[May-30-2025] Daily Cybersecurity Threat Report

1. Executive Summary

The past 24 hours have seen a diverse array of cybersecurity incidents, ranging from targeted defacements and large-scale data breaches to initial access sales and data leaks. Key trends include the continued exploitation of human vulnerabilities through social engineering, the monetization of stolen data on dark web forums, and the persistent activity of both financially motivated cybercriminals and ideologically driven hacktivist groups. Incidents span various sectors, including real estate, government, education, energy, and telecommunications, affecting organizations and individuals across multiple countries. The detailed analysis below provides context for each incident and insights into the threat actors involved.

2. Daily Incident Overview

This section provides a concise overview of recent cybersecurity incidents, offering a snapshot of the day’s significant cyber events and their immediate implications, directly derived from the information you provided.

Daily Incident Summary

Incident Title	Category	Victim Organization	Victim Country	Threat Actor(s)
Team 1722 targets the website of Tripoli Immobiliare	Defacement	tripoli immobiliare	Italy	Team 1722
Alleged data sale of United States Environmental Protection Agency	Data Breach	united states environmental protection agency	USA	B4baYega
Blackswamp targets the website of Aftab Information Processing Company	Defacement	aftab information processing company	Iran	Blackswamp
Alleged sale of Azerbaijan Gambling-Casino players leads	Data Leak		Azerbaijan	LandLord
Alleged data breach of Canadian Rocky Mountain Resorts	Data Breach	canadian rocky mountain resorts	Canada	Worldleaks
Alleged data breach of Wekiwi France	Data Breach	wekiwi france	France	icikevin
Alleged data sale of TotalEnergies Power & Gas	Data Breach	totalenergies power & gas	France	icikevin
Alleged data leak of Telkom Indonesia	Data Breach	pt telkom indonesia	Indonesia	gesss
Alleged sale of unauthorized access to French Magento Shop	Initial Access		France	Fordnox
Alleged data leak of Super Store Finder	Data Breach	super store finder		VOID
Alleged sale of Chinese citizen’s personal data	Data Leak		China	Skivon
Alleged data leak of Princeton University	Data Breach	princeton university	USA	VOID
Alleged data leak of Bangladesh Geographic Information System	Data Breach	bangladesh geographic information system	Bangladesh	VOID
Alleged database leak of New World International School	Data Breach	new world international school	Saudi Arabia	JakartaCyberPsychos
Alleged data sale of an unidentified car company in Mexico	Data Leak		Mexico	AKA_Astaroth
Alleged data sale of Ministry of Civil Service	Data Breach	ministry of civil service	Taiwan	heiwukoong
Alleged data breach of Deloitte	Data Breach	deloitte	UK	303
Alleged Unauthorized Access to an unidentified tank and silo manufacturing company in Franc	Initial Access		France	SECT0R16
Alleged data breach of the University of Jordon	Data Breach	the university of jordon	Jordan	Elite Squad
Kal Egy 319 targets the website of Tec The Education Consultancy	Defacement	tec the education consultancy	USA	KAL EGY 319
Kal Egy 319 targets the website of Graduate college of Education	Defacement	graduate college of education	Cuba	KAL EGY 319
Alleged data breach of sport2000	Data Breach	sport2000	France	xelvain
Alleged data sale of Sucive	Data Breach	sucive	Uruguay	Tacuara
Alleged data breach of Claro	Data Breach	claro	Colombia	C0mm4nd2
KAL EGY 319 targets the website of BDSS	Defacement	bdss	Bahrain	KAL EGY 319
Alleged access sale of Atlassian Corporation Plc	Initial Access	atlassian corporation plc	Australia	LulzSec Black
Alleged data leak of Badan Pengawas Tenaga Nuklir	Data Leak	badan pengawas tenaga nuklir	Indonesia	ParanoidHax
Alleged data sale of France Travail	Data Breach	france travail	France	ryolait
Alleged data leak of Kementerian Dalam Negeri Republik Indonesia	Data Leak	kementerian dalam nageri republik indonesia	Indonesia	Hime666

3. Detailed Incident Analysis

This section provides an in-depth examination of each significant cybersecurity incident reported in the last 24 hours, offering critical context, detailed threat actor profiles where available, and an analysis of their methodologies and broader implications.

3.1: Team 1722 targets the website of Tripoli Immobiliare

Category: Defacement

Content: The group claims to have defaced the website of Tripoli Immobiliare in Italy, stating that they deleted most of the data and took full control of the site.

Date: 2025-05-30T12:29:06Z

Network: telegram

Victim Country: Italy

Victim Industry: Real Estate

Victim Organization: tripoli immobiliare

Victim Site: immobiliaretripoli.it

Threat Actor Profile: Team 1722

Team 1722 is a consistently active pro-Russian hacktivist group that primarily targets NATO-aligned nations and Ukraine supporters.¹ This group has been observed embracing ransomware as a tool for ideological disruption, marking a significant departure from traditional hacktivist methods like defacement or DDoS attacks.¹ They have also actively contributed to the surge in attacks on Industrial Control Systems (ICS) and Operational Technology (OT) systems, exploiting internet-facing components for political and economic leverage.¹

Known Tactics, Techniques, and Procedures (TTPs): Ransomware adoption, targeting critical infrastructure, multi-vector attacks combining DDoS, credential leaks, and ICS disruption.¹
Motivations and Past Noteworthy Activities: Ideologically motivated, supporting pro-Russian objectives, and operating alongside other active hacktivist groups such as NoName057(16), Hacktivist Sandworm, Z-pentest, Sector 16, and Overflame.¹
Technical Details and Exploited Vulnerabilities: While specific technical details for this defacement are not provided, their general TTPs include exploiting internet-facing ICS/OT systems and compromising SCADA systems and control panels.¹
Mitigation and Defensive Measures: Organizations should implement enhanced ICS/OT security measures, including robust segmentation, multi-factor authentication, and comprehensive incident response plans tailored for operational technology environments.
References:

Published URL: https://t.me/x1722x/2624
Screenshots: https://d34iuop8pidsy8.cloudfront.net/cbba51ae-2d73-4d6a-88c7-6e603de13481.png

3.2: Alleged data sale of United States Environmental Protection Agency

Category: Data Breach

Content: The threat actor claims to be selling a 100GB data leak allegedly from the U.S. Environmental Protection Agency (EPA), containing sensitive information in.sql and Excel formats.

Date: 2025-05-30T12:15:25Z

Network: openweb

Victim Country: USA

Victim Industry: Government Relations

Victim Organization: united states environmental protection agency

Victim Site: epa.gov

Threat Actor Profile: B4baYega

This actor is identified as a fictional persona controlled by a North Korean threat actor, operating as part of a “well-organized, state-sponsored, large criminal ring with extensive resources”.³ This group has demonstrated a high level of sophistication in creating believable cover identities, leveraging stolen U.S. credentials and AI-enhanced photos to circumvent traditional vetting processes.³

Known Tactics, Techniques, and Procedures (TTPs): Identity fabrication, social engineering, initial access via single-board computers (e.g., Raspberry Pi) to download malware, and operational security measures like connecting to “IT mule laptop farms” and using VPNs to mask their true location.³
Motivations and Past Noteworthy Activities: Primarily financially motivated, with a significant portion of earnings intended to fund “illegal programs” in North Korea.³
Technical Details and Exploited Vulnerabilities: The incident involved malware loaded onto an Apple laptop, followed by attempts to manipulate session history files, transfer potentially harmful files, and execute unauthorized software.³ The vulnerability exploited was primarily human trust and the limitations of traditional identity verification processes.
Mitigation and Defensive Measures: Organizations should enhance hiring processes to include more thorough identity validation and train staff on common red flags associated with this type of threat.³
References:

