This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
- Alleged data leak of F-13 fighter jet documents
- Category: Data Breach
- Content: Threat actor claims to be selling Top Secret F-13 Fighter Jet documents.
- Date: 2025-10-17T23:51:23Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-%F0%9F%A4%96-TOP-SECRET-F-13-FIGHTER-JET-DOCUMENT-%F0%9F%A4%96)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/62751174-4ac9-407b-84b4-7a98b1831971.png
- Threat Actors: jrintel
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data leak of unidentified Brazilian e-commerce firm
- Category: Data Breach
- Content: Threat actor claims to be selling an 820,000-record database of Brazilian e-commerce customers that includes CPF (Brazilian tax ID) numbers and extensive order details.
- Date: 2025-10-17T23:42:22Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-820k-Brazil-E-Commerce-Database-with-CPF-Order-Details)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/827d12eb-f24a-480f-8d32-c5622aaac58c.png
- Threat Actors: Loser
- Victim Country: Brazil
- Victim Industry: E-commerce & Online Stores
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged leak of Top Secret Joint Cyberspace Operations document
- Category: Data Breach
- Content: The threat actor claims to be selling a classified Joint Cyberspace Operations document dated December 19, 2022, reportedly labeled as Top Secret and related to Joint Publication 3-12.
- Date: 2025-10-17T23:35:05Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-%F0%9F%A4%96-TOP-SECRET-JOINT-CYBERSPACE-OPERATIONS-DOCUMENT-%F0%9F%A4%96)
- Screenshots:
- Threat Actors: jrintel
- Victim Country: USA
- Victim Industry: Defense & Space
- Victim Organization: joint publication 3-12 — joint cyberspace operations
- Victim Site: Unknown
- Alleged gain of access to Shengao Biotechnology Co., Ltd.
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to Shengao Biotechnology Co., Ltd.’s internal monitoring system. The system reportedly manages temperature and humidity in the company’s refrigeration and culture facilities and tracks warehouses storing biological materials and pharmaceuticals in real time. It also issues alerts for abnormal conditions and includes network configuration, device connection, and automatic data backup to an SD card.
- Date: 2025-10-17T23:15:11Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/1993)
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: shengao biotechnology co., ltd.
- Victim Site: Unknown
- Alleged data leak of an unidentified Argentina National Business Project Portal
- Category: Data Breach
- Content: Threat actor claims to be selling a 620,000-entry dump from an Argentina National Business Project Portal, allegedly including passwords and account fields (id, hashID, clave, email, level, active, committee, name, company, username, project, website, phone, address, timestamps, etc.)
- Date: 2025-10-17T23:13:08Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-620k-Argentina-National-Business-Project-Portal-Database-with-Passwords–56436)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/85f2c7ba-9666-4732-9971-f207ad6b00d5.png
- Threat Actors: Loser
- Victim Country: Argentina
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data leak of an unidentified amateur sports league platform in Canada
- Category: Data Breach
- Content: The threat actor claims to be selling leaked data from a Canadian amateur sports league platform. The compromised database reportedly contains information of 265,000 users, including emails, passwords, IP addresses, usernames, and personal details such as city, bio, and arena names.
- Date: 2025-10-17T23:03:12Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-265k-Canada-Amateur-Sports-League-Platform-User-Database-Passwords-IPs)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/f24652f5-6ead-4b69-bbcd-aac6b39ae5e1.png
- Threat Actors: Loser
- Victim Country: Canada
- Victim Industry: Sports
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data breach of cfx.re
- Category: Data Breach
- Content: Threat actor claims to have leaked database of cfx.re, part of Rockstar games. The compromised data reportedly contain over 6.5 million user data from year 2023 to 2025.
- Date: 2025-10-17T22:43:17Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-CFX-RE-FULL-6-5M-USERS-2023-2025)
- Screenshots:
- Threat Actors: Tenere700
- Victim Country: Netherlands
- Victim Industry: Gaming
- Victim Organization: cfx.re
- Victim Site: cfx.re
- Alleged data breach of Zasudali
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Zasudali, Russia. The compromised data reportedly contains database of magistrates (219,161), database of judges with biographies (28,492), and database of FSIN facilities (923).
