broader trend of cybercriminals seeking monetary gain by retrieving data they can sell.13
- Typical TTPs: “offshoree” engages in data breaches, credit card sales, and document leaks. Their operations are heavily reliant on dark web marketplaces and forums (like XSS, DarkForums.st, Exploit.in) to advertise and sell stolen information.12 They may also leverage sophisticated initial access methods, including exploiting vulnerabilities in remote desktop protocol (RDP), weak passwords, or lack of two-factor authentication.25 The commercialization of stolen data involves tactics like mass data dumps as marketing tools.12
- Targeting Patterns: “offshoree” targets a wide range of entities, including police departments, government agencies, and financial institutions, indicating an opportunistic approach driven by the value of the data they can acquire.12
- Notable Activities/Characteristics: This actor exemplifies the industrialization and commercialization of stolen data on the dark web. The resilience of these markets, even after high-profile takedowns, ensures their continued role in the cybercrime ecosystem.19
kovalidis
- Aliases & Affiliations: “kovalidis” is a generic term for an unidentified threat actor. No specific aliases or affiliations are provided. However, the nature of the incident (sale of domain user access) suggests a connection to groups involved in initial access brokering or ransomware operations.
- Origin & Motivation: The motivation for “kovalidis” is likely financial gain, as they are selling unauthorized access to an organization’s domain users. This access is a valuable commodity for other cybercriminals to conduct further attacks, such as ransomware deployment or data exfiltration.6
- Typical TTPs: The sale of domain user access implies successful initial compromise of a network. This could be achieved through various methods, including exploiting vulnerabilities in internet-facing services, spear-phishing campaigns, or leveraging malware-as-a-service (MaaS) frameworks like SocGholish (also known as FakeUpdates) which are designed to drop second-stage payloads and backdoors.18 Medusa ransomware actors also use legitimate tools and “living off the land” (LOTL) techniques for network enumeration and lateral movement.6
- Targeting Patterns: The target is an unidentified organization in Indonesia, indicating a broad targeting approach focused on gaining valuable network access.
- Notable Activities/Characteristics: The offering of such extensive domain user access suggests a significant compromise, potentially leading to widespread impact within the victim organization. The hybridization and sophistication of TTPs, where legitimate tools are misused for malicious purposes, make detection challenging.
V. Emerging Trends and Analysis
The daily incident log, when viewed through the lens of broader threat intelligence, illuminates several critical trends shaping the current cybersecurity landscape. These trends highlight the evolving nature of cyber adversaries and the increasing complexity of defending against them.
The Escalation and Commercialization of Hacktivism
Hacktivist groups are undergoing a significant transformation, moving beyond their historical role as low-skilled actors engaging in symbolic “digital graffiti.” They have evolved into more capable teams, often smaller in size but far more effective.9 This escalation in skill is directly correlated with an increased risk to organizations. Many of these groups are forming extensive alliances, such as the coordination seen among over 40 hacktivist groups targeting Indian entities, including Keymous+ and AnonSec.7 Similarly, the Peoples Cyber Army (PCA) has formed the CARRtel alliance with NoName057(16) and HackNeT, demonstrating a networked approach to cyber operations.10 These alliances amplify their reach and impact, allowing for more coordinated and potent campaigns.
A particularly concerning development is the emergence of “Hacktivism as a Service” (HaaS), exemplified by “DDoS-for-hire” offerings within hacktivist circles.2 This commercialization of disruptive capabilities blurs the lines between ideological motivation and financial gain. Groups, including some hacktivists, are becoming “DDoS-as-a-service providers,” offering their services for a fee or in exchange for advertising on their Telegram channels.3 This operational shift lowers the barrier to entry for launching disruptive cyberattacks, as individuals or smaller groups can now “rent” the capabilities of established hacktivist collectives. This commercial model also provides a funding stream for these groups, allowing them to invest in more sophisticated tools and techniques. Organizations must therefore prepare for more frequent, sustained, and sophisticated hacktivist campaigns that may be financially backed or professionally executed. Traditional, reactive defenses against opportunistic hacktivism may prove insufficient, necessitating a proactive approach to DDoS mitigation, robust incident response plans tailored for high-impact disruption, and continuous monitoring for early warning signs from hacktivist communication channels.