Published URL: https://darkforums.st/Thread-Selling-U-S-Environmental-Protection-Agency%C2%A0100GB-Data-Leak
Screenshots: https://d34iuop8pidsy8.cloudfront.net/27d0f963-0faf-4d2b-b1e6-13b28087a0c9.png

3.3: Blackswamp targets the website of Aftab Information Processing Company

Category: Defacement

Content: The group claims to have defaced the website of Aftab Information Processing Company

Date: 2025-05-30T11:35:45Z

Network: telegram

Victim Country: Iran

Victim Industry: Information Technology (IT) Services

Victim Organization: aftab information processing company

Victim Site: aftabip.ir

Threat Actor Profile: Blackswamp

Information regarding the specific threat actor “Blackswamp” is limited in the provided research material. While the research mentions various hacker groups, Blackswamp is not directly detailed.⁴

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://t.me/ReportBattalion/42
Screenshots: https://d34iuop8pidsy8.cloudfront.net/885cf307-eada-432d-ad86-27f737ea43d1.png

3.4: Alleged sale of Azerbaijan Gambling-Casino players leads

Category: Data Leak

Content: A threat actor claims to be selling 400K lead records of Azerbaijan gambling and casino players from 2024.

Date: 2025-05-30T11:08:36Z

Network: openweb

Victim Country: Azerbaijan

Victim Industry: Gambling & Casinos

Victim Organization:

Victim Site:

Threat Actor Profile: LandLord

“Landlord Cybercrime” refers to a category of cybercriminal activity that specifically targets sectors handling sensitive data or financial transactions, rather than a single named group.⁶ The primary motivation is financial gain through identity theft, unauthorized purchases, and the diversion of funds.⁷

Known Tactics, Techniques, and Procedures (TTPs): Phishing attacks (disguising as legitimate entities to trick victims into sharing sensitive data), hacking (gaining control of devices to steal identities or divert funds), and malware attacks (gaining remote access to sensitive information).⁶ They exploit vulnerabilities in software, communication tools, billing platforms, and insecure public Wi-Fi networks.⁶
Motivations and Past Noteworthy Activities: Financial gain through identity theft, financial fraud, and data breaches.⁷
Technical Details and Exploited Vulnerabilities: Common vulnerabilities include a lack of robust security features in software, inadequate multi-factor authentication, unencrypted data, and the use of public Wi-Fi for sensitive transactions.⁶
Mitigation and Defensive Measures: Organizations should ensure their software includes robust security features like multi-factor authentication and encryption, choose vendors with strong cybersecurity track records, and educate staff and users on recognizing phishing attempts. Other essential steps include using strong passwords, avoiding public Wi-Fi (or using VPNs), implementing strict access controls, conducting regular security audits, and developing detailed incident response plans.⁶
References:

Published URL: https://darkforums.st/Thread-Selling-Azerbaijan-Gambling-Casino-players-leads-2024-400K-records
Screenshots: https://d34iuop8pidsy8.cloudfront.net/a157ef7f-3a91-432a-8771-74400de48374.png

3.5: Alleged data breach of Canadian Rocky Mountain Resorts

Category: Data Breach

Content: The group claims to have obtained 829.8 GB of data from the organization, including 1,649,817 files.

Date: 2025-05-30T10:58:01Z

Network: tor

Victim Country: Canada

Victim Industry: Hospitality & Tourism

Victim Organization: canadian rocky mountain resorts

Victim Site: crmr.com

Threat Actor Profile: Worldleaks

World Leaks is an extortion platform launched by the operators of the Hunters International ransomware group in early 2025.⁸ It functions as an “Extortion-as-a-Service” (EaaS) platform, providing affiliates with exfiltration tools and collaborating with other ransomware groups like Secp0.⁸ While it claims to be “extortion-only,” some victims have still experienced ransomware deployment.⁸

Known Tactics, Techniques, and Procedures (TTPs): Extortion-only model (pivoting from traditional double extortion), multi-platform operation (main data leak site, negotiation site, “Insider platform” for journalists, and an affiliate panel), data exfiltration, and psychological leverage through selective exposure of sensitive files.⁸ Despite claims, some victims have suffered ransomware deployment.⁸
Motivations and Past Noteworthy Activities: Primary motivation is financial gain. Hunters International, the group’s predecessor, remained active with over 70 claimed victims even after the announcement of World Leaks.⁸
Technical Details and Exploited Vulnerabilities: Initial access often occurs through phishing, malicious hyperlinks, RDP-based assaults, and exploiting technical vulnerabilities in outdated systems.⁹ The World Leaks ransomware uses the victim machine’s own resources for exfiltration and encryption, detectable by high processing, memory, and disk access consumption, as well as changes to file extensions.⁹
Mitigation and Defensive Measures: Preventing a World Leaks ransomware attack requires a comprehensive cybersecurity framework, including robust backup strategies, secure remote access, and vigilance against phishing and infected files.⁹
References:

Published URL: https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies/5800571525
Screenshots: https://d34iuop8pidsy8.cloudfront.net/173ad007-b05d-4cc9-a368-6163c32b6083.png, https://d34iuop8pidsy8.cloudfront.net/bdcba08e-200a-4d73-8e97-fbf229a4ae03.png

3.6: Alleged data breach of Wekiwi France

Category: Data Breach

Content: The threat actor claims to have breached Wekiwi France.

Date: 2025-05-30T10:38:27Z

Network: openweb

Victim Country: France

Victim Industry: Energy & Utilities

Victim Organization: wekiwi france

Victim Site: wekiwi.fr

Threat Actor Profile: icikevin

Information regarding the specific threat actor “icikevin” is not available in the provided research material.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://darkforums.st/Thread-Selling-Data-France-Selling-gas-and-electricity-in-France
Screenshots: https://d34iuop8pidsy8.cloudfront.net/04d77b15-f730-4de9-9393-f24138f125f4.png

3.7: Alleged data sale of TotalEnergies Power & Gas

Category: Data Breach

Content: The threat actor claims to be selling a dataset allegedly containing 22.25 million records from TotalEnergies Power & Gas, featuring sensitive customer information such as names, phone numbers, addresses, postal codes, service details, and tariff plans.

Date: 2025-05-30T10:36:36Z

Network: openweb

Victim Country: France

Victim Industry: Oil & Gas

Victim Organization: totalenergies power & gas

Victim Site: totalenergies.fr

Threat Actor Profile: icikevin

Information regarding the specific threat actor “icikevin” is not available in the provided research material.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://darkforums.st/Thread-Selling-Data-France-Selling-gas-and-electricity-in-France
Screenshots: https://d34iuop8pidsy8.cloudfront.net/a03f49d9-0ab0-4435-b49c-079ea76d0207.png

3.8: Alleged data leak of Telkom Indonesia

Category: Data Breach

Content: The threat actor claims to be selling to an Indonesian Telkom admin account, potentially exposing sensitive Wi-Fi user data.