- Date: 2025-10-17T22:11:34Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-zasudili-ru-Leak)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/56b113ba-0f93-4ce1-aadd-28127db71d4d.png
- Threat Actors: btCC
- Victim Country: Russia
- Victim Industry: Information Services
- Victim Organization: zasudali
- Victim Site: zasudili.ru
- Hoehner Research & Consulting Group GmbH falls victim to Sinobi ransomware
- Category: Ransomware
- Content: Group claims to have obtained 20 GB of organization’s data.
- Date: 2025-10-17T22:04:24Z
- Network: tor
- Published URL: (http://sinobi6ywgmmvg2gj2yygkb2hxbimaxpqkyk27wti5zjwhfcldhackid.onion/leaks/68f2b08c88b6823fa2a1813b)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/c70d28fb-bea5-4a20-ac1e-880ee9614429.png
- Threat Actors: Sinobi
- Victim Country: Germany
- Victim Industry: Renewables & Environment
- Victim Organization: hoehner research & consulting group gmbh
- Victim Site: hrcg.eu
- D Magazine Partners falls victim to Sinobi ransomware
- Category: Ransomware
- Content: Group claims to have obtained 205 GB of organization’s data.
- Date: 2025-10-17T21:59:44Z
- Network: tor
- Published URL: (http://sinobi6ywgmmvg2gj2yygkb2hxbimaxpqkyk27wti5zjwhfcldhackid.onion/leaks/68f2ac6288b6823fa2a166b5)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/a124442d-65e6-4013-bf2e-17bb5cf51e4c.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Publishing Industry
- Victim Organization: d magazine
- Victim Site: dmagazine.com
- Alleged data sale of TravelWifi
- Category: Data Breach
- Content: Threat actor claims to be selling leaked US military data from TravelWifi, part of DHI Telecom, USA. The compromised data reportedly contains 10gb SQL dump file regarding DHI Telecom Including username,email,base64 encrypted password, address, etc.
- Date: 2025-10-17T21:53:03Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-300k-US-Military-DHI-Telecom-travelwifi-com)
- Screenshots:
- Threat Actors: haxorsss
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: travelwifi
- Victim Site: travelwifi.com
- Madagascar Airlines falls victim to The Gentlemen ransomware
- Category: Ransomware
- Content: Group claims to have obtained organization’s data.
- Date: 2025-10-17T21:52:01Z
- Network: tor
- Published URL: (http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/)
- Screenshots:
- Threat Actors: The Gentlemen
- Victim Country: Madagascar
- Victim Industry: Airlines & Aviation
- Victim Organization: madagascar airlines
- Victim Site: madagascarairlines.com
- Alleged data breach of Fruit paradise
- Category: Data Breach
- Content: Threat actor claims to have leaked database from Fruit paradise (Фруктовый рай), Russia. The compromised data reportedly contains admin credentials, payment details, order details, user data and delivery information.
- Date: 2025-10-17T21:03:30Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-%D0%BA%D0%B0%D1%80%D0%B2%D0%B8%D0%BD%D0%B3-%D0%BA%D0%B0%D0%B7%D0%B0%D0%BD%D1%8C-%D1%80%D1%84-Database)
- Screenshots:
- Threat Actors: btCC
- Victim Country: Russia
- Victim Industry: E-commerce & Online Stores
- Victim Organization: fruit paradise
- Victim Site: арвинг-казань.рф
- Collins Aerospace falls victim to Everest ransomware
- Category: Ransomware
- Content: Group claims to have obtained the organization’s data and access. Note : A threat actor named “Minion” posted on a cybercrime forum about a cyberattack targeting Collins Aerospace on September 22, 2025.
- Date: 2025-10-17T20:37:18Z
- Network: tor
- Published URL: (http://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion/news/colinsaerospace/)
- Screenshots:
- Threat Actors: Everest
- Victim Country: USA
- Victim Industry: Aviation & Aerospace
- Victim Organization: collins aerospace
- Victim Site: collinsaerospace.com
- Alleged sale of server root access and payment-redirect scheme
- Category: Initial Access
- Content: The threat actor claims to be selling root access to a server used for a US-targeted porn payment-redirect scheme.
- Date: 2025-10-17T20:34:38Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268450/)
- Screenshots:
- Threat Actors: funfact
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Shadrix & Parmer, P.C. falls victim to INC RANSOM ransomware
- Category: Ransomware
- Content: Group claims to have obtained organization’s data. Sample screenshots are provided on their dark web portal.
