This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
- Alleged leak of Discord Logs
- Category: Data Breach
- Content: The group claims to have obtained over 2.3 billion Discord logs from more than 56 million users.
- Date: 2025-10-08T23:56:09Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/discord-2-3b-discord-logs-available-from-56m-users.44239/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/909206db-990a-4e4b-a8ce-7df7041f25b7.png
- Threat Actors: discordbreach
- Victim Country: USA
- Victim Industry: Software Development
- Victim Organization: discord
- Victim Site: discord.com
- Alleged data leak of OLX Kazakhstan
- Category: Data Breach
- Content: The threat actor claims to have leaked sensitive customer database from OLX Kazakhstan. The exposed dataset reportedly include name, phone number, contact address etc. NB: Authenticity of claim is yet to be verified
- Date: 2025-10-08T23:36:30Z
- Network: telegram
- Published URL: (https://t.me/aqj986/7590)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/9151d8a8-1af4-4bff-b664-dffb2c1fce57.png
- Threat Actors: Aiqianjin
- Victim Country: Kazakhstan
- Victim Industry: Consumer Services
- Victim Organization: olx kazakhstan
- Victim Site: olx.kz
- Alleged unauthorized access to Mersin Akdeniz Endüstriyel Soğutma
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to a system in Turkey responsible for industrial cooling of refrigerated warehouses. The compromised system regulates temperature, humidity, and gas levels for the storage of fruits and vegetables in controlled environments.
- Date: 2025-10-08T23:35:57Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/1867)
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: Turkey
- Victim Industry: Industrial Automation
- Victim Organization: mersin akdeniz endüstriyel soğutma
- Victim Site: akdenizsogutmasanayi.com.tr
- Industrial Chemicals Corporation (ICC) falls victim to Sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have exfiltrated approximately 380 GB of data from Industrial Chemicals Corporation, including financial data, confidential documents, and contractual information. They intend to publish it within 6-7 days
- Date: 2025-10-08T23:34:57Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e6741c88b6823fa26927ce)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/6e7e074c-8a65-4204-81c9-5739e80f055d.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Manufacturing
- Victim Organization: industrial chemicals corporation (icc)
- Victim Site: industrialchemcorp.com
— PAGE 2 —
- Alleged data sale of FirstTwo
- Category: Data Breach
- Content: Threat actor claims to be selling leaked data from FirstTwo, USA. The compromised data reportedly contains 88.5 million records that includes names, numbers, address, date of birth.
- Date: 2025-10-08T21:52:12Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267839/)
- Screenshots:
- Threat Actors: Neur0n
- Victim Country: USA
- Victim Industry: Public Safety
- Victim Organization: firsttwo
- Victim Site: firsttwo.com
- Alleged sale of Credit Card data from Turkey
- Category: Data Breach
- Content: The threat actor claims to be selling Credit Card data from Turkey. The compromised data reportedly contains 2938 records that includes name, email, address, phone, town, etc.
- Date: 2025-10-08T21:35:57Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267834/)
- Screenshots:
- Threat Actors: Gualtieri
- Victim Country: Turkey
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Data Breach of CORDIALITO
- Category: Data Breach
- Content: A threat actor claims to have leaked the data of CORDIALITO, a Venezuelan betting house. The compromised data reportedly contains 423,000 lines of records, including user IDs, personal information, account credentials, PINs, account types, birth dates, country, city, etc.
- Date: 2025-10-08T20:35:14Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-VENEZUELA-CORDIALITO-leaks-betting-house-423K-lines)
- Screenshots:
- Threat Actors: malconguerra2
- Victim Country: Venezuela
- Victim Industry: Gambling & Casinos
- Victim Organization: cordialito
- Victim Site: cordialitos.com
- Sun Fiber LLC falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 750 GB of organization’s data including Confidential, Financial data, Contracts, HR, etc. They intend to publish it within 7-8 days.
- Date: 2025-10-08T20:20:07Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e68b4688b6823fa26994ef)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/cb859622-72bb-4a66-a090-8d7b81a87c41.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Manufacturing
- Victim Organization: sun fiber llc
- Victim Site: sunfiberllc.com
- RIGHT AT HOME CARE, LLC falls victim to sinobi ransomware
- Category: Ransomware
- Content: The group claims to have obtained 50 GB of organization’s data including Customer’s data, Contracts, etc.
- Date: 2025-10-08T20:19:49Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e6736388b6823fa269247a)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Hospital & Health Care
- Victim Organization: right at home care, llc
- Victim Site: rightathomecare.org
— PAGE 3 —
- D. Wilson Construction Co. falls victim to sinobi ransomware
- Category: Ransomware
- Content: The group claims to have obtained 510 GB of organization’s data including Financial data, Customer’s data, Contracts, Incidents, etc. They intend to publish it within 7-8 days.
- Date: 2025-10-08T20:05:09Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e68ed188b6823fa269ab38)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/a83d7317-c431-4167-a508-0c175a43e42f.png
- https://d34iuop8pidsy8.cloudfront.net/c1edf0cd-f8ac-48b4-a44f-be4997a3b6fd.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: d. wilson construction co.