Date: 2025-05-30T10:31:27Z

Network: openweb

Victim Country: Indonesia

Victim Industry: Network & Telecommunications

Victim Organization: pt telkom indonesia

Victim Site: telkom.co.id

Threat Actor Profile: gesss

While “gesss” is not a named group in the research, the provided material discusses threat actors targeting the U.S. tax season with sophisticated phishing techniques, which could be indicative of similar financially motivated campaigns.¹⁰ These campaigns often involve delivering malicious files via email with deceptive extensions to compromise sensitive personal and financial data.¹⁰

Known Tactics, Techniques, and Procedures (TTPs): Sophisticated phishing using deceptive extensions (e.g., .pdf.lnk), multi-stage payload delivery involving malicious LNK files embedding Base64-encoded PowerShell commands to download infostealers, and leveraging social engineering during opportune times like tax season.¹⁰ They target vulnerable demographics with limited knowledge of government processes.¹⁰
Motivations and Past Noteworthy Activities: Primarily financial gain through identity theft and financial fraud.¹⁰ The persistent targeting of the U.S. energy sector by “unsophisticated cyber actors” also highlights the continued efficacy of basic intrusion techniques when poor cyber hygiene and exposed assets are present.¹¹
Technical Details and Exploited Vulnerabilities: Attack chains involve malicious LNK files, Base64-encoded PowerShell commands, and the download of .rar archives containing malicious executables (e.g., Stealerium-infostealer).¹⁰
Mitigation and Defensive Measures: Organizations and individuals should exercise extreme vigilance against unsolicited emails, verify all communications, and employ robust endpoint protection and email security solutions.¹⁰
References:

Published URL: https://darkforums.st/Thread-INDONESIA-USER-WIFI-WWW-TELKOM-CO-ID
Screenshots: https://d34iuop8pidsy8.cloudfront.net/38254644-c7bc-48b7-a276-203341113ea6.png

3.9: Alleged sale of unauthorized access to French Magento Shop

Category: Initial Access

Content: A threat actor claims to be selling full admin access to a French online shop running on Magento 2, including the ability to redirect credit card payments.

Date: 2025-05-30T10:24:06Z

Network: openweb

Victim Country: France

Victim Industry: E-commerce & Online Stores

Victim Organization:

Victim Site:

Threat Actor Profile: Fordnox

Information regarding a specific threat actor named “Fordnox” is not directly available in the provided research material. The research notes discuss general cybersecurity issues for small businesses, including the importance of email security, remote monitoring, password management, and multi-factor authentication.¹² It also highlights that small businesses are often targets for sophisticated operations using AI-powered tools.¹²

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material. However, general cybercriminal tactics include exploiting weak passwords, unmonitored security alerts, and inadequate backup procedures.¹²
Motivations and Past Noteworthy Activities: Not available in the provided research material. General motivations for cybercriminals include financial gain through data theft and ransomware.¹²
Technical Details and Exploited Vulnerabilities: Not available in the provided research material. General vulnerabilities include unmonitored security alerts, weak passwords, and issues with cloud-based vendors.¹²
Mitigation and Defensive Measures: Small businesses should implement strong email security, remote monitoring and patch management, security password management, and multi-factor authentication.¹² Regular security audits and comprehensive incident response plans are also crucial.¹²
References:

Published URL: https://forum.exploit.in/topic/259999/
Screenshots: https://d34iuop8pidsy8.cloudfront.net/7146028b-8a5c-43fe-a8a8-a5fb2388d3f6.png

3.10: Alleged data leak of Super Store Finder

Category: Data Breach

Content: The threat actor claims to have leaked admin credentials of Super Store Finder.

Date: 2025-05-30T09:44:23Z

Network: openweb

Victim Country:

Victim Industry: Professional Services

Victim Organization: super store finder

Victim Site: superstorefinder.net

Threat Actor Profile: VOID

Information regarding a specific threat actor named “VOID” is not directly available in the provided research material. The research notes mention “Void Blizzard” (also known as Laundry Bear), a Russian state-sponsored hacking crew.¹³ However, the incidents attributed to “VOID” in your JSON (Princeton University, Bangladesh Geographic Information System, Super Store Finder) do not align with the typical targets or activities of Void Blizzard (NATO member states, Ukraine, government, defense, critical infrastructure, transportation, healthcare, media).¹³ Therefore, it is likely a different, unspecified threat actor.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material for this specific actor.
Motivations and Past Noteworthy Activities: Not available in the provided research material for this specific actor.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material for this specific actor.
Mitigation and Defensive Measures: Not available in the provided research material for this specific actor.
References:

Published URL: https://darkforums.st/Thread-superstorefinder-net-Admin-Credential-LEAK
Screenshots: https://d34iuop8pidsy8.cloudfront.net/e0d740ba-e456-42a4-94f3-aaf304660d6d.png

3.11: Alleged sale of Chinese citizen’s personal data

Category: Data Leak

Content: The threat actor claims to be selling newly leaked Chinese data containing personal details of government and private sector employees, infrastructure IPs, and sensitive records from hospitals, schools, and insurance agencies.

Date: 2025-05-30T09:38:18Z

Network: openweb

Victim Country: China

Victim Industry:

Victim Organization:

Victim Site:

Threat Actor Profile: Skivon

Information regarding a specific threat actor named “Skivon” is not directly available in the provided research material. The research notes mention “Skira ransomware group” ¹⁵ and general spear-phishing campaigns ¹⁶, but no direct information on an actor named Skivon.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://darkforums.st/Thread-Selling-Authentic-China-Data-Leak-For-Sale-5000-One-Hand-and-We-Close-the-Deal
Screenshots: https://d34iuop8pidsy8.cloudfront.net/d219b376-6c92-4477-b806-2e51bfba9e85.png

3.12: Alleged data leak of Princeton University

Category: Data Breach

Content: The threat actor claims to have leaked Princeton University employee email addresses.

Date: 2025-05-30T09:06:03Z

Network: openweb

Victim Country: USA

Victim Industry: Education

Victim Organization: princeton university

Victim Site: princeton.edu

Threat Actor Profile: VOID

Information regarding a specific threat actor named “VOID” is not directly available in the provided research material. The research notes mention “Void Blizzard” (also known as Laundry Bear), a Russian state-sponsored hacking crew.¹³ However, the incidents attributed to “VOID” in your JSON (Princeton, Super Store Finder, Bangladesh GIS) do not align with the typical targets or activities of Void Blizzard (NATO member states, Ukraine, government, defense, critical infrastructure, transportation, healthcare, media).¹³ Therefore, it is likely a different, unspecified threat actor.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material for this specific actor.
Motivations and Past Noteworthy Activities: Not available in the provided research material for this specific actor.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material for this specific actor.
Mitigation and Defensive Measures: Not available in the provided research material for this specific actor.
References:

Published URL: https://darkforums.st/Thread-LEAK-Princeton-University-Employees-Email-Address
Screenshots: https://d34iuop8pidsy8.cloudfront.net/4e01ef7d-79ec-47df-a43b-1a50d4bf8d10.png

3.13: Alleged data leak of Bangladesh Geographic Information System

Category: Data Breach

Content: The threat actor claims to have leaked database of Bangladesh Geographic Information System. The compromised data contains admin username, password and more.

Date: 2025-05-30T09:00:48Z

Network: openweb

Victim Country: Bangladesh

Victim Industry: Government Relations

Victim Organization: bangladesh geographic information system

Victim Site: gis.gov.bd

Threat Actor Profile: VOID

Information regarding a specific threat actor named “VOID” is not directly available in the provided research material. The research notes mention “Void Blizzard” (also known as Laundry Bear), a Russian state-sponsored hacking crew.¹³ However, the incidents attributed to “VOID” in your JSON (Princeton, Super Store Finder, Bangladesh GIS) do not align with the typical targets or activities of Void Blizzard (NATO member states, Ukraine, government, defense, critical infrastructure, transportation, healthcare, media).¹³ Therefore, it is likely a different, unspecified threat actor.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material for this specific actor.
Motivations and Past Noteworthy Activities: Not available in the provided research material for this specific actor.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material for this specific actor.
Mitigation and Defensive Measures: Not available in the provided research material for this specific actor.
References:

Published URL: https://darkforums.st/Thread-Bangladesh-Geographic-Information-System-Leaked-Admin-Username-and-Password
Screenshots: https://d34iuop8pidsy8.cloudfront.net/447eb99f-84e0-4d1a-b1ab-fe49556fd277.png

3.14: Alleged database leak of New World International School

Category: Data Breach

Content: A threat actor claims to have leaked the database of New World International School (NWIS).