- Date: 2025-10-17T20:03:37Z
- Network: tor
- Published URL: (http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/68f1c669fa0b6f4bdfca2d5f)
- Screenshots:
- Threat Actors: INC RANSOM
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: shadrix & parmer, p.c.
- Victim Site: shadrixlaw.com
- Cottage Corporation falls victim to PLAY ransomware
- Category: Ransomware
- Content: Group claims to have obtained organization’s data and plans to publish it within 2 days.
- Date: 2025-10-17T19:59:44Z
- Network: tor
- Published URL: (http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion/topic.php?id=U5GnJ7BFvO7fy)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: USA
- Victim Industry: Hospitality & Tourism
- Victim Organization: cottage corporation
- Victim Site: cottagecorp.com
- Alleged data sale of Australian accounting
- Category: Data Breach
- Content: The threat actor claims to be selling a large dataset of Australian accounting. The compromised data reportedly contains 89.9 gb records that includes tax return, audits, company statement, corporate key, shares in the company, etc.
- Date: 2025-10-17T19:58:38Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268446/)
- Screenshots:
- Threat Actors: remotedesktop
- Victim Country: Austria
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data sale of Democrazia Sovrana Popolare
- Category: Data Breach
- Content: The threat actor claims to be selling data from Italian political party Democrazia Sovrana Popolare (DSP). The compromised data reportedly contains 5000 records that includes user, password, phone, payments and personal data.
- Date: 2025-10-17T19:45:57Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/democrazia-sovrana-popolare-political-party-leak.44607/)
- Screenshots:
- Threat Actors: USDT
- Victim Country: Italy
- Victim Industry: Non-profit & Social Organizations
- Victim Organization: democrazia sovrana popolare
- Victim Site: democraziasovranapopolare.net
- Milgard Windows and Doors falls victim to CL0P ransomware
- Category: Ransomware
- Content: Group claims to have obtained organization’s data.
- Date: 2025-10-17T19:40:41Z
- Network: tor
- Published URL: (http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/milgard-com)
- Screenshots:
- Threat Actors: CL0P
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: milgard windows and doors
- Victim Site: milgard.com
- Alleged sale of mixed access to email accounts
- Category: Initial Access
- Content: The threat actor claims to be selling 45,000 mixed access to email accounts.
- Date: 2025-10-17T19:30:11Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/45k-mix-access-mail.44606/)
- Screenshots:
- Threat Actors: Nira
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data sale of prueba.farmagranada.es
- Category: Data Breach
- Content: The threat actor claims to be selling data from prueba.farmagranada.es(subdomain of farmagranada.com). The compromised data reportedly contains 1 gb of records emails, customer records, and additional sensitive information.
- Date: 2025-10-17T19:24:12Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/prueba-farmagranada-es.39456/#post-233206)
- Screenshots:
- Threat Actors: frog
- Victim Country: Spain
- Victim Industry: E-commerce & Online Stores
- Victim Organization: prueba.farmagranada.es
- Victim Site: prueba.farmagranada.es
- Alleged data breach of adscale
- Category: Data Breach
- Content: Threat actor claims to have leaked data and source code from adscale, USA. The compromised data reportedly contains data from as recent as October 16th, and had their source code. NB: adscale was previously breached on Mon Sep 15 2025.
- Date: 2025-10-17T18:58:57Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Source-Code-AdScale-Data-Breach-Leaked-Download)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/fd3e664f-3b88-4ac5-b09a-becab710b7ee.png
- Threat Actors: 888
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: adscale
- Victim Site: adscale.com
- Alleged sale of 3.5M UK email leads
- Category: Data Breach
- Content: The threat actor claims to be selling a dataset of 3.5 million UK email leads.
- Date: 2025-10-17T18:52:27Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/3-5m-uk-emails-leads.44605/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/09138450-fe4b-464e-a162-c51334770999.png
- Threat Actors: oguser
- Victim Country: UK
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data sale of Crypto University
- Category: Data Breach
- Content: Threat actor claims to be selling leaked users data from Crypto University, UAE. The compromised data reportedly contains 25,800 records including user id, status, affiliate code, email address, passwords (hashed), first name, last name, address, postal code, phone number etc.