- Victim Site: dwilsonconstruction.com
- Alleged Data sale of Redexis
- Category: Data Breach
- Content: The threat actor claims to be selling leaked data of Redexis. The compromised data reportedly contains around 755,000 unique customer records, including names, ID numbers, phone numbers, years of birth, and IBANs.
- Date: 2025-10-08T19:59:39Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-SPAIN-Redexis-Gas)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/58530a1b-7558-4429-9959-5a2ccfe3d326.png
- Threat Actors: dry
- Victim Country: Spain
- Victim Industry: Oil & Gas
- Victim Organization: redexis
- Victim Site: redexis.es
- Alleged sale of full access to shop sites
- Category: Initial Access
- Content: Threat actor claims to be selling full access to shop sites.
- Date: 2025-10-08T19:59:23Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267824/)
- Screenshots:
- Threat Actors: APT_Hunter
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Chek Tan and Company, LLP falls victim to RADAR group Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data and intends to publish it within 13-14 days.
- Date: 2025-10-08T19:47:54Z
- Network: tor
- Published URL: (http://3bnusfu2lgk5at43ceu7cdok5yv4gfbono2jv57ho74ucjvc7czirfid.onion/awaiting-publication)
- Screenshots:
- Threat Actors: RADAR group
- Victim Country: USA
- Victim Industry: Accounting
- Victim Organization: chek tan and company, llp
- Victim Site: chektan.com
- Ackermann Group falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 250 GB of organization’s data including Financial data, Customer’s data, Contracts, etc. They intend to publish it within 5-6 days.
- Date: 2025-10-08T19:41:54Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e6765388b6823fa269314b)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/8bf44e91-67f2-4639-877c-378ac6294d50.png
- Threat Actors: Sinobi
- Victim Country: France
- Victim Industry: Wholesale
- Victim Organization: ackermann group
- Victim Site: groupeackermann.fr
— PAGE 4 —
- Alleged data breach of MS Glow
- Category: Data Breach
- Content: The threat actor claims to have leaked a database belonging to MS Glow, an Indonesian skincare and beauty brand. The compromised data reportedly contains personal information of users from the MS Glow mobile application, including names, addresses, phone numbers, bank account details, ID card numbers (KTP), provinces, and cities. NB: The organization previously breached on September 27 2024
- Date: 2025-10-08T19:41:44Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Data-Users-Member-Application-MS-Glow-Indonesian)
- Screenshots:
- Threat Actors: TRexID
- Victim Country: Indonesia
- Victim Industry: Manufacturing
- Victim Organization: ms glow
- Victim Site: msglowid.com
- Dakota Boys and Girls Ranch falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 150 GB of organization’s data including Confidential, Incidents, HR, etc. They intend to publish it within 5-6 days.
- Date: 2025-10-08T19:35:37Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e680e188b6823fa26963bf)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/5694b59c-f7d7-4852-97dd-b46453250447.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Mental Health Care
- Victim Organization: dakota boys and girls ranch
- Victim Site: dakotaranch.org
- The Catered Affair falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 120 GB of organization’s data including Customer’s data, Financial data, Incidents, etc. They intend to publish it within 5-6 days.
- Date: 2025-10-08T19:08:03Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e6818588b6823fa26965b4)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/6aad1888-778a-4421-83c2-c40d0744e5cd.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Food & Beverages
- Victim Organization: the catered affair
- Victim Site: thecateredaffair.com
- Shape Corp. falls victim to Nova Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 55 GB of the organization’s data and intends to publish it within 13-14 days.
- Date: 2025-10-08T19:05:40Z
- Network: tor
- Published URL: (http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/#)
- Screenshots:
- Threat Actors: Nova
- Victim Country: USA
- Victim Industry: Automotive
- Victim Organization: shape corp.
- Victim Site: shapecorp.com
- Bohlsen Restaurant Group falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 700 Gb of organization’s data including Financial data, Contracts, HR data etc. They intend to publish it within 5-6 Hours.
- Date: 2025-10-08T18:53:31Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e684c488b6823fa2697650)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/f6c43550-b9f3-457d-8d8d-ad2dce79ee6b.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Restaurants
- Victim Organization: bohlsen restaurant group
- Victim Site: brgroup.biz
— PAGE 5 —
- Public Relations Society of America (PRSA) falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 800 GB of organization’s data including Confidential, Customer’s data, Financial data, Incidents, etc. They intend to publish it within 7-8 days.
- Date: 2025-10-08T18:51:52Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e685cf88b6823fa2697aba)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Public Relations/PR
- Victim Organization: public relations society of america (prsa)
- Victim Site: prsa.org
- Desert Plastering, LLC falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 740 GB of organization’s data including Confidential, Financial data, Contracts, Customer’s data etc. They intend to publish it within 7-8 days.
- Date: 2025-10-08T18:47:41Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e6873d88b6823fa269821f)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: desert plastering, llc
- Victim Site: desertplastering.com
- MTI America falls victim to sinobi ransomware
- Category: Ransomware
- Content: The group claims to have obtained 120 GB of organization’s data including Financial data, Customer’s data, Contracts, etc. They intend to publish it within 7-8 days.