Date: 2025-05-30T08:55:05Z

Network: openweb

Victim Country: Saudi Arabia

Victim Industry: Education

Victim Organization: new world international school

Victim Site: newworldschool.com.sa

Threat Actor Profile: JakartaCyberPsychos

Information regarding the specific threat actor “JakartaCyberPsychos” is not available in the provided research material.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://darkforums.st/Thread-LEAKED-DATABASE-NEW-WORLD-INTERNASIONAOL-SCHOOL
Screenshots: https://d34iuop8pidsy8.cloudfront.net/d60d8744-7e3f-4360-8584-0796c232ab83.png

3.15: Alleged data sale of an unidentified car company in Mexico

Category: Data Leak

Content: The threat actor claims to be selling data from an unidentified car company in Mexico. The compromised data includes name, email, phone, year, car type, and invoice PDF.

Date: 2025-05-30T06:31:28Z

Network: openweb

Victim Country: Mexico

Victim Industry: Retail Industry

Victim Organization:

Victim Site:

Threat Actor Profile: AKA_Astaroth

AKA_Astaroth refers to a sophisticated, commercially available phishing kit sold on cybercrime platforms, often with support packages.¹⁷ This kit boasts advanced methods to bypass two-factor authentication (2FA).¹⁷

Known Tactics, Techniques, and Procedures (TTPs): Utilizes “evilginx-style reverse proxy techniques” to bypass 2FA, real-time credential and session interception, session hijacking, mimicry using SSL-certified phishing domains, and attack notifications via Telegram or web panel.¹⁷ The availability of such kits “lowers the barrier to entry for cybercriminals, empowering less-experienced attackers to execute highly effective attacks”.¹⁷
Motivations and Past Noteworthy Activities: Primary motivation is financial gain through account compromise.¹⁷
Technical Details and Exploited Vulnerabilities: The attack relies on reverse proxy techniques, real-time credential and session cookie capture, and the use of SSL-certified phishing domains to mimic secure sites.¹⁷
Mitigation and Defensive Measures: Organizations should move beyond traditional MFA to phishing-resistant authentication methods (e.g., FIDO2 security keys), implement continuous security monitoring for suspicious session activity, and provide enhanced user training that specifically addresses the red flags of sophisticated phishing attacks.¹⁷
References:

Published URL: https://darkforums.st/Thread-Access-to-information-about-a-car-company-in-Mexico
Screenshots: https://d34iuop8pidsy8.cloudfront.net/9349ff06-b1f2-446f-8a15-d38590f80fc2.png

3.16: Alleged data sale of Ministry of Civil Service

Category: Data Breach

Content: The threat actor claims to have leaked data from Taiwan’s Civil Service Bureau, exposing information on 550,000 civil servants. The compromised dataset includes personal details such as Taiwanese phone numbers, national ID numbers, full names, department codes, employing agencies, job titles, and position codes.

Date: 2025-05-30T06:28:41Z

Network: openweb

Victim Country: Taiwan

Victim Industry: Government Administration

Victim Organization: ministry of civil service

Victim Site: csptc.gov.tw

Threat Actor Profile: heiwukoong

Information regarding a specific threat actor named “heiwukoong” is not directly available in the provided research material. The research notes discuss the political landscape in Taiwan and the “China threat” narrative ¹⁸, but do not link this to a specific threat actor.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://darkforums.st/Thread-Selling-Taiwan-s-Ministry-of-Civil-Service-database-leaked-in-February-2025-550k-lines
Screenshots: https://d34iuop8pidsy8.cloudfront.net/1f6597b4-c89c-425e-ada6-87d712025092.png

3.17: Alleged data breach of Deloitte

Category: Data Breach

Content: The threat actor claims to have breached the data of Deloitte. The compromised data includes of Github Credentials and source codes.

Date: 2025-05-30T06:27:04Z

Network: openweb

Victim Country: UK

Victim Industry: Management Consulting

Victim Organization: deloitte

Victim Site: deloitte.com

Threat Actor Profile: 303

The “303” threat actor refers to Squad 303, a Polish hacktivist group that has gained notoriety for its unique approach to information warfare against Russia.¹⁹ This group has orchestrated large-scale SMS campaigns, sending millions of text messages to Russian phone numbers with the aim of exposing information about the invasion of Ukraine.²⁰

Known Tactics, Techniques, and Procedures (TTPs): Mass SMS campaigns, public participation platforms (websites enabling public to send SMS messages to random Russian phone numbers), and information warfare.²⁰
Motivations and Past Noteworthy Activities: Driven by anti-Russia, pro-Ukraine hacktivism, aiming to wage “cyber war on Russia”.²⁰
Technical Details and Exploited Vulnerabilities: The primary technical methods involve mass SMS messaging and a web platform designed for public interaction and message dissemination.²⁰
Mitigation and Defensive Measures: Nations and organizations should enhance the security of communication networks to prevent abuse for mass messaging campaigns and develop comprehensive counter-disinformation strategies.²⁰
References:

Published URL: https://darkforums.st/Thread-Source-Code-Deloitte-com-Source-Code-Internal-Github-Credentials-leaked-download
Screenshots: https://d34iuop8pidsy8.cloudfront.net/e86ef5d4-e2be-43eb-89e7-0638df127532.png

3.18: Alleged Unauthorized Access to an unidentified tank and silo manufacturing company in Franc

Category: Initial Access

Content: The group claims to have gained unauthorized access to the control system of an unidentified tank and silo manufacturing company in France. The main vulnerability exploited was the lack of multi-factor authentication and minimal security measures.

Date: 2025-05-30T05:52:54Z

Network: telegram

Victim Country: France

Victim Industry: Manufacturing

Victim Organization:

Victim Site:

Threat Actor Profile: SECT0R16

SECT0R16 is a new Russian cybercriminal group that emerged in January 2025, known for its collaborations with other Kremlin-linked entities like Z-Pentest and OverFlame.²¹

Known Tactics, Techniques, and Procedures (TTPs): Primarily targets U.S. oil and gas infrastructure, with a specific focus on compromising SCADA systems and control panels of oil production facilities.²¹ Employs advanced techniques to infiltrate and manipulate targeted systems, including vulnerability exploitation, social engineering, manipulation of control interfaces, and data exfiltration.²¹ Leverages platforms such as Telegram, YouTube, and darknet private forums for communication and to manipulate public opinion.²¹
Motivations and Past Noteworthy Activities: Geopolitically driven, aiming to expose perceived abuses of power and corruption and to oppose major world powers. They have claimed responsibility for two attacks on U.S. oil facilities.²¹
Technical Details and Exploited Vulnerabilities: The group exploits internet-facing ICS/OT systems and compromises SCADA systems and control panels.²¹
Mitigation and Defensive Measures: Organizations must implement enhanced ICS/OT security measures, including robust segmentation, multi-factor authentication, and comprehensive incident response plans tailored for operational technology environments.
References:

Published URL: https://t.me/c/2269071661/57
Screenshots: https://d34iuop8pidsy8.cloudfront.net/f5de4db4-b000-4ff7-a879-472f8f84985e.png