The Enduring Threat of Ransomware-as-a-Service (RaaS) and Double Extortion
Ransomware remains a pervasive and highly destructive threat, with groups like Ghost (Cring) and Medusa consistently leveraging Ransomware-as-a-Service (RaaS) models and double extortion tactics.4 In the double extortion model, threat actors not only encrypt victim data but also exfiltrate sensitive information, threatening public release if ransom demands are not met.4 This adds significant pressure on victims, increasing the likelihood of payment.
The detailed Tactics, Techniques, and Procedures (TTPs) of groups like Medusa highlight the adaptive and increasingly evasive nature of these operations. Medusa actors heavily utilize “living off the land” (LOTL) techniques, employing legitimate tools such as PowerShell, Windows Command Prompt, Advanced IP Scanner, SoftPerfect Network Scanner, and Windows Management Instrumentation (WMI) for reconnaissance, network enumeration, and data transfer.6 They also leverage legitimate remote access software like AnyDesk, Atera, and ConnectWise for lateral movement and execution, often tailoring their choice to tools already present in the victim environment to evade detection.6 Furthermore, Medusa actors actively attempt to disable Endpoint Detection and Response (EDR) tools and delete PowerShell command line history to cover their tracks.6 This evolution in RaaS operations demonstrates a deliberate blending into victim environments, making their activities harder to distinguish from legitimate system processes and thereby increasing dwell time and the likelihood of successful compromise. The focus on evasion signifies a mature and well-resourced adversary. Organizations must therefore move beyond basic signature-based antivirus solutions and invest in advanced detection capabilities such as EDR/XDR platforms with strong behavioral analytics and machine learning. Developing robust threat hunting programs is also crucial to proactively identify and neutralize sophisticated RaaS operations designed to mimic legitimate activity and evade traditional security controls.
The Dark Web as a Central Hub for Cybercrime Operations
Dark web forums and marketplaces continue to serve as critical platforms for threat actors, facilitating a wide range of illicit activities. Forums like XSS, DarkForums.st, and Exploit.in are explicitly used for advertising stolen data, selling unauthorized access to compromised systems, and coordinating criminal activities.12 The incident involving “offshoree” selling credit card records and databases on these platforms directly reflects this trend.
The resilience of these markets, even after high-profile takedowns like Joker’s Stash, ensures their continued and evolving role in the cybercrime ecosystem.19 New marketplaces quickly emerge to fill voids, often specializing in particular regions or types of card data.19 The BidenCash dark web market, for example, recently leaked nearly one million credit card records as a marketing tactic, demonstrating a professional, business-like approach to illicit trade.12 Their “Anti-Public System” to verify data exclusivity further highlights this industrialization. This signifies that data breaches are not merely isolated incidents of immediate impact but feed a continuous, highly profitable underground economy. The evolution of skimming techniques, from physical card data capture to e-skimming (Magecart attacks) that lift card data from e-commerce websites and true cyberattacks, further underscores this industrialization.19 Data Loss Prevention (DLP) strategies and continuous dark web monitoring are no longer supplementary but essential components of a comprehensive security strategy. Organizations must proactively monitor for their compromised data appearing on dark web markets and implement robust fraud detection systems. The long-term financial and reputational consequences of data breaches necessitate a proactive approach to protect sensitive information throughout its lifecycle.
The Strategic Importance of Critical Infrastructure and OT/ICS Security
The consistent and specific targeting of critical infrastructure, particularly Operational Technology (OT) and Industrial Control Systems (ICS), by various threat actors underscores a growing strategic focus on disrupting essential services. Groups like Z-Pentest specifically target OT in energy and water sectors, demonstrating capabilities to manipulate critical functions such as water pumping and gas flaring.1 Ransomware groups like Ghost (Cring) and Medusa also explicitly list critical infrastructure among their targets.4
This focus goes beyond traditional IT systems to directly impact physical processes, which can lead to severe, potentially physical, and widespread consequences. Unlike data breaches, attacks on OT/ICS can result in direct operational shutdowns, environmental damage, and pose direct threats to public safety and national security. This elevates OT/ICS security to a paramount concern, distinct from traditional IT security. The detailed description of Z-Pentest’s capabilities in penetrating OT/ICS environments and manipulating critical functions highlights this severe potential. Organizations with OT/ICS environments must therefore implement specialized and robust security measures tailored to these unique systems. This includes strict network segmentation between IT and and OT, comprehensive asset inventory, continuous monitoring for anomalous behavior within industrial control systems, and developing specific incident response plans for OT environments. Recognizing the unique risks and potential for catastrophic impact is crucial for effective defense.