- Date: 2025-10-08T18:40:09Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e68e3a88b6823fa269a6e1)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Hospital & Health Care
- Victim Organization: mti america
- Victim Site: mtiamerica.com
- Alleged Sale of Access to 1000+ POS Machines
- Category: Initial Access
- Content: The threat actor claims to be selling RMM Admin Panels access to more than 1000 POS Machines from USA and UK.
- Date: 2025-10-08T18:26:49Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267817/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/5a16e4f4-354d-4fc9-926a-088df2021cbd.png
- Threat Actors: nixploiter
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Lashbrook falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-08T18:19:31Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e683eb88b6823fa269705d)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Wholesale
- Victim Organization: lashbrook
- Victim Site: lashbrookdesigns.com
— PAGE 6 —
- Alleged sale of Driver License data from USA
- Category: Data Breach
- Content: The threat actor claims to be selling Driver License data from USA. The compromised data reportedly contain more than 9000 records.
- Date: 2025-10-08T18:10:58Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267816/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/fbc01728-2291-43f9-a9dd-43de301c884b.png
- https://d34iuop8pidsy8.cloudfront.net/d76d5ddc-d8c6-4464-8df4-d8ff1691a0dc.png
- Threat Actors: SinCity
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Tibbetts Lumber Co. LLC falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 920 GB of organization’s data including Confidential, Financial data, Contracts, Customer’s data, etc. They intend to publish it within 7-8 days.
- Date: 2025-10-08T18:00:59Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e6781d88b6823fa2693877)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/3a6167e8-2426-40f6-8d0d-d0fd8d41c94e.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Retail Industry
- Victim Organization: tibbetts lumber co. llc
- Victim Site: tibbettslumber.com
- Cameron, Hodges, Coleman, LaPointe, & Wright, P.A. falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 163.00 GB of the organization’s data. NB : The organization previously fell victim to Sarcoma Ransomware on July 01 2025 and RansomHub ransomware on July 16 2024
- Date: 2025-10-08T17:47:24Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=dbcf7c18-46f5-3ac8-abaf-669f91a7b6d3)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: cameron, hodges, coleman, lapointe, & wright, p.a
- Victim Site: cameronhodges.com
- Osland Financial Group falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 50 GB of organization’s data including Financial data, Customer’s data, etc.
- Date: 2025-10-08T17:37:01Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e6714588b6823fa2691bb2)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Financial Services
- Victim Organization: osland financial group
- Victim Site: oslandgroup.com
— PAGE 7 —
- Alleged sale of shell access to PrestaShop in france
- Category: Initial Access
- Content: Threat actor claims to be selling shell access to PrestaShop in france.
- Date: 2025-10-08T17:36:16Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267809/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/b1fb7dd3-39b9-4731-92a6-32c3170437c2.png
- Threat Actors: akr1t
- Victim Country: France
- Victim Industry: E-commerce & Online Stores
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Sale of access to unidentified Grocery Retail in USA
- Category: Initial Access
- Content: threat actor claims to be selling Fortinet VPN credentials and Domain Administrator access to a USA based grocery retail company.
- Date: 2025-10-08T17:17:15Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267802/)
- Screenshots:
- Threat Actors: Mark1777
- Victim Country: USA
- Victim Industry: Retail Industry
- Victim Organization: Unknown
- Victim Site: Unknown
- ST. CATHERINE OF SIENA CATHOLIC CHURCH falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 30 GB of organization’s data including Incidents, Confidential data, etc.
- Date: 2025-10-08T17:07:27Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e671fa88b6823fa2691dac)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/a55fa286-30b2-4e4d-80f7-155812f72219.png
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Religious Institutions
- Victim Organization: st. catherine of siena catholic church
- Victim Site: scswf.org
- Alleged data leak of French Badminton Federation
- Category: Data Breach
- Content: Threat actor claims to have leaked data from French Badminton Federation. The compromised data reportedly contain 500,000 records of information including name, id, email, zip code, etc. NB: The organization was previously breached on september 07, 2025.
- Date: 2025-10-08T16:49:12Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/ffbad-fftt.44231/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/b9f207cb-5f3a-4a0d-877c-670739fe08ac.png
- https://d34iuop8pidsy8.cloudfront.net/de6e32fd-7f0d-405a-8606-e89cd3436a2a.png
- Threat Actors: kenya
- Victim Country: France
- Victim Industry: Sports
- Victim Organization: french badminton federation
- Victim Site: ffbad.org
- Termotasajero S.A. E.S.P. falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 200 GB of organization’s data including Confidential, Incidents, Financial data, Contracts, etc.
- Date: 2025-10-08T16:45:51Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e672a188b6823fa2692061)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: Colombia
- Victim Industry: Oil & Gas
- Victim Organization: termotasajero s.a. e.s.p.
- Victim Site: termotasajero.com.co
— PAGE 8 —
- Alleged data breach of Bank Rakyat Indonesia
- Category: Data Breach
- Content: The threat actor claims to have leaked a customer database belonging to Bank Republik Indonesia Maluku customers.
- Date: 2025-10-08T16:25:03Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-BANK-REPUBLIK-INDONESIA-MALUKU-customers)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/4b72cc28-1707-4889-aa23-b99d69bacaa9.png
- Threat Actors: Mr404Here
- Victim Country: Indonesia
- Victim Industry: Banking & Mortgage
- Victim Organization: bank rakyat indonesia
- Victim Site: bri.co.id
- J B Brown & Sons falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 50 GB of organization’s data including Financial data, HR data, etc.