3.19: Alleged data breach of the University of Jordon

Category: Data Breach

Content: The group claims to have breached the data of the University of Jordon. The compromised data includes of name, email, join time, leave time, etc…

Date: 2025-05-30T04:50:47Z

Network: telegram

Victim Country: Jordan

Victim Industry: Education

Victim Organization: the university of jordon

Victim Site: ju.edu.jo

Threat Actor Profile: Elite Squad

Information regarding a specific threat actor named “Elite Squad” is not directly available in the provided research material. The term “elite squad” is used generically in the research to refer to a cybersecurity research team ²³, and there is also discussion about developing cyber talent pipelines ²⁴, but no specific threat actor group with this name.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://t.me/zririririrgjdghodghod/192
Screenshots: https://d34iuop8pidsy8.cloudfront.net/6359fd08-e098-418a-98af-04ab9d78185c.png

3.20: Kal Egy 319 targets the website of Tec The Education Consultancy

Category: Defacement

Content: The group claims to have defaced the website of Tec The Education Consultancy. Mirror: https://haxor.id/archive/mirror/222894

Date: 2025-05-30T04:34:41Z

Network: telegram

Victim Country: USA

Victim Industry: Education

Victim Organization: tec the education consultancy

Victim Site: tec-lms.com

Threat Actor Profile: KAL EGY 319

KAL EGY 319 is a Pakistan-linked hacktivist group that engages in cyber activities often aligned with geopolitical tensions.²⁵ In May 2025, this group, among others, claimed over 100 cyberattacks on Indian government, education, and critical infrastructure websites, including widespread defacement campaigns and alleged data breaches.²⁵ However, investigations revealed that the actual impact of these alleged cyberattacks was minimal, with many claims being exaggerated, recycled, or outright fabricated.²⁵

Known Tactics, Techniques, and Procedures (TTPs): Mass defacement claims, data breach claims, and information warfare through spreading unverified claims on social media platforms.²⁵
Motivations and Past Noteworthy Activities: Motivations are rooted in geopolitical conflict, aiming to create a perception of digital conflict and influence public sentiment.²⁶
Technical Details and Exploited Vulnerabilities: The group claimed defacement and data breaches, though specific technical details of these alleged compromises were often lacking or unverified.²⁵
Mitigation and Defensive Measures: Organizations should maintain robust monitoring capabilities and critically evaluate public claims of cyberattacks, focusing on verifiable evidence of compromise. Comprehensive incident response plans are crucial to address both actual threats and potential disinformation campaigns.
References:

Published URL: https://t.me/KALE3G1Y9/489
Screenshots: https://d34iuop8pidsy8.cloudfront.net/c73652bc-dfdb-4358-adcb-ae9f2e901125.png

3.21: Kal Egy 319 targets the website of Graduate college of Education

Category: Defacement

Content: The group claims to target the website of Graduate college of Education. Mirror: https://haxor.id/archive/mirror/222895

Date: 2025-05-30T04:34:18Z

Network: telegram

Victim Country: Cuba

Victim Industry: Education

Victim Organization: graduate college of education

Victim Site: fgse.cu.edu.eg

Threat Actor Profile: KAL EGY 319

Known Tactics, Techniques, and Procedures (TTPs): Mass defacement claims, data breach claims, and information warfare through spreading unverified claims on social media platforms.²⁵
Motivations and Past Noteworthy Activities: Motivations are rooted in geopolitical conflict, aiming to create a perception of digital conflict and influence public sentiment.²⁶
Technical Details and Exploited Vulnerabilities: The group claimed defacement and data breaches, though specific technical details of these alleged compromises were often lacking or unverified.²⁵
Mitigation and Defensive Measures: Organizations should maintain robust monitoring capabilities and critically evaluate public claims of cyberattacks, focusing on verifiable evidence of compromise. Comprehensive incident response plans are crucial to address both actual threats and potential disinformation campaigns.
References:

Published URL: https://t.me/KALE3G1Y9/490
Screenshots: https://d34iuop8pidsy8.cloudfront.net/3f8457bc-48d7-47a9-bcc3-c958f11ac15d.png

3.22: Alleged data breach of sport2000

Category: Data Breach

Content: A threat actor claims to have leaked data from Sport 2000, a French sports retail chain with around 710 stores and over 3.3 million loyalty card users. The compromised dataset is 1.11 GB and dates from 2024; it allegedly includes customer and loyalty program information.

Date: 2025-05-30T04:26:01Z

Network: openweb

Victim Country: France

Victim Industry: Retail Industry

Victim Organization: sport2000

Victim Site: sport2000.fr

Threat Actor Profile: xelvain

Information regarding the specific threat actor “xelvain” is not available in the provided research material.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://darkforums.st/Thread-sport2000-database
Screenshots: https://d34iuop8pidsy8.cloudfront.net/beb67b6b-7af9-41fc-b590-3d2b66212bc9.png

3.23: Alleged data sale of Sucive

Category: Data Breach

Content: A threat actor claims to have leaked a dataset containing 618,000 records from Uruguay, including personal details, contact information, and vehicle data such as registration, chassis, and engine numbers.

Date: 2025-05-30T04:03:40Z

Network: openweb

Victim Country: Uruguay

Victim Industry: Automotive

Victim Organization: sucive

Victim Site: sucive.gub.uy

Threat Actor Profile: Tacuara

Tacuara refers to TAG-110 (also UAC-0063), a Russia-aligned threat actor believed to share overlaps with the Russian nation-state hacking crew APT28.²⁷ The group has been observed conducting spear-phishing campaigns, demonstrating a continuous adaptation of initial access vectors.²⁷

Known Tactics, Techniques, and Procedures (TTPs): Evolving initial access techniques, shifting from HTML Application (.HTA) loaders to macro-enabled Word templates (.DOTM) for payload delivery in spear-phishing campaigns.²⁷ They use government-themed documents as lure material and leverage global template files for persistence.²⁷
Motivations and Past Noteworthy Activities: Primarily cyber espionage, aimed at gathering intelligence to influence regional politics or security. The group has historically targeted European embassies and organizations in Central Asia, East Asia, and Europe.²⁷
Technical Details and Exploited Vulnerabilities: Attacks involve spear-phishing, macro-enabled Word documents (.DOTM), VBA macros for execution and persistence, and communication with command-and-control (C2) servers for further payload delivery.²⁷
Mitigation and Defensive Measures: Organizations should implement robust email security, enforce policies to disable macros by default, and deploy advanced endpoint detection and response (EDR) solutions to identify and block suspicious activity.
References:

Published URL: https://darkforums.st/Thread-Selling-618000-records-sucive-gub-uy
Screenshots: https://d34iuop8pidsy8.cloudfront.net/53c5d4ef-e1ba-4c10-917c-186aedae42f8.png

3.24: Alleged data breach of Claro

Category: Data Breach

Content: The threat actor claims to have leaked over 180,000 Claro Colombia cell phone numbers. The compromised dataset includes phone numbers associated with the Colombian telecommunications provider.