VI. Recommendations and Mitigation Strategies
In light of the evolving threat landscape and the incidents observed, organizations must adopt a multi-layered, adaptive defense strategy. While sophisticated threats demand advanced solutions, the effectiveness of these measures often hinges on a strong foundation of cybersecurity hygiene.
Foundational Cybersecurity Hygiene: The Non-Negotiables
Despite the complexity of advanced threats, many successful attacks still hinge on the exploitation of fundamental security weaknesses. For instance, Ghost (Cring) exploits unpatched software and weak credentials, and DarkSide gains initial access through RDP weaknesses, weak passwords, and lack of multi-factor authentication.4 Neglecting these foundational elements provides easy entry points, rendering advanced defenses less effective. Therefore, a strong cybersecurity hygiene foundation acts as a critical deterrent and significantly raises the bar for adversaries, forcing them to expend more resources and increasing their chances of detection.
- Robust Patch Management & System Updates: Implement a rigorous patching regimen for all operating systems, software, and firmware. Promptly apply security patches, especially for internet-facing services and known vulnerabilities.4 This is the most fundamental defense against common exploitation vectors.
- Enforce Multi-Factor Authentication (MFA): Mandate MFA for all privileged accounts, remote access services (e.g., VPNs, RDP), and critical business applications.4 This is a critical barrier against credential theft and weak passwords, a primary initial access method for groups like DarkSide.25
- Implement Strong Access Controls & Least Privilege: Enforce the principle of least privilege, ensuring users and systems only have the minimum necessary permissions to perform their functions. Regularly review and revoke excessive user permissions, and promptly disable inactive accounts.4 This limits lateral movement and the potential impact of a compromised account.
- Comprehensive Employee Cybersecurity Education: Conduct regular and engaging training programs on phishing awareness, social engineering tactics, and general digital hygiene. Emphasize the risks associated with suspicious links, attachments, and deceptive update prompts.4 Human error remains a significant initial access vector.
Advanced Defensive Measures: Elevating Protection
Organizations need to strategically invest in intelligence-led security programs that enable them to anticipate threats, actively seek out vulnerabilities within their own environments, and continuously monitor for early indicators of compromise. This involves integrating threat intelligence into all security operations, from vulnerability management to incident response, to build a truly resilient and adaptive defense.
- Deploy Endpoint Detection and Response (EDR) / Extended Detection and Response (XDR) Solutions: Implement advanced EDR or XDR solutions to detect and respond to ransomware activity, “living off the land” (LOTL) techniques, and other sophisticated malicious behaviors that bypass traditional antivirus.4 These tools provide deeper visibility into endpoint activities.
- Network Segmentation & Hardening: Segment networks to limit lateral movement of adversaries once initial access is gained. Harden internet-facing services by disabling unused ports (e.g., RDP 3389, FTP 21, SMB 445) unless strictly necessary. Require VPN access for all administrative functions instead of exposing services directly online.4 This significantly reduces the external attack surface.
- Strengthen Email and Communication Security: Deploy advanced anti-phishing tools (e.g., DMARC, DKIM, SPF) and automated email filtering to block malicious attachments and links.4 This directly combats spear-phishing and malicious file delivery, which are key TTPs for APTs like OilRig 5 and ransomware distributors like SocGholish.18
- Proactive Threat Hunting & Continuous Monitoring: Enable comprehensive network and endpoint logging, and integrate logs into a Security Information and Event Management (SIEM) system to detect suspicious activity early. Actively monitor for unauthorized account logins, unusual file encryption patterns, and privilege escalation attempts.4 Conduct proactive threat hunting to identify and neutralize threats before they fully materialize.5 This is critical against stealthy and persistent threats.