- Date: 2025-10-08T16:23:11Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e6752388b6823fa2692c3e)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Real Estate
- Victim Organization: j b brown & sons
- Victim Site: jbbrown.com
- Alleged leak of Business information data from UK
- Category: Data Breach
- Content: The threat actor clam to be selling business information data from UK. The compromised data includes name, address, city, phone number, dob, etc.
- Date: 2025-10-08T16:19:04Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/267799/)
- Screenshots:
- Threat Actors: Ghost_devil
- Victim Country: UK
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Tecnomarket Snc falls victim to sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 7.5 GB of organization’s data including Contracts, Financial data, etc.
- Date: 2025-10-08T16:08:41Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/68e676ec88b6823fa26933a5)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: Italy
- Victim Industry: Restaurants
- Victim Organization: tecnomarket snc
- Victim Site: tecnomarketrubiera.it
- Alleged data breach of Verizon
- Category: Data Breach
- Content: Threat actor claims to have leaked data of E-UTRAN networking project related to Verizon, USA. The compromised data reportedly contains telephone number, utran-cell-id-3gpp, RSSI, TP, etc.
- Date: 2025-10-08T15:59:15Z
- Network: telegram
- Published URL: (https://t.me/andrewfedman/1408)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/5d62c0d5-a553-4b29-ae97-0b2e588c7c73.png
- Threat Actors: Scattered LAPSUS$ Hunters
- Victim Country: USA
- Victim Industry: Network & Telecommunications
- Victim Organization: verizon
- Victim Site: verizon.com
— PAGE 9 —
- Alleged data breach of True Corporation Public Company Limited
- Category: Data Breach
- Content: Threat actor claims to have leaked data from true.th and dtac.co.th, operated by True Corporation Public Company Limited, a telecom-tech company based in Thailand. The compromised data reportedly contains ID, name, phone number, email address, etc.
- Date: 2025-10-08T15:36:53Z
- Network: telegram
- Published URL: (https://t.me/andrewfedman/1413)
- Screenshots:
- Threat Actors: Scattered LAPSUS$ Hunters
- Victim Country: Thailand
- Victim Industry: Network & Telecommunications
- Victim Organization: true corporation public company limited
- Victim Site: true.th
- VIM Technologies Inc. falls victim to akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data. The compromised data includes corporate documents, Customer information, partners files, projects, contracts and agreements, employee files, NDA, etc.
- Date: 2025-10-08T15:36:18Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/fd88c1cb-4908-40bf-bcca-6d1c30a00cd8.png
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Environmental Services
- Victim Organization: vim technologies inc.
- Victim Site: vimtechnologies.com
- Alleged data breach of True Corporation
- Category: Data Breach
- Content: Threat actor claims to have leaked data from True Corporation, telecom-tech company based in Thailand. The compromised data reportedly contains ID, name, phone number, email address, etc.
- Date: 2025-10-08T15:28:49Z
- Network: telegram
- Published URL: (https://t.me/andrewfedman/1413)
- Screenshots:
- Threat Actors: Scattered LAPSUS$ Hunters
- Victim Country: Thailand
- Victim Industry: Network & Telecommunications
- Victim Organization: true corporation
- Victim Site: true.th
- Hoyer Law Group, PLLC falls victim to akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data. The compromised data includes corporate documents. Customer personal documents, employee files (w4 complete forms, SSNs, phones, addresses and so on), project information, medical reports, police reports, and other confidential documents, NDAs, etc.
- Date: 2025-10-08T15:28:23Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: hoyer law group, pllc
- Victim Site: “hoyerlawgroup.com”
— PAGE 10 —
- Alleged data leak of Lyca Mobile
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Lyca Mobile, France. The compromised data reportedly contains ID, email, IP address, phone number, user UUID, etc.
- Date: 2025-10-08T15:07:02Z
- Network: telegram
- Published URL: (https://t.me/andrewfedman/1405)
- Screenshots:
- Threat Actors: Scattered LAPSUS$ Hunters
- Victim Country: France
- Victim Industry: Network & Telecommunications
- Victim Organization: lyca mobile
- Victim Site: lycamobile.fr
- IFPC Worldwide falls victim to INTERLOCK Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 126 GB of data from the organization, comprising over 32,531 files stored across nearly 4,916 folders.
- Date: 2025-10-08T14:32:22Z
- Network: tor
- Published URL: (http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/leaks.php)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/6d591dbe-611c-4109-a9b7-d89277c779d9.png
- https://d34iuop8pidsy8.cloudfront.net/5a5f8c5d-f1a8-4d2b-a541-2ffa571bd710.png
- Threat Actors: INTERLOCK
- Victim Country: USA
- Victim Industry: Security & Investigations
- Victim Organization: ifpc worldwide, inc.
- Victim Site: ifpcworldwide.com
- Alleged sale of 100k leads of Indian Doctors
- Category: Data Breach
- Content: The group claims to be selling a large dataset allegedly containing personal and professional information for approximately 100,000 Indian doctors, including id, unique_id, UIN, name, specialty, qualification, email address, mobile number, and city.