Date: 2025-05-30T03:51:45Z

Network: openweb

Victim Country: Colombia

Victim Industry: Network & Telecommunications

Victim Organization: claro

Victim Site: claro.com.co

Threat Actor Profile: C0mm4nd2

Information regarding a specific threat actor named “C0mm4nd2” is not directly available in the provided research material. The research notes provide general definitions and types of cybercrime, including identity theft, internet fraud, hacking, and data breaches.²⁸

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material. General cybercrime tactics include using computers to illegally access, transmit, or manipulate data.²⁸
Motivations and Past Noteworthy Activities: Not available in the provided research material. General motivations for cybercrime include financial gain, political objectives, or disruption.²⁸
Technical Details and Exploited Vulnerabilities: Not available in the provided research material. General vulnerabilities include the increasing prevalence of mobile devices, social networks, and cloud computing, which offer new avenues for cybercriminals.²⁸
Mitigation and Defensive Measures: Not available in the provided research material. General recommendations include a coordinated response among end users, financial institutions, and cybersecurity professionals to thwart sophisticated attacks.²⁸
References:

Published URL: https://darkforums.st/Thread-Document-180k-Claro-Colombia-cell-phone-numbers
Screenshots: https://d34iuop8pidsy8.cloudfront.net/f07e73dd-0c3e-448d-9c7b-4133d86c7378.png

3.25: KAL EGY 319 targets the website of BDSS

Category: Defacement

Content: The group claims to have defaced the website of BDSS. https://haxor.id/archive/mirror/222893

Date: 2025-05-30T03:42:47Z

Network: telegram

Victim Country: Bahrain

Victim Industry: Industrial Automation

Victim Organization: bdss

Victim Site: bdss.bh

Threat Actor Profile: KAL EGY 319

Known Tactics, Techniques, and Procedures (TTPs): Mass defacement claims, data breach claims, and information warfare through spreading unverified claims on social media platforms.²⁵
Motivations and Past Noteworthy Activities: Motivations are rooted in geopolitical conflict, aiming to create a perception of digital conflict and influence public sentiment.²⁶
Technical Details and Exploited Vulnerabilities: The group claimed defacement and data breaches, though specific technical details of these alleged compromises were often lacking or unverified.²⁵
Mitigation and Defensive Measures: Organizations should maintain robust monitoring capabilities and critically evaluate public claims of cyberattacks, focusing on verifiable evidence of compromise. Comprehensive incident response plans are crucial to address both actual threats and potential disinformation campaigns.
References:

Published URL: https://t.me/KALE3G1Y9/488
Screenshots: https://d34iuop8pidsy8.cloudfront.net/f62ac8b6-a72d-4430-a192-c661bc301bc1.png

3.26: Alleged access sale of Atlassian Corporation Plc

Category: Initial Access

Content: A group claims to have accessed the server of Atlassian Corporation Plc, which is hosted by Digital Ocean LLC. The access has been gained through exploiting the CVE-2023-22527 vulnerability. The compromised access includes all sensitive data and sensitive configuration files, passwords, and other files.

Date: 2025-05-30T03:27:48Z

Network: telegram

Victim Country: Australia

Victim Industry: Software Development

Victim Organization: atlassian corporation plc

Victim Site: atlassian.com

Threat Actor Profile: LulzSec Black

LulzSec Black refers to Lulz Security, or “LulzSec,” a computer hacker group known for high-profile cyberattacks.³⁰ While the original LulzSec disbanded, new iterations like “LulzSec Reborn” have emerged.³⁰ Their hacking was often for “the lulz” (entertainment) rather than financial gain.³⁰

Known Tactics, Techniques, and Procedures (TTPs): Breaking into computer networks of governments, companies, and individuals, making public vast quantities of data, and planting false stories.³⁰ They have also been associated with mass digital assaults and defacing websites.³¹
Motivations and Past Noteworthy Activities: Primarily for “lulz” or entertainment, and hacktivism, such as protesting treatment of WikiLeaks.³⁰
Technical Details and Exploited Vulnerabilities: Historically, LulzSec has exploited vulnerabilities in various systems to gain access and exfiltrate data.³⁰
Mitigation and Defensive Measures: Organizations should implement robust vulnerability management programs, conduct regular security audits, and maintain strong access controls to prevent unauthorized access.
References:

Published URL: https://t.me/c/2218423825/7504
Screenshots: https://d34iuop8pidsy8.cloudfront.net/d25d318f-5f72-4f22-abd9-7376df25c76c.png

3.27: Alleged data leak of Badan Pengawas Tenaga Nuklir

Category: Data Leak

Content: The threat actor claims to be selling Indonesia’s Nuclear Energy Regulatory Agency (BAPETEN). They claim to have access to several internal databases, potentially exposing sensitive nuclear regulatory information.

Date: 2025-05-30T02:27:11Z

Network: openweb

Victim Country: Indonesia

Victim Industry: Government Administration

Victim Organization: badan pengawas tenaga nuklir

Victim Site: bapeten.go.id

Threat Actor Profile: ParanoidHax

ParanoidHax is a hacktivist group that focuses on publicizing data breaches and leaks, often for ideological or disruptive purposes.¹ They, along with other groups like THE ANON 69, Indohaxsec, and Defacer Kampung, have been observed actively promoting data leaks, primarily through their Telegram channels.¹

Known Tactics, Techniques, and Procedures (TTPs): Data leak promotion and dissemination of information about data leaks, primarily leveraging public messaging platforms like Telegram.¹
Motivations and Past Noteworthy Activities: Typically involve ideological disruption and public exposure of sensitive information.¹ The growing sophistication of hacktivist groups is narrowing the gap between nation-state and financially motivated threat actors.¹
Technical Details and Exploited Vulnerabilities: While specific technical details of how these groups acquire the data are not provided, their primary activity involves the public dissemination of previously compromised information.
Mitigation and Defensive Measures: Organizations should implement robust data loss prevention (DLP) measures, conduct continuous monitoring for data exfiltration, and maintain active threat intelligence subscriptions to track data leak promotion on public and dark web platforms.
References:

Published URL: https://darkforums.st/Thread-Document-Badan-Pengawas-Tenaga-Nuklir-INDONESIAN
Screenshots: https://d34iuop8pidsy8.cloudfront.net/1805d4e9-19d7-4e83-acad-0b6730dc4215.png

3.28: Alleged data sale of France Travail

Category: Data Breach

Content: The threat actor claims to be involving change to selling 1.2 million personal records from France Travail. The data was illegally accessed and is being sold online, violating GDPR and posing major privacy risks.

Date: 2025-05-30T02:01:36Z

Network: openweb

Victim Country: France

Victim Industry: Government Administration

Victim Organization: france travail

Victim Site: francetravail.fr

Threat Actor Profile: ryolait

Information regarding a specific threat actor named “ryolait” is not directly available in the provided research material. The research notes discuss a general incident where a breach went undetected for five months and was only discovered when hackers contacted the organization.³² This highlights the severe consequences of delayed breach detection and the financial and legal fallout that can ensue.³²

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material. The incident implies an initial compromise leading to data exfiltration and subsequent financial extortion, characteristic of ransomware or data breach extortion tactics.³²
Motivations and Past Noteworthy Activities: Not available in the provided research material. The primary motivation for such incidents is financial gain through extortion.³²
Technical Details and Exploited Vulnerabilities: Specific technical details of the initial compromise are not provided, but the prolonged undetected presence suggests vulnerabilities in continuous security monitoring and alert management systems.³²
Mitigation and Defensive Measures: General recommendations include establishing robust continuous security monitoring, effective alert escalation procedures, and comprehensive incident response planning that accounts for technical, legal, and public relations aspects.³²
References:

Published URL: https://darkforums.st/Thread-pole-emloi-fr-France-Travail-1-2-million
Screenshots: https://d34iuop8pidsy8.cloudfront.net/fcd544b3-cda9-4289-8c0e-ddf07d1bce4a.png

3.29: Alleged data leak of Kementerian Dalam Negeri Republik Indonesia

Category: Data Leak

Content: The threat actor claims to be a large-scale data leak from Indonesia’s Kementerian Dalam Negeri Republik Indonesia exposed personal details like names, ID numbers, birthdate addresses, and phone numbers.