- Date: 2025-10-17T18:16:45Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-CryptoUniversity-network-Database)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/1d92bddc-08ce-41ad-8834-2d7d0188657c.png
- https://d34iuop8pidsy8.cloudfront.net/4bcd1b26-f67b-41fc-82b4-bdabfc5853bd.png
- Threat Actors: 888
- Victim Country: UAE
- Victim Industry: E-Learning
- Victim Organization: crypto university
- Victim Site: cryptouniversity.network
- Law Offices of Galine, Frye, Fitting & Frangos, LLP falls victim to PEAR ransomware
- Category: Ransomware
- Content: Group claims to have obtained 2.1 TB of the organization’s data. The compromised information reportedly includes financial records, confidential documents, personal data, and more.
- Date: 2025-10-17T17:19:18Z
- Network: tor
- Published URL: (http://peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion/Companies/dongaline/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/193250c1-9361-48e2-8d26-8edd6634903f.png
- Threat Actors: PEAR
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: law offices of galine, frye, fitting & frangos, llp
- Victim Site: dongaline.com
- Tenryu America falls victim to Akira ransomware
- Category: Ransomware
- Content: Group claims to have obtained the organization’s data. The compromised information reportedly includes employee records, client data, contracts, and financial documents.
- Date: 2025-10-17T16:49:58Z
- Network: tor
- Published URL: (https://www.google.com/search?q=https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/45a67654-789b-45e6-bd4c-70d643469304.png
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: tenryu america, inc.
- Victim Site: tenryu.com
- Alleged data breach of TripWorks
- Category: Data Breach
- Content: Threat actor claims to have leaked users data from TripWorks, USA. The compromised data reportedly contains over 100,000 users data including booking ids, first names, last names, email addresses, phone numbers, dates, booking details, etc.
- Date: 2025-10-17T16:43:58Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-TripWorks-Data-Breach-Leaked-Download)
- Screenshots:
- Threat Actors: 888
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: tripworks
- Victim Site: tripworks.com
- Manko Window Systems falls victim to akira ransomware
- Category: Ransomware
- Content: Group claims to have obtained 20 GB of the organization’s data. The compromised information reportedly includes personal data, employee records, and accounting and financial documents.
- Date: 2025-10-17T16:43:43Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Glass, Ceramics & Concrete
- Victim Organization: manko window systems
- Victim Site: mankowindows.com
- Pharmacie des Alizés falls victim to DEVMAN 2.0 ransomware
- Category: Ransomware
- Content: Group claims to have obtained 80 GB of organization’s data and plans to publish within 2-3 days.
- Date: 2025-10-17T16:30:28Z
- Network: tor
- Published URL: (http://devmanblggk7ddrtqj3tsocnayow3bwnozab2s4yhv4shpv6ueitjzid.onion/)
- Screenshots:
- Threat Actors: DEVMAN 2.0
- Victim Country: France
- Victim Industry: Healthcare & Pharmaceuticals
- Victim Organization: pharmacie des alizés
- Victim Site: pharmaciedesalizes.fr
- Dental Society of La Plata falls victim to DragonForce ransomware
- Category: Ransomware
- Content: Group claims to have obtained 911.29 GB of organization’s data and plans to publish it with in 7-8 days.
- Date: 2025-10-17T16:18:52Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- Threat Actors: DragonForce
- Victim Country: Argentina
- Victim Industry: Education
- Victim Organization: dental society of la plata
- Victim Site: solp.org.ar
- Sold Real Estate falls victim to RADAR group ransomware
- Category: Ransomware
- Content: Group claims to have obtained organization’s data and plans to publish it within 17-18 days.
- Date: 2025-10-17T16:02:28Z
- Network: tor
- Published URL: (http://3bnusfu2lgk5at43ceu7cdok5yv4gfbono2jv57ho74ucjvc7czirfid.onion/awaiting-publication)
- Screenshots:
- Threat Actors: RADAR group
- Victim Country: Australia
- Victim Industry: Real Estate
- Victim Organization: sold real estate
- Victim Site: soldrealestate.io
- Alleged sale of RDWeb/RDP access to U.S. retail company
- Category: Initial Access
- Content: The threat actor claims to be selling RDWeb and RDP access with local administrative privileges to a U.S.-based retail company.
- Date: 2025-10-17T16:02:07Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268427/)
- Screenshots:
- Threat Actors: Big-Bro
- Victim Country: USA
- Victim Industry: Retail Industry
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged sale of RDP/RDWeb access to Spain freight & logistics company
- Category: Initial Access
- Content: The threat actor claims to be selling RDP and RDWeb access to a Spain-based freight & logistics company.