- Date: 2025-10-08T14:29:26Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-IN-Doctors-database)
- Screenshots:
- Threat Actors: Yrrrr
- Victim Country: India
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Access Sale to Argentine Government Systems
- Category: Initial Access
- Content: The threat actor claims to be selling unauthorized access to a system allegedly belonging to the Argentine government. The leaked access reportedly includes MySQL 5.7.36 credentials, database dumps, and a PHP web shell.
- Date: 2025-10-08T14:10:57Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Argentine-Government)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/c5d381b0-39e3-4257-980d-2b527ebfe7fd.png
- Threat Actors: Near
- Victim Country: Argentina
- Victim Industry: Government Administration
- Victim Organization: government of argentina
- Victim Site: argentina.gob.ar
- HEZI RASH claims to target multiple countries
- Category: Alert
- Content: A recent post by the group indicates they are targeting Turkey, Iraq, Armenia and Germany
- Date: 2025-10-08T14:02:34Z
- Network: telegram
- Published URL: (https://t.me/hezirash/1818)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/95a2d33b-67ae-4085-8420-5b696e47ffdf.png
- Threat Actors: HEZI RASH
- Victim Country: Turkey
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
— PAGE 11 —
- Alleged data leak of Kuwait Airways
- Category: Data Breach
- Content: The threat actor claims to have leaked the data of Kuwait Airways, The compromised data includes member title, full name, member status, martial status, job title, birth date etc. NB: This breach was previously done by SkeltonCrew from the xss forum, we reported it on Mar 24, 2024. FalconFeeds: https://dash.falconfeeds.io/threat-feed/posts/POST-2981212D098C7755
- Date: 2025-10-08T13:46:33Z
- Network: telegram
- Published URL: (https://t.me/andrewfedman/1392)
- Screenshots:
- Threat Actors: Scattered LAPSUS$ Hunters
- Victim Country: Kuwait
- Victim Industry: Airlines & Aviation
- Victim Organization: kuwait airways
- Victim Site: kuwaitairways.com
- Alleged database sale of Hinds County Government, USA
- Category: Data Breach
- Content: The threat actor claims to be selling a database and unauthorized access allegedly belonging to Hinds County, Mississippi, USA. The leaked data reportedly includes various internal records, session IDs, and payment-related tables.
- Date: 2025-10-08T13:33:59Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Hinds-County-Mississippi-USA-hindscountyms-com)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/5e31d866-c04f-4dfc-b4a3-12bd448baa23.png
- Threat Actors: krekti
- Victim Country: USA
- Victim Industry: Government Administration
- Victim Organization: hinds county government
- Victim Site: hindscountyms.com
- St. Peter O’Brien Law Offices, P.C. falls victim to Akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 188GB of corporate data from St. Peter O’Brien Law Offices, P.C., including personal information of employees such as driver’s licenses, financial records, and other documents, as well as client data containing driver’s licenses, Social Security numbers, credit card and payment details, medical records, project information, financial and accounting data, NDAs, and other sensitive files.
- Date: 2025-10-08T13:25:57Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: st. peter o’brien law offices, p.c.
- Victim Site: stplawoffices.com
- Alleged sale of Dell customer and product data
- Category: Data Breach
- Content: The group claims to be selling a large dataset allegedly containing Dell customer and product information, including warranty details, serial numbers, and purchase records for millions of devices such as monitors, notebooks, desktops, and servers.
- Date: 2025-10-08T13:23:04Z
- Network: telegram
- Published URL: (https://t.me/andrewfedman/1389)
- Screenshots:
- Threat Actors: Scattered LAPSUS$ Hunters
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: dell inc.
- Victim Site: dell.com
— PAGE 12 —
- Alleged sale of Indonesian Credential Data
- Category: Data Breach
- Content: The group claims to have selling complete SQL data containing Indonesian user credentials. The data includes sensitive fields such as id_student,name, email,semester_id, status_study,photo etc.
- Date: 2025-10-08T13:15:50Z
- Network: telegram
- Published URL: (https://t.me/chipercoreteam01/8)
- Screenshots:
- Threat Actors: CipherCore Team
- Victim Country: Indonesia
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Sale of Fox RAT v6.0 Android Malware Tool
- Category: Malware
- Content: The threat actor claims to be selling a sophisticated Android Remote Access Trojan called Fox RAT v6.0, which allegedly provides unauthorized remote control and persistent surveillance of infected devices — including access to contacts, call/SMS logs, device identifiers (IMEI), file management, keylogging, camera/microphone streaming, APK installation, clipboard theft, and remote command execution — and is advertised to spread via phishing or trojanized apps.
- Date: 2025-10-08T13:13:49Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Fox-RAT-V-6-0)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/d00ce02d-6910-474d-856d-b2a776f88ac7.png
- Threat Actors: dimexor4381
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- DataStream Content Solutions falls victim to akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained corporate data from DataStream Content Solutions, including customer files, project information, and other sensitive documents.