Date: 2025-05-30T01:41:33Z

Network: openweb

Victim Country: Indonesia

Victim Industry: Government Administration

Victim Organization: kementerian dalam nageri republik indonesia

Victim Site: kemendagri.go.id

Threat Actor Profile: Hime666

Information regarding the specific threat actor “Hime666” is not available in the provided research material.

Known Tactics, Techniques, and Procedures (TTPs): Not available in the provided research material.
Motivations and Past Noteworthy Activities: Not available in the provided research material.
Technical Details and Exploited Vulnerabilities: Not available in the provided research material.
Mitigation and Defensive Measures: Not available in the provided research material.
References:

Published URL: https://darkforums.st/Thread-Document-DUKCAPIL-INDONESIA-5-GB-FRESS
Screenshots: https://d34iuop8pidsy8.cloudfront.net/e30c558f-90d7-40bc-b751-18f39cde66e3.png

4. Emerging Threat Actor Insights & Trends

The analysis of the recent incidents highlights several key trends in the cybersecurity landscape:

Diverse Attack Categories: The incidents cover a wide range of attack categories, including defacement, data breach, data leak, and initial access. This indicates that threat actors employ varied methods to achieve their objectives, from public disruption to direct financial gain.
Monetization of Data: A significant number of incidents involve the selling or leaking of sensitive data on dark web forums. This underscores the robust underground economy for stolen information, which includes personal records, credentials, and proprietary company data.
Geographical Spread: Victims are located across numerous countries, including Italy, USA, Iran, Azerbaijan, Canada, France, Indonesia, UK, Jordan, Saudi Arabia, Mexico, Taiwan, Uruguay, Colombia, and Bahrain. This global reach emphasizes the borderless nature of cyber threats.
Varied Threat Actor Sophistication: The actors range from well-resourced, state-sponsored entities (e.g., B4baYega, Tacuara/TAG-110) to hacktivist groups (e.g., Team 1722, KAL EGY 319, 303, ParanoidHax) and opportunistic cybercriminals (e.g., LandLord, AKA_Astaroth). Some incidents also involve actors for whom detailed information is not readily available, highlighting the challenge of attribution.
Social Engineering and Phishing Persistence: Tactics like sophisticated phishing campaigns (e.g., gesss, AKA_Astaroth) and identity fabrication (e.g., B4baYega) remain highly effective, demonstrating that human vulnerabilities are still a primary target for initial access.
Critical Infrastructure and Government Targets: Government entities (e.g., EPA, Ministry of Civil Service, France Travail, BAPETEN, Bangladesh GIS) and critical infrastructure (e.g., energy, telecommunications, manufacturing control systems) continue to be high-value targets for various threat actors, driven by espionage, financial, or geopolitical motivations.
Hacktivism and Information Warfare: Groups like KAL EGY 319 and 303 use cyberattacks not only for direct impact but also as a tool for information warfare, spreading claims and influencing narratives, sometimes with exaggerated or fabricated results.

5. Recommendations for Enhanced Cybersecurity Posture

In light of the observed threat landscape, organizations must adopt a proactive and adaptive defense strategy. The following recommendations are crucial for enhancing cybersecurity posture:

Implement Robust Identity and Access Management: Strengthen authentication mechanisms, including phishing-resistant multi-factor authentication (MFA) for all accounts, especially administrative ones. Implement advanced identity verification processes for new hires and continuous vetting to counter sophisticated social engineering and identity fabrication attempts.
Enhance Data Protection and Loss Prevention: Prioritize data encryption both in transit and at rest. Implement comprehensive data loss prevention (DLP) solutions to monitor and prevent unauthorized exfiltration of sensitive information. Regularly back up critical data and ensure backups are isolated and tested for recovery.
Strengthen Endpoint and Network Security: Deploy advanced Endpoint Detection and Response (EDR) solutions to detect and respond to malicious activity on devices. Implement robust email security gateways to filter out phishing attempts and malicious attachments. Segment networks to limit lateral movement in case of a breach.
Improve Vulnerability Management: Conduct regular vulnerability assessments and penetration testing to identify and remediate weaknesses in systems and applications. Promptly patch and update all software, operating systems, and firmware to address known vulnerabilities.
Develop Comprehensive Incident Response Plans: Create and regularly test detailed incident response plans that cover detection, containment, eradication, recovery, and post-incident analysis. Ensure clear communication protocols for internal and external stakeholders, including legal and public relations teams.
Invest in Security Awareness Training: Conduct continuous and targeted security awareness training for all employees. Educate staff on recognizing various social engineering tactics, including phishing, vishing, and impersonation, and emphasize the importance of verifying suspicious communications.
Leverage Threat Intelligence: Subscribe to and actively utilize threat intelligence feeds to stay informed about emerging threats, new attack methodologies, and the activities of relevant threat actors. This proactive approach helps in anticipating and preparing for potential attacks.
Secure Third-Party and Cloud Environments: Implement strong security measures for third-party vendors and cloud services. Ensure that contracts include robust cybersecurity clauses and that vendors adhere to security best practices, as supply chain vulnerabilities can be exploited.

By focusing on these key areas, organizations can build a more resilient cybersecurity posture capable of defending against the evolving and diverse threats observed in the current landscape.