- Date: 2025-10-17T15:57:22Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268424/)
- Screenshots:
- Threat Actors: 361CrimeLiFe
- Victim Country: Spain
- Victim Industry: Package & Freight Delivery
- Victim Organization: Unknown
- Victim Site: Unknown
- One Agency Eastlakes falls victim to RADAR group ransomware
- Category: Ransomware
- Content: Group claims to have obtained organization’s data and publish it within 17-18 days.
- Date: 2025-10-17T15:55:16Z
- Network: tor
- Published URL: (http://3bnusfu2lgk5at43ceu7cdok5yv4gfbono2jv57ho74ucjvc7czirfid.onion/awaiting-publication)
- Screenshots:
- Threat Actors: RADAR group
- Victim Country: Australia
- Victim Industry: Real Estate
- Victim Organization: one agency eastlakes
- Victim Site: oneagencyeastlakes.com.au
- UrbanX falls victim to RADAR group ransomware
- Category: Ransomware
- Content: Group claims to have obtained organization’s data and plans to publish it within 17-18 days. Note: UrbanX was previously breached on May 15, 2025.
- Date: 2025-10-17T15:46:48Z
- Network: tor
- Published URL: (http://3bnusfu2lgk5at43ceu7cdok5yv4gfbono2jv57ho74ucjvc7czirfid.onion/awaiting-publication)
- Screenshots:
- Threat Actors: RADAR group
- Victim Country: Australia
- Victim Industry: Real Estate
- Victim Organization: urbanx
- Victim Site: urbanx.io
- Alleged Sale of Bittrex Database
- Category: Data Breach
- Content: A threat actor claims to be selling a database of Bittrex. nb: last breached on Jul 10 2025.
- Date: 2025-10-17T15:09:58Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268416/)
- Screenshots:
- Threat Actors: marqus
- Victim Country: USA
- Victim Industry: Financial Services
- Victim Organization: bittrex
- Victim Site: bittrex.com
- Alleged sale of access to unidentified french association
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to an unidentified french association.
- Date: 2025-10-17T13:18:16Z
- Network: telegram
- Published URL: (https://t.me/perunswaroga/622)
- Screenshots:
- Threat Actors: Perun Svaroga
- Victim Country: France
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Curtis Steel falls victim to Akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 20 GB of the organization’s data. The compromised data includes financial data (audit, payment details, financial reports, invoices), detailed employees and customers information ( Dl numbers, Social Security Numbers, medical information, emails, phones) confidential information, NDAs,etc.
- Date: 2025-10-17T12:32:57Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Mining/Metals
- Victim Organization: curtis steel co
- Victim Site: curtissteel.com
- Alleged sale of Discord’s 0day exploit
- Category: Vulnerability
- Content: The threat actor claims to be selling a Discord 0-day exploit that reveals the chat history, registered email, and phone number of any Discord user without 2FA enabled.
- Date: 2025-10-17T12:26:25Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Discord-s-0day-exploit-chat-access-info–56372)
- Screenshots:
- Threat Actors: scan
- Victim Country: USA
- Victim Industry: Social Media & Online Social Networking
- Victim Organization: discord
- Victim Site: discord.com
- Alleged unauthorized access to an unidentified AC system of sewing factory in Poland
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to an unidentified air conditioning system of a sewing factory in Poland. The compromised system allegedly allows control over the alert system, technological process controller, safety systems and work cycles.
- Date: 2025-10-17T12:13:59Z
- Network: telegram
- Published URL: (https://t.me/c/2634086323/2037)
- Screenshots:
- Threat Actors: NoName057(16)
- Victim Country: Poland
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Consolidated Restaurant Operations falls victim to akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 38 GB of the organization’s data. The compromised data includes employee’s personal document scans such as passports, driver’s licenses, medical information, Social Security numbers, confidentiality agreements, detailed financials, NDAs, police reports, etc.
- Date: 2025-10-17T12:13:27Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Restaurants
- Victim Organization: consolidated restaurant operations, inc.
- Victim Site: croinc.com
- Plastics Extrusion Machinery LLC falls victim to Akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 350 GB of the organization’s data. The compromised data includes financial data, detailed employees and customers information ( Dl numbers, Social Security Numbers, medical information, emails, phones) confidential information, NDAs and other documents with detailed personal information.