- Date: 2025-10-08T13:05:30Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: datastream content solutions
- Victim Site: dscs.com
- Wind alliance targets the website of AquaService
- Category: Defacement
- Content: The group claims to have deface the website of AquaService
- Date: 2025-10-08T12:57:33Z
- Network: telegram
- Published URL: (https://t.me/c/2619773723/3108)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/dc1933a8-e0ff-4b31-9772-a8aaef65b5d5.png
- Threat Actors: Wind alliance
- Victim Country: Ukraine
- Victim Industry: Retail Industry
- Victim Organization: aquaservice
- Victim Site: aquaservice.od.ua
— PAGE 13 —
- Alleged data breach of Sarva Haryana Gramin Bank
- Category: Data Breach
- Content: The threat actor claims to have leaked MySQL data from Sarva Haryana Gramin Bank, allegedly containing employee and client data and more.
- Date: 2025-10-08T12:46:01Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Sarva-Haryana-Gramin-Bank-Database)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/f88cec9e-11bd-4bda-b89d-fa615e8ae119.png
- Threat Actors: ByteToBreach
- Victim Country: India
- Victim Industry: Banking & Mortgage
- Victim Organization: sarva haryana gramin bank
- Victim Site: shgb.co.in
- Alleged data leak of appel.com
- Category: Data Breach
- Content: The threat actor claims to be leaked data from apple.com.
- Date: 2025-10-08T12:37:10Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/appel-com-2020-7kk.44222/)
- Screenshots:
- Threat Actors: 999hpbugatti
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: appel.com
- Alleged data leak of Russian confidential documents
- Category: Data Breach
- Content: The threat actor claims to be selling a highly confidential document related to Russia’s Kinzhal hypersonic missile system. The document allegedly contains sensitive operational and maintenance procedures for the missile, including pre-launch protocols, in-flight operations, and post-mission guidelines. It also details the missile’s integration with various aircraft platforms, without disclosing specific performance data.
- Date: 2025-10-08T12:35:02Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Highly-Confidential-Russian-Missile-Kh-47M2-Kinzhal-System-Operation-Document)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/fedf44b3-6634-4470-b54b-da25244a5b53.png
- Threat Actors: A1HM27
- Victim Country: Russia
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Cerenade falls victim to akira Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 100 GB corporate data from Cerenade Technology, including scanned client documents such as passports, visas and documents from India, USA, Mexico, Middle East countries, Japan and other countries around the globe.
- Date: 2025-10-08T12:11:58Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Software Development
- Victim Organization: cerenade
- Victim Site: cerenade.com
— PAGE 14 —
- Carey D. Ebert, Chapter 13 Trustee falls victim to INC Ransom Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 150 GB of organization’s data and plans to publish it within 1 day.
- Date: 2025-10-08T12:09:13Z
- Network: tor
- Published URL: (http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/68defd0dfa0b6f4bdfb76a48)
- Screenshots:
- Threat Actors: INC RANSOM
- Victim Country: USA
- Victim Industry: Financial Services
- Victim Organization: carey d. ebert, chapter 13 trustee
- Victim Site: planoch13.com
- Charter Industrial Supply falls victim to Sarcoma Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 440 GB of organization’s data and plans to publish it within the next 6-7 days. Update: On October 08 2025, they revealed the full domain name and samples of 64 GB of data.
- Date: 2025-10-08T10:35:09Z
- Network: tor
- Published URL: (http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/9b5985a4-9ba8-4b82-bd42-56b92c479940.png
- https://d34iuop8pidsy8.cloudfront.net/1dd6d697-46c5-4e32-9753-2b2e0b6b1c71.png
- https://d34iuop8pidsy8.cloudfront.net/b8f9a991-7c7e-432a-8b12-b2ed26107f49.png
- https://d34iuop8pidsy8.cloudfront.net/9989100c-e9a7-467e-af15-04ded991e6a4.png
- https://d34iuop8pidsy8.cloudfront.net/9c466764-165d-4286-9cba-73609fbcd13b.png
- https://d34iuop8pidsy8.cloudfront.net/9a63bac1-c470-4361-90cc-75ccdf58880e.png
- https://d34iuop8pidsy8.cloudfront.net/e55f612d-aa2c-4924-b322-0c96ab8f1b28.jpeg
- https://d34iuop8pidsy8.cloudfront.net/dc37b578-6c77-4370-a408-5b9c8bfdc497.jpeg
- Threat Actors: Sarcoma
- Victim Country: USA
- Victim Industry: Wholesale
- Victim Organization: charter industrial supply
- Victim Site: charterindustrial.com
- Linxx Global Solutions falls victim to Payouts King Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 1.1 TB of the organization’s data and intends to publish it within 6 to 7 days. Update: On October 08 2025, they revealed the full domain name and samples of 1.1 TB of data.
- Date: 2025-10-08T10:34:33Z
- Network: tor
- Published URL: (https://payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/fc09a37b-ef19-4276-9aa8-b4674f79eaac.png
- https://d34iuop8pidsy8.cloudfront.net/842115ab-296c-48a2-8339-50127913e455.png
- Threat Actors: Payouts King
- Victim Country: USA
- Victim Industry: Security & Investigations
- Victim Organization: linxx global solutions
- Victim Site: linxxglobal.com
— PAGE 15 —
- Shit Alliance claims to target Germany
- Category: Alert
- Content: A recent post by the group indicates they are targeting Germany.