Works cited

Rise in hacktivist threats to critical sector, as pro-Russian groups cause 50% rise in ICS/OT attacks in March – Industrial Cyber, accessed May 30, 2025, https://industrialcyber.co/reports/rise-in-hacktivist-threats-to-critical-sector-as-pro-russian-groups-cause-50-rise-in-ics-ot-attacks-in-march/
Hacktivists Target Critical Infrastructure, Move Into Ransomware – Cyble, accessed May 30, 2025, https://cyble.com/blog/hacktivists-infrastructure-move-into-ransomware/
Cyber firm KnowBe4 hired a fake IT worker from North Korea | CyberScoop, accessed May 30, 2025, https://cyberscoop.com/cyber-firm-knowbe4-hired-a-fake-it-worker-from-north-korea/
Agencies issue update on BlackSuit ransomware group | AHA News, accessed May 30, 2025, https://www.aha.org/news/headline/2024-08-08-agencies-issue-update-blacksuit-ransomware-group
List of hacker groups – Wikipedia, accessed May 30, 2025, https://en.wikipedia.org/wiki/List_of_hacker_groups
Property Management Cybersecurity Risks: How Landlords Can Secure Tenant Information, accessed May 30, 2025, https://jaxontexas.com/property-management-cybersecurity-risks-how-landlords-can-secure-tenant-information/
How landlords can safeguard against cybercrime – NRLA, accessed May 30, 2025, https://www.nrla.org.uk/news/how-landlords-can-safeguard-against-cybercrime
World Leaks: An Extortion Platform – Lexfo’s security blog, accessed May 30, 2025, https://blog.lexfo.fr/world-leaks-an-extortion-platform.html
Decrypt World Leaks Ransomware – Digital Recovery, accessed May 30, 2025, https://digitalrecovery.com/en/decrypt-ransomware/world-leaks/
Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer, accessed May 30, 2025, https://www.seqrite.com/blog/threat-actors-are-targeting-us-tax-session-with-new-tactics-of-stealerium-infostealer/
Unsophisticated cyber actors are targeting the U.S. Energy sector – Security Affairs, accessed May 30, 2025, https://securityaffairs.com/177551/security/unsophisticated-cyber-actors-are-targeting-the-u-s-energy-sector.html
The Digital Fort Knox: 8 Security Essentials Every Small Business Needs – IT Architeks, accessed May 30, 2025, https://www.itarchiteks.com/the-digital-fort-knox-8-security-essentials-every-small-business-needs
Russian hackers Void Blizzard step up espionage campaign | SC Media, accessed May 30, 2025, https://www.scmagazine.com/news/russian-hackers-void-blizzard-step-up-espionage-campaign
Microsoft, Dutch government discover new Russian hacking group | Cybersecurity Dive, accessed May 30, 2025, https://www.cybersecuritydive.com/news/russia-ukraine-logistics-laundry-bear-microsoft-netherlands/749143/
A New Dark Actor Enters the Criminal Underground. Discovering Skira Ransomware, accessed May 30, 2025, https://www.redhotcyber.com/en/post/a-new-dark-actor-enters-the-criminal-underground-discovering-skira-ransomware/
CFOs, financial execs in crosshairs of ‘highly targeted’ spearphishing campaign, accessed May 30, 2025, https://www.cybersecuritydive.com/news/spearphishing-remote-access-campaign-cfos-finance-executives-trellix/749192/
Astaroth Phishing Kit Bypasses 2FA Using Reverse Proxy Techniques, accessed May 30, 2025, https://www.infosecurity-magazine.com/news/astaroth-phishing-kit-bypasses-2fa/
How the narrative of China as a threat evolved into a populist attitude in Taiwan during the administration of the Democratic Pr – Oxford Academic, accessed May 30, 2025, https://academic.oup.com/irap/article-pdf/25/2/lcaf003/63394685/lcaf003.pdf
No. 303 Squadron RAF – Wikipedia, accessed May 30, 2025, https://en.wikipedia.org/wiki/No._303_Squadron_RAF
Inside Squad 303 – the ‘largest hacking op in history’ waging cyber war on Russia, accessed May 30, 2025, https://www.dailystar.co.uk/news/world-news/inside-squad-303-largest-hacking-26514650
Sector 16 Group – Cyber Intelligence Bureau – Orange Cyberdefense, accessed May 30, 2025, https://www.orangecyberdefense.com/fileadmin/global/CyberIntelligenceBureau/Gangs_Investigations/Sector16/Sector16Group.pdf
A New Russian Cybercriminal Group Targets U.S. Oil and Gas Facilities – INCYBER NEWS, accessed May 30, 2025, https://incyber.org/en/article/a-new-russian-cybercriminal-group-targets-u-s-oil-and-gas-facilities/
Where Capability Meets Opportunity: Introducing the Tenable Research Special Operations Team, accessed May 30, 2025, https://www.tenable.com/blog/where-capability-meets-opportunity-introducing-the-tenable-research-special-operations-team
ROTC for Hackers: Developing a Pipeline of Cyber Talent for National Defense | CNAS, accessed May 30, 2025, https://www.cnas.org/publications/commentary/rotc-for-hackers-developing-a-pipeline-of-cyber-talent-for-national-defense
Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge | CloudSEK, accessed May 30, 2025, https://www.cloudsek.com/blog/brief-disruptions-bold-claims-the-tactical-reality-behind-the-india-pakistan-hacktivist-surge
Hacker hype vs. real risks: Inside the true scale of India-Pakistan cyber clash, accessed May 30, 2025, https://www.capacitymedia.com/article/hacker-hype-vs-real-risks-inside-the-true-scale-of-india-pak-cyber-clash
Russia-Linked Hackers Target Tajikistan Government with Weaponized Word Documents, accessed May 30, 2025, https://thehackernews.com/2025/05/russia-linked-hackers-target-tajikistan.html
CYBERCRIME Definition & Meaning – Merriam-Webster, accessed May 30, 2025, https://www.merriam-webster.com/dictionary/cybercrime
Cybercrime | Definition, Statistics, & Examples – Britannica, accessed May 30, 2025, https://www.britannica.com/topic/cybercrime
LulzSec – Radware, accessed May 30, 2025, https://www.radware.com/security/ddos-knowledge-center/ddospedia/lulzsec/
We Are Anonymous: Inside the Hacker World of LulzSec, Anonymous, and the Global Cyber Insurgency – Amazon.com, accessed May 30, 2025, https://www.amazon.com/We-Are-Inside-LulzSec-Insurgency/dp/0316213543
Report shows hackers used stolen credentials to access state benefits system – YouTube, accessed May 30, 2025, https://www.youtube.com/watch?v=t-bwYwTyVhU

1. Executive Summary

2. Daily Incident Overview

3. Detailed Incident Analysis

3.1: Team 1722 targets the website of Tripoli Immobiliare

Threat Actor Profile: Team 1722

3.2: Alleged data sale of United States Environmental Protection Agency

Threat Actor Profile: B4baYega

3.3: Blackswamp targets the website of Aftab Information Processing Company

Threat Actor Profile: Blackswamp

3.4: Alleged sale of Azerbaijan Gambling-Casino players leads

Threat Actor Profile: LandLord

3.5: Alleged data breach of Canadian Rocky Mountain Resorts

Threat Actor Profile: Worldleaks

3.6: Alleged data breach of Wekiwi France

Threat Actor Profile: icikevin

3.7: Alleged data sale of TotalEnergies Power & Gas

Threat Actor Profile: icikevin

3.8: Alleged data leak of Telkom Indonesia

Threat Actor Profile: gesss

3.9: Alleged sale of unauthorized access to French Magento Shop

Threat Actor Profile: Fordnox

3.10: Alleged data leak of Super Store Finder

Threat Actor Profile: VOID

3.11: Alleged sale of Chinese citizen’s personal data

Threat Actor Profile: Skivon

3.12: Alleged data leak of Princeton University

Threat Actor Profile: VOID

3.13: Alleged data leak of Bangladesh Geographic Information System

Threat Actor Profile: VOID

3.14: Alleged database leak of New World International School

Threat Actor Profile: JakartaCyberPsychos

3.15: Alleged data sale of an unidentified car company in Mexico

Threat Actor Profile: AKA_Astaroth

3.16: Alleged data sale of Ministry of Civil Service

Threat Actor Profile: heiwukoong

3.17: Alleged data breach of Deloitte

Threat Actor Profile: 303

3.18: Alleged Unauthorized Access to an unidentified tank and silo manufacturing company in Franc

Threat Actor Profile: SECT0R16

3.19: Alleged data breach of the University of Jordon

Threat Actor Profile: Elite Squad

3.20: Kal Egy 319 targets the website of Tec The Education Consultancy

Threat Actor Profile: KAL EGY 319

3.21: Kal Egy 319 targets the website of Graduate college of Education

Threat Actor Profile: KAL EGY 319

3.22: Alleged data breach of sport2000

Threat Actor Profile: xelvain

3.23: Alleged data sale of Sucive

Threat Actor Profile: Tacuara

3.24: Alleged data breach of Claro

Threat Actor Profile: C0mm4nd2

3.25: KAL EGY 319 targets the website of BDSS

Threat Actor Profile: KAL EGY 319

3.26: Alleged access sale of Atlassian Corporation Plc

Threat Actor Profile: LulzSec Black

3.27: Alleged data leak of Badan Pengawas Tenaga Nuklir

Threat Actor Profile: ParanoidHax

3.28: Alleged data sale of France Travail

Threat Actor Profile: ryolait

3.29: Alleged data leak of Kementerian Dalam Negeri Republik Indonesia

Threat Actor Profile: Hime666

4. Emerging Threat Actor Insights & Trends

5. Recommendations for Enhanced Cybersecurity Posture

Works cited

Related Posts

[April-10-2025] Daily Cybersecurity Threat Report

[April-12-2025] Daily Cybersecurity Threat Report – Part 2

[May-25-2025] Daily Cybersecurity Threat Report