- Implement Data Loss Prevention (DLP) Programs: Deploy robust DLP solutions to monitor, detect, and block sensitive data exfiltration attempts.17 This is crucial given the prevalence of double extortion tactics by ransomware groups and the commercialization of stolen data on the dark web.
Incident Preparedness & Resilience: Minimizing Impact
- Maintain Regular, Encrypted, and Immutable Backups: Ensure critical data and systems are regularly backed up, encrypted, and stored offline or in an immutable format.4 Crucially, regularly test disaster recovery procedures to ensure data can be restored quickly and reliably.4 This is the ultimate defense against ransomware and data destruction.
- Develop and Test a Comprehensive Incident Response Plan: Create and regularly update an incident response plan tailored to various scenarios, including ransomware, data breaches, and APT attacks.5 Establish clear protocols for rapid detection, containment, eradication, and recovery during an incident. Conduct tabletop exercises to test the plan’s effectiveness.
- Secure Supply Chain Operations: Implement measures to secure your supply chain, including rigorous vetting of third-party vendors and monitoring for insider threats, especially in the context of remote or offshore hires.5 This addresses sophisticated initial access vectors like those used by Famous Chollima.
OT/ICS Specific Recommendations (if relevant to incidents)
- For organizations with Operational Technology (OT) or Industrial Control Systems (ICS), implement specialized security measures beyond traditional IT. This includes strict network segmentation between IT and OT networks, dedicated monitoring for industrial protocols, and robust access controls for critical operational functions.1 Recognizing the unique risks and potential for catastrophic impact in these environments is crucial for effective defense.
VII. Conclusion
The cybersecurity landscape remains fluid and complex, characterized by continuously evolving Tactics, Techniques, and Procedures (TTPs), diversifying motivations, and increasingly interconnected threat actor networks. The incidents observed over the last 24 hours underscore a significant trend: the convergence of traditional cybercriminal activities with politically motivated hacktivism, leading to hybrid operations that can pursue both disruptive and financially exploitative objectives. This necessitates a comprehensive understanding of the adversary, moving beyond simple attribution to analyzing their alliances, evolving TTPs, and underlying motivations.
A particularly concerning development is the persistent and growing targeting of critical infrastructure and Operational Technology (OT) environments. Attacks against these vital systems carry the potential for severe real-world impacts that extend far beyond data theft, including operational shutdowns, environmental damage, and threats to public safety and national security. This elevates OT/ICS security to a paramount concern, demanding specialized defensive measures and incident response capabilities.
To effectively counter these sophisticated and adaptive threats, organizations must adopt a multi-layered, adaptive defense strategy. This involves a dual approach: reinforcing strong foundational cybersecurity hygiene, such as robust patching, multi-factor authentication, and stringent access controls, which serve as critical barriers against common exploitation vectors. Concurrently, organizations must invest in advanced detection capabilities, including Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) solutions, coupled with proactive threat hunting programs, to identify and neutralize sophisticated adversary activities that attempt to blend into legitimate network traffic. Finally, maintaining robust, immutable backups and regularly testing comprehensive incident response plans are indispensable for minimizing the impact of successful breaches and ensuring rapid recovery. Continuous vigilance, intelligence integration, and organizational adaptation are fundamental pillars for maintaining resilience in the face of persistent and sophisticated cyber threats.