- Date: 2025-10-08T10:21:37Z
- Network: telegram
- Published URL: (https://t.me/c/2958462092/34)
- Screenshots:
- Threat Actors: Shit Alliance
- Victim Country: Germany
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data breach of DBGov
- Category: Data Breach
- Content: The group claims to have obtained database of DBGov.
- Date: 2025-10-08T10:16:18Z
- Network: telegram
- Published URL: (https://t.me/c/2958462092/29)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/c5837a52-03a7-40ce-ad59-bfa7d1757364.JPG
- Threat Actors: Shit Alliance
- Victim Country: Germany
- Victim Industry: Government & Public Sector
- Victim Organization: dbgov
- Victim Site: ggm.dbgov.de
- Kryptos Ransomware group adds an unknown victim ( mea*****.com)
- Category: Ransomware
- Content: The group claims to have obtained organization data and intends to publish it within 10-11 days.
- Date: 2025-10-08T10:04:38Z
- Network: tor
- Published URL: (http://kryptospnjzz7vfkr663bnqv3dxirmr3svo5zwq7cvu2wdfngujgknyd.onion/)
- Screenshots:
- Threat Actors: Kryptos
- Victim Country: USA
- Victim Industry: Architecture & Planning
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data sale of PT Bank Danamon Indonesia Tbk
- Category: Data Breach
- Content: The group claims to have selling 20K database of PT Bank Danamon Indonesia Tbk.
- Date: 2025-10-08T09:50:36Z
- Network: telegram
- Published URL: (https://t.me/c/2702757113/541)
- Screenshots:
- Threat Actors: Night Owll
- Victim Country: Indonesia
- Victim Industry: Banking & Mortgage
- Victim Organization: pt bank danamon indonesia tbk
- Victim Site: danamon.co.id
- Cofiex Asesoria De Empresas Sl falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 68.25 GB of the organization data.
- Date: 2025-10-08T08:58:01Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- Threat Actors: DragonForce
- Victim Country: Spain
- Victim Industry: Professional Services
- Victim Organization: cofiex asesoria de empresas sl.
- Victim Site: cofiex.es
— PAGE 16 —
- Grupo Serex falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 110.82 GB of the organization data.
- Date: 2025-10-08T08:45:32Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/f42f24ff-37a4-4cf0-987a-e270420fb68b.jpg
- Threat Actors: DragonForce
- Victim Country: Guatemala
- Victim Industry: Architecture & Planning
- Victim Organization: grupo serex
- Victim Site: gruposerex.com
- ClawSec Team claims to target multiple countries
- Category: Alert
- Content: A recent post by the group indicates that they are targeting multiple countries, such as India, Romania, Israel, Germany, Poland, Brazil.
- Date: 2025-10-08T08:43:53Z
- Network: telegram
- Published URL: (https://t.me/ClawSecTeam/62)
- Screenshots:
- Threat Actors: ClawSec Team
- Victim Country: India
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- AllgäuStern Hotel falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 12.73 GB of the organization data.
- Date: 2025-10-08T08:15:28Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/10e9fc34-492a-41f5-8b52-04b35a250baa.png
- Threat Actors: DragonForce
- Victim Country: Germany
- Victim Industry: Hospitality & Tourism
- Victim Organization: allgäusternhotel
- Victim Site: allgaeustern.de
- Vanan Services falls victim to Kill Security Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data and plans to publish it within 5-6 days. Sample screenshots are provided in their dark web portal.
- Date: 2025-10-08T08:13:01Z
- Network: tor
- Published URL: (http://ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion/?view=BTnGq2jhqB7xNEXgZIzfvxq5)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/2f274eed-ce1d-4e12-ab96-9e87f325bd9f.jpg
- https://d34iuop8pidsy8.cloudfront.net/e4178cf7-4a90-4bc8-beca-ff32ec30650e.jpg
- https://d34iuop8pidsy8.cloudfront.net/518f53c3-999d-40b9-8cf8-e306a393f319.jpg
- Threat Actors: Kill Security
- Victim Country: USA
- Victim Industry: Translation & Localization
- Victim Organization: vanan services, inc.
- Victim Site: vananservices.com
— PAGE 17 —
- LC Informatique Sàrl falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 1.46GB of the organization data.
- Date: 2025-10-08T08:10:53Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- Threat Actors: DragonForce
- Victim Country: Switzerland
- Victim Industry: Information Technology (IT) Services
- Victim Organization: lc informatique sàrl
- Victim Site: lc-informatique.ch
- Kill Security Ransomware group adds an unknown victim (•••yc•• •o••• C••••o)
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data and intends to publish it within 3–4 days.
- Date: 2025-10-08T07:44:37Z
- Network: tor
- Published URL: (http://ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion/?view=sUWk5NS5NGlfndp5iPn4WD7E)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/ab89b917-1ac9-4833-b67d-b40182fc6a72.png
- https://d34iuop8pidsy8.cloudfront.net/0498c1ed-ba18-424e-88eb-81aa896c3594.png
- Threat Actors: Kill Security
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data breach of Now Book It
- Category: Data Breach
- Content: A threat actor claims to have leaked data from Now Book It, a booking platform used in Australia and New Zealand. The breach allegedly includes over 10.7 million records, with millions of unique emails and phone numbers, along with sensitive personal details.