- Date: 2025-10-17T12:11:30Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Machinery Manufacturing
- Victim Organization: plastics extrusion machinery llc
- Victim Site: pemusa.com
- Night Owll targets the website of Badan Pengelola Perbatasan Daerah (BPPD)
- Category: Defacement
- Content: The group claims to have defaced the website of Badan Pengelola Perbatasan Daerah (BPPD).
- Date: 2025-10-17T11:59:55Z
- Network: telegram
- Published URL: (https://t.me/c/2702757113/607)
- Screenshots:
- Threat Actors: Night Owll
- Victim Country: Indonesia
- Victim Industry: Government Administration
- Victim Organization: badan pengelola perbatasan daerah
- Victim Site: bppd.nttprov.go.id
- Alleged unauthorized access to an unidentified German citizen’s computer
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to a German citizen’s computer.
- Date: 2025-10-17T11:51:36Z
- Network: telegram
- Published URL: (https://t.me/Z_ALLIANCE/835)
- Screenshots:
- Threat Actors: Z-PENTEST ALLIANCE
- Victim Country: Germany
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- WEBER GmbH falls victim to RansomHouse Ransomware
- Category: Ransomware
- Content: The group claims to have obtained data from the organization.
- Date: 2025-10-17T10:59:31Z
- Network: tor
- Published URL: (http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/r/d89cfb668815e70e7af9c0263c78eb2f613f79da)
- Screenshots:
- Threat Actors: RansomHouse
- Victim Country: Germany
- Victim Industry: Machinery Manufacturing
- Victim Organization: weber gmbh
- Victim Site: webergmbh.de
- Alleged data leak of Insurance Office of America
- Category: Data Breach
- Content: The threat actor claims to have leaked over 100k internal documents data from Insurance Office of America.
- Date: 2025-10-17T10:45:23Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Insurance-Office-of-America-US-Full-Leak-100k-internal-documents)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/5c62440f-ad60-4567-ad11-f076cb51d738.png
- Threat Actors: MarlboroRed
- Victim Country: USA
- Victim Industry: Insurance
- Victim Organization: insurance office of america
- Victim Site: ioausa.com
- Alleged data breach of Universal Thought Consult
- Category: Data Breach
- Content: The group claims to have leaked data from Universal Thought Consult.
- Date: 2025-10-17T10:31:29Z
- Network: telegram
- Published URL: (https://t.me/lunarisS3C/60)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/9cab49c8-659a-42cc-b60b-e1de5deb0c87.png
- Threat Actors: LunarisSec
- Victim Country: Nepal
- Victim Industry: Education
- Victim Organization: universal thought consult
- Victim Site: utc.com.np
- Alleged unauthorized access to Kittiwit School
- Category: Initial Access
- Content: The group claims to have gained login access to Kittiwit School.
- Date: 2025-10-17T10:15:57Z
- Network: telegram
- Published URL: (https://t.me/notctber/1323)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/efaef391-1946-4141-ba53-c88cb90cf900.png
- Threat Actors: NOTCTBER404
- Victim Country: Thailand
- Victim Industry: Education
- Victim Organization: kittiwit school
- Victim Site: kittivit.ac.th
- Alitech Sp. z o.o falls victim to Nova Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 22 GB of the organization’s data and intends to publish them within 10-11 days.
- Date: 2025-10-17T10:13:26Z
- Network: tor
- Published URL: (http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/#)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/b21a1eef-729a-42eb-a075-2622ea259715.jpg
- Threat Actors: Nova
- Victim Country: Poland
- Victim Industry: Retail Industry
- Victim Organization: alitech sp. z o.o
- Victim Site: alitech.com.pl
- Alleged unauthorized access to Cargo airport network in Canada
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to Cargo airport network in Canada.
- Date: 2025-10-17T09:53:13Z
- Network: telegram
- Published URL: (https://t.me/Mhwear98/1133)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/51a94d56-fdba-4e6b-a5e6-336314c52713.png
- https://d34iuop8pidsy8.cloudfront.net/6770f0e1-5ca9-4ec8-b52f-2ca2f8130af0.png
- Threat Actors: Cyber Islamic resistance
- Victim Country: Canada
- Victim Industry: Transportation & Logistics
- Victim Organization: Unknown
- Victim Site: Unknown
- Gardiner’s Solicitors falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 87.4 GB of the organization’s data and intends to publish them within 5-6 days.
