← Feed

Posts

• View post

  the WallStreet ransomware group has just listed Walgreens on their DLS

• View post

• View post

  the INC ransomware group has listed Sportsman's Guide (https://sportsmansguide.com), a US e-retailer of outdoor sporting goods, firearms, and hunting/camping gear. Listed revenue: ~$10M.

• View post

  ALPHV aka BlackCat throwback (2022)

• View post

  ​

• View post

  ello traveller give me an add if you are into threat intelligence, malware, ransomware, OSINT, or hacking <3

• View post

  the Vexy ransomware group lists 3 new victims ░ Upper Web (Brazil) ░ Osiiminppal ░ Franc-Oil (Nigeria)

• View post

  RE: https://infosec.exchange/@ctiupdates/117604704555728074 Cracked states they have fixed some thingy things

• View post

  the Cracked hacking forum is down because DDoS Guard has suspended services to them. they are actively working on alternative solutions.

• View post

  digga is a free and open-source domain and infrastructure research toolkit. It combines DNS lookups, RDAP with WHOIS fallback, passive subdomain discovery, IP and ASN information, email authentication checks, and TLS certificate inspection in one interface. https://digga.dev/

• View post

  wake up babe we got a new Op Endgame video drop about Gootloader

• View post

  the Metaencryptor ransomware group has published a listing for ProMantra, Inc., a US-based healthcare IT/BPO company (Somerset, NJ) specializing in revenue cycle management, medical billing, coding, and claims processing. ~50GB of data claimed, 7-day deadline before further action.

• View post

  the Barracuda ransomware group claims to have exfiltrated 1.23TB from ProLiant (Payroll/HR services provider), including contracts, financial data, and employee information for the company and its partners. Asking price: $50,000.

• View post

  the Qilin ransomware group has just listed The University of Texas at Arlington and UTA Libraries

• View post

  the Play ransomware group has listed Minor League Baseball (MiLB) MiLB Scheduled publication date: Nov 15, 2026. Claimed data: confidential client documents, budget, payroll, IDs, tax, and financial information.

• View post

  the initial access broker skra is advertising bot based access to a Singapore transportation company (~$300M revenue), claiming SYSTEM-level and local admin credentials across a domain environment with ~500 users and 150 AD computers and will install the implant for the buyer. (claim unverified)

• View post

  a new RaaS group named Curious Worm has appeared and dropped a few victims on their DLS today. Is this some AI powered skid group, a 0APT style fake group, or actual threat actors?? Time will tell! .¸¸.· Atlas Healthcare Partners .¸¸.· Marquis Companies .¸¸.· Safco Dental Supply .¸¸.·Life Line Screening .¸¸.· Raleigh Orthopaedic .¸¸.· Baron & Budd .¸¸.· Shannon Medical Center .¸¸.· SBH Health System .¸¸.· SACHEM

• View post

  VPN Detection - checks whether an IP is a VPN, proxy, Tor exit or hosting address. Free, no signup. Also a Chrome extension that looks up an IP you select on any page. https://vpndetection.io/

• View post

  ​

• View post

  The Qilin ransomware group has listed Oral Roberts University (ORU), a liberal arts university in Tulsa, Oklahoma, offering programs in business, biology, engineering, computer science, nursing, criminal justice, and theology

• View post

  an initial access broker named Aero is advertising access to a US industrial machinery/manufacturing company (~$259M revenue) (claim unverified)

• View post

  the INC ransomware group has listed Game Changer Wealth, a full-service financial services firm with three offices located in the heart of Baton Rouge, Lafayette, and Metairie in Louisiana

• View post

  SOLD 💰 threat actor 888 has marked as SOLD a listing for initial access to a US software development company (~$230M revenue), including administrative portals and source code access (claim unverified)

• View post

  the BYOD ransomware group has listed Toyota and Providence

• View post

  Telegram Archive backs up one or more Telegram accounts to a machine you host. It runs in Docker or from pip, and saves messages, media, edits and deletions to SQLite or PostgreSQL on your own disk. A web viewer, which never talks to Telegram, lets you read and search what it saved. https://github.com/GeiserX/Telegram-Archive

• View post

  the Booba ransomware group lists 6 new victims on their DLS »-(¯`· Acclaim Health »-(¯` ·Day One RI »-(¯`· El Portal Imaging Center »-(¯`· Collier Sports Medicine and Orthopedic Center »-(¯`· Georgetown Sleep Center »-(¯`· COMPUTER TASK GROUP

• View post

  Every single time...

• View post

  a threat actor named far7tw is advertising access to a PandaDoc Enterprise dashboard belonging to Neighbors Insurance Agency (Miami, FL), claiming exposure of 8,000+ documents including medical/auto insurance applications, driver’s licenses, SSNs, VIN records, and medical history files. (claim unverified)

• View post

  the Rhysida ransomware group has listed Treuhand & Immobilien Abt AG(Switzerland) on their DLS and is asking a ransom of 5 BTC

• View post

  Online malware analysis sandbox. Detonates a submitted file or URL and publishes the report, and lets you search past public scans by indicator: IP, domain, URL, mutex, registry key, hash or JA3/JA4 fingerprint. Reports are readable without an account; a free tier adds submissions, an API and a command line client. https://malwagon.com