- Date: 2025-10-08T05:27:39Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-5kk-Now-Book-It-AU-NZ)
- Screenshots:
- Threat Actors: Trezor
- Victim Country: Australia
- Victim Industry: Hospitality & Tourism
- Victim Organization: now book it
- Victim Site: nowbookit.com
- INDOHAXSEC claims to target Israeli Websites
- Category: Alert
- Content: A recent post by the group indicates that they are targeting Israeli websites using multiple servers for their operations.
- Date: 2025-10-08T05:19:47Z
- Network: telegram
- Published URL: (https://t.me/INDOHAXSEC/39)
- Screenshots:
- Threat Actors: INDOHAXSEC
- Victim Country: Israel
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
— PAGE 18 —
- Alleged data sale of Kuwait Ministry of Public Works
- Category: Data Breach
- Content: Threat actor claims to be selling data from the Kuwait Ministry of Public Works (MPW). The compromised data includes 12 TB dump (1,643,432 files in 226,731 folders) dated October 2025.
- Date: 2025-10-08T03:41:03Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-%F0%9F%87%B0%F0%9F%87%BC-KUWAIT-Ministry-of-Public-Works-MPW-Breach-12-TB)
- Screenshots:
- Threat Actors: Kazu
- Victim Country: Kuwait
- Victim Industry: Government Administration
- Victim Organization: kuwait ministry of public works
- Victim Site: mpw.gov.kw
- Alleged gain of access to Maejo University
- Category: Initial Access
- Content: The group claims to have gained access to Maejo University.
- Date: 2025-10-08T03:34:30Z
- Network: telegram
- Published URL: (https://t.me/NigthCrawlerX/997)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/a4c05473-e79b-4c6a-b189-d0640ed0227a.png
- Threat Actors: NightCrawlerX
- Victim Country: Thailand
- Victim Industry: Education
- Victim Organization: maejo university
- Victim Site: reg3.mju.ac.th
- Alleged data leak of Banjarnegara of Indonesia
- Category: Data Breach
- Content: The threat actor claims to have leaked data from Banjarnegara of Indonesia. which includes: ID, PN, NIK, NIP, name, post/position, work unit, sub-unit, agency name, NHK, field, number of reports, mobile number, email account, status, WL year, WL type, report status, report date, submission date, LHKPN status, and post status.
- Date: 2025-10-08T03:26:24Z
- Network: openweb
- Published URL: (https://breachsta.rs/topic/data-rekap-banjarnegaradownload-e3j8m19j4)
- Screenshots:
- Threat Actors: NIGHTBREAKER403
- Victim Country: Indonesia
- Victim Industry: Government Administration
- Victim Organization: banjarnegara regency government
- Victim Site: banjarnegarakab.go.id
- Alleged unauthorized access to Lucky Investments company
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to a Lucky Investments company. The internal server contains client data, investment data, and financial information.
- Date: 2025-10-08T02:57:42Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/1864)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/9fdff229-2d22-4ab2-847a-428e3d787017.png
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: Pakistan
- Victim Industry: Financial Services
- Victim Organization: lucky investments company
- Victim Site: luckyinvestments.com.pk
— PAGE 19 —
- Alleged data leak of multiple domains in france
- Category: Data Breach
- Content: The threat actor claims to be leaking databases containing account credentials for multiple French services and domains.
- Date: 2025-10-08T02:22:09Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/french-db.44208/)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/ff4373ee-46e1-4108-8376-281777a7ea4c.png
- Threat Actors: qlfclre
- Victim Country: France
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Acuna Fombona falls victim to Space Bears Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization data that includes Personal information of employees and clients Financial documents etc. They intend to publish the data within 6-7 days,
- Date: 2025-10-08T02:17:30Z
- Network: tor
- Published URL: (http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/)
- Screenshots:
- Threat Actors: Space Bears
- Victim Country: Spain
- Victim Industry: Medical Equipment Manufacturing
- Victim Organization: acuna fombona
- Victim Site: acuna-fombona.com
— PAGE 20 —
Conclusion The incidents detailed in this report highlight a diverse and active landscape of cyber threats, encompassing Ransomware, Data Breaches, Initial Access sales, Malware distribution, and Defacement attacks. Ransomware attacks, notably by the Sinobi group (with 12 distinct victims), constituted a significant portion of the activity, primarily affecting US-based organizations across diverse sectors like Manufacturing, Construction, and Health Care, with data volumes ranging from a few GB up to 920 GB. The akira and DragonForce groups also demonstrated active operations, hitting Law, IT, and Financial sectors.
Data Breaches were prominent, with high-volume leaks impacting Discord (2.3 billion logs), FirstTwo (88.5 million records), and Now Book It (10.7 million records). Geographically, the USA, France, and Indonesia were frequently targeted.
Initial Access remains a marketable commodity, with threat actors selling access to government systems (Argentina), retail infrastructure (POS Machines, Fortinet VPN/Domain Admin), and academic networks (Maejo University).
These incidents collectively underscore the critical and ongoing nature of cyber threats across multiple sectors and geographies, demanding a continuous focus o