- Date: 2025-10-17T09:36:56Z
- Network: tor
- Published URL: (https://www.google.com/search?q=http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/192ad9f3-6598-44e2-8d49-2a90e38f04b4.png
- https://d34iuop8pidsy8.cloudfront.net/a9b59544-70be-445e-bdd1-1558fe111deb.png
- Threat Actors: DragonForce
- Victim Country: UK
- Victim Industry: Law Practice & Law Firms
- Victim Organization: gardiner’s solicitors
- Victim Site: gardinerssolicitors.co.uk
- Gerhard Geiger GmbH & Co. KG falls victim to RHYSIDA Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data and intents to publish it within 6 to 7 days.
- Date: 2025-10-17T08:55:40Z
- Network: tor
- Published URL: (http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/0fdec735-2056-4801-8536-4ad13885b375.jpg
- Threat Actors: RHYSIDA
- Victim Country: Germany
- Victim Industry: Manufacturing & Industrial Products
- Victim Organization: gerhard geiger gmbh & co. kg
- Victim Site: geiger.de
- Scattered LAPSUS$ Hunters claims to target USA
- Category: Alert
- Content: A recent post by the group indicates that they are targeting U.S. Critical Infrastructure.
- Date: 2025-10-17T07:54:11Z
- Network: telegram
- Published URL: (https://t.me/ripalldaguyz/101)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/30aab595-c616-4d48-b621-028303e6d8f7.png
- Threat Actors: scattered LAPSUS$ hunters 7.0
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged sale of 10k credit card data from USA
- Category: Data Breach
- Content: Threat actor claims to be selling 10000 CC from USA.
- Date: 2025-10-17T06:09:04Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268387/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/93414ef1-adb9-4a73-8e85-4ead628dfe10.png
- Threat Actors: cashmoneycard
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- KAL EGY 319 claims to target all Educational Institutions in Egypt
- Category: Alert
- Content: A recent post by the group indicates that they are targeting all educational institutions in Egypt.
- Date: 2025-10-17T05:58:09Z
- Network: telegram
- Published URL: (https://t.me/KALOSHA319/23)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/3749f19f-df16-48d1-b4cd-cbbb93f95f4e.png
- Threat Actors: KAL EGY 319
- Victim Country: Egypt
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged sale of European Air Defense Database
- Category: Data Breach
- Content: The threat actor claims to have leaked and is selling 8 GB of sensitive database allegedly tied to a European air defense entity.
- Date: 2025-10-17T05:42:53Z
- Network: openweb
- Published URL: (https://breachsta.rs/topic/fresh-european-air-defense-database-breach-by-daemonroot-cdj7ng71d28s)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/2f5cbbed-e55f-4808-9126-f1bad5240085.png
- Threat Actors: DaemonRoot
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data leak of European air defense network
- Category: Data Breach
- Content: The threat actor claims to have breached a European air defense database and is offering 8 GB of documents for sale
- Date: 2025-10-17T05:20:04Z
- Network: openweb
- Published URL: (https://breachsta.rs/topic/fresh-european-air-defense-database-breach-by-daemonroot-cdj7ng71d28s)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/8ad9bba9-82bc-4f9f-8b51-35f279e36e9a.png
- Threat Actors: DaemonRoot
- Victim Country: Unknown
- Victim Industry: Defense & Space
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged sale of ATM hacking tools
- Category: Malware
- Content: A threat actor offering a productized ATM cash‑out platform called “CUTLET MAKER 2025” that claims to enable large‑scale, modular ATM compromises with multi‑tier user roles (admin/staff/drop), automated bulk workflows (scan → exploit → backdoor → cash extraction), centralized real‑time monitoring and analytics with encrypted communications.
- Date: 2025-10-17T05:01:25Z
- Network: openweb
- Published URL: (https://demonforums.net/Thread-Leak-ATM-hacking-tools-tutoria)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/f53c58ad-4c3c-4793-becd-b40f71e7809a.png
- https://d34iuop8pidsy8.cloudfront.net/d455aff4-13e5-463e-85ec-00789855c961.png
- Threat Actors: rippors
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data breach of University of Oxford
- Category: Data Breach
- Content: Threat actor claims to have leaked 21,658 student data from University of Oxford. The compromised data includes student ID, full name, date of birth, home and mailing addresses, city and other location details, country information, postal codes, phone and mobile numbers, email addresses, roll number, and job title or company details.