Works cited
- Z-PENTEST ALLIANCE – Cyber Intelligence Bureau – Orange Cyberdefense, accessed May 26, 2025, https://www.orangecyberdefense.com/fileadmin/global/CyberIntelligenceBureau/Gangs_Investigations/z-pentest/Z-Pentest_Alliance.pdf
- Cyberattack Suspected in Worldwide X Outage – ZeroFox, accessed May 26, 2025, https://www.zerofox.com/intelligence-feed/cyberattack-suspected-in-worldwide-x-outage/
- Cyberattacks surge amid India-Pakistan clashes after strikes – SecurityBrief Asia, accessed May 26, 2025, https://securitybrief.asia/story/cyberattacks-surge-amid-india-pakistan-clashes-after-strikes
- Ghost (Cring) Ransomware: Understanding The Threat & How Enterprises Can Defend Themselves, accessed May 26, 2025, https://www.alstonprivacy.com/ghost-cring-ransomware-understanding-the-threat-how-enterprises-can-defend-themselves/
- Dark Web Profile: OilRig (APT34) – SOCRadar® Cyber Intelligence Inc., accessed May 26, 2025, https://socradar.io/dark-web-profile-oilrig-apt34/
- #StopRansomware: Medusa Ransomware | CISA, accessed May 26, 2025, https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
- Escalating Hacktivist Attacks Amidst India-Pakistan Tensions – Radware, accessed May 26, 2025, https://www.radware.com/security/threat-advisories-and-attack-reports/escalating-hacktivist-attacks-amidst-india-pakistan-tensions/
- Hacktivism in the Israel-Hamas Conflict | Citizen Data Leaked Using Old Malware, accessed May 26, 2025, https://www.sentinelone.com/blog/hacktivism-in-the-israel-hamas-conflict-citizen-data-leaked-using-old-malware/
- Understanding Hacktivists: The Overlap of Ideology and Cybercrime | Trend Micro (US), accessed May 26, 2025, https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/understanding-hacktivists-the-overlap-of-ideology-and-cybercrime
- Threat Actor Profile: Peoples Cyber Army of Russia – Cyble, accessed May 26, 2025, https://cyble.com/threat-actor-profiles/peoples-cyber-army-of-russia/
- India Under Cyber Siege: 40+ Hacktivist Groups joined hands and Targeting Key Sectors Post-Operation Sindoor – CyberXTron, accessed May 26, 2025, https://cyberxtron.com/blog/india-under-cyber-siege-40-hacktivist-groups-joined-hands-and-targeting-key-sectors-post-operation-sindoor-6500
- BidenCash Dark Web Market Leaks Nearly One Million Credit Cards – SOCRadar, accessed May 26, 2025, https://socradar.io/bidencash-dark-web-market-one-million-credit-cards/
- What is a Cyber Threat Actor? | CrowdStrike, accessed May 26, 2025, https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-actor/
- Top 10 Dark Web Forums Of 2025 And Deep Web Communities – Cyble, accessed May 26, 2025, https://cyble.com/knowledge-hub/top-10-dark-web-forums/
- Cyber Threat Profile | Google Cloud, accessed May 26, 2025, https://cloud.google.com/security/resources/datasheets/cyber-threat-profile
- What is a CVE Rating? – Bitsight, accessed May 26, 2025, https://www.bitsight.com/glossary/cve-rating
- FAMOUS CHOLLIMA: The Hidden Cyber Threat Lurking Among Your Remote Hires, accessed May 26, 2025, https://www.wagnerlawgroup.com/blog/2025/02/famous-chollima-the-hidden-cyber-threat-lurking-among-your-remote-hires/
- SocGholishs Intrusion Techniques Facilitate Distribution of RansomHub Ransomware, accessed May 26, 2025, https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html
- Unmasking the Underground: Navigating the Threat of Dark Web Credit Card Marketplaces, accessed May 26, 2025, https://www.outseer.com/fraud-protection/unmasking-the-underground/
- THREAT ACTORS – KELA Cyber Threat Intelligence, accessed May 26, 2025, https://www.kelacyber.com/platform/threat-actors/
- Threat Actor Profiles – SOCRadar® Cyber Intelligence Inc., accessed May 26, 2025, https://socradar.io/category/threat-actor-profiles/
- Hack Forums – Wikipedia, accessed May 26, 2025, https://en.wikipedia.org/wiki/Hack_Forums
- Is hackforums a honeypot? : r/hacking – Reddit, accessed May 26, 2025, https://www.reddit.com/r/hacking/comments/1jisrds/is_hackforums_a_honeypot/
- The Dark Web Explained | CrowdStrike, accessed May 26, 2025, https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/dark-web/
- DarkSide Hacker Group | Mimecast, accessed May 26, 2025, https://www.mimecast.com/content/darkside-ransomware/
- Crypto-Miners Love PHP: Understanding and Stopping Offshore Exploits – HackerNoon, accessed May 26, 2025, https://hackernoon.com/crypto-miners-love-php-understanding-and-stopping-offshore-exploits