- Date: 2025-10-17T04:42:25Z
- Network: openweb
- Published URL: (https://breachsta.rs/topic/oxford-university-breach-full-database-21658-students-uk-h6v050fqhlck)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/c18ffc08-f85a-40de-b0db-00edec2d3ea8.png
- Threat Actors: BlackOrcaX
- Victim Country: UK
- Victim Industry: Higher Education/Acadamia
- Victim Organization: university of oxford
- Victim Site: ox.ac.uk
- Alleged data breach of Club Atlético Talleres
- Category: Data Breach
- Content: The threat actor claims to have leaked data from Club Atlético Talleres (CAT), an Argentine professional football club. The exposed information allegedly includes important cloud files and over 900 log records
- Date: 2025-10-17T04:21:50Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Club-Atletico-Talleres)
- Screenshots:
- Threat Actors: govetthereum
- Victim Country: Argentina
- Victim Industry: Sports
- Victim Organization: club atlético talleres
- Victim Site: clubtalleres.com.ar
- Alleged data breach of Like4Like
- Category: Data Breach
- Content: The threat actor claims to have leaked the database of Like4Like.org, exposing admin panel access and data of 112,365 users. The breach includes emails, usernames, hashed passwords, and user activity metrics.
- Date: 2025-10-17T04:02:56Z
- Network: openweb
- Published URL: (https://breachsta.rs/topic/like4likeorg-database-breach-full-admin-panel-access-112365-user-accounts-dmrye0c69mmx)
- Screenshots:
- Threat Actors: BlackOrcaX
- Victim Country: Unknown
- Victim Industry: Social Media & Online Social Networking
- Victim Organization: like4like
- Victim Site: like4like.org
- SK shieldus falls victim to BlackShrantac Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 24 GB of organization’s internal data including customer information and service requirements, internal network details, HR and payment-related records, and cybersecurity technical documentation. The leak also allegedly exposes website source code, along with API keys, configuration files, and other critical system data.
- Date: 2025-10-17T01:57:30Z
- Network: tor
- Published URL: (http://jvkpexgkuaw5toiph7fbgucycvnafaqmfvakymfh5pdxepvahw3xryqd.onion/targets/4)
- Screenshots:
- Threat Actors: BlackShrantac
- Victim Country: South Korea
- Victim Industry: Security & Investigations
- Victim Organization: sk shieldus
- Victim Site: skshieldus.com
Conclusion
The incidents detailed in this report highlight a diverse and active landscape of cyber threats.
Data breaches and leaks are prominent, affecting various sectors from e-commerce and gaming to defense and higher education, and impacting countries including the USA, Brazil, Russia, Canada, Germany, UK, Argentina, Italy, Nepal, Thailand, and South Korea. The compromised data ranges from personal user information and tax IDs to internal documents, military-related classified documents, and large customer databases.
Beyond data compromise, the report also reveals significant activity in initial access sales, with threat actors offering unauthorized access to corporate networks (including RDWeb/RDP access to U.S. and Spanish firms), a German citizen’s computer, a Canadian cargo airport, a Polish factory’s AC system, a French association, and a Thai school.
The prevalence of ransomware attacks, specifically by groups like Akira, Sinobi, DragonForce, RADAR group, Everest, PLAY, CL0P, RHYSIDA, Nova, and BlackShrantac, is notable, with victims across the USA, Germany, Madagascar, Argentina, France, Australia, Poland, and South Korea, targeting industries from aerospace and law firms to real estate and manufacturing.
The sale of malware, including an ATM cash-out platform, and the sale of a Discord 0-day exploit underscore the availability of offensive capabilities and vulnerabilities being traded in the cyber underground. Additionally, alerts indicate targeting of U.S. Critical Infrastructure and Egyptian educational institutions.
The incidents collectively demonstrate that organizations across various industries and geographies face persistent threats from data exfiltration, unauthorized network access, and the proliferation of malicious tools. The nature of these incidents emphasizes the critical importance of robust cybersecurity measures, including strong access controls, data protection strategies, continuous vulnerability management, and proactive threat intelligence to defend against a wide array of sophisticated and opportunistic attacks.