Account required
Sign in to view threat intelligence
CTI data is restricted to registered users. Create a free account to browse the dashboard, then upgrade to a paid plan to unlock event details and IOCs.
Cyber Threat Intelligence
Daily snapshot
Daily brief 27 August 2026
MrDarkRoot Targets Global Education Sector in Mass Data Sale Campaign
MrDarkRoot claims 18 education-sector data sales across 12 countries, hitting US universities and Israeli Ministry of Education. DDoS and initial access activity also tracked.
Events
0
In current view
Critical exposure
0
Last 24 hours
0
vs previous 24h
Distinct actors
0
In current view
By attack category · 9
Data Exposure
0
Ransomware
0
Access Brokerage
0
DDoS
0
Web Defacement
0
Malware Ops
0
Vulnerability
0
Threat Alert
0
Cyber Operation
0
Top victim countries
No country data in this view.
Subscriber-only
CTI brief — 2026-08-27
The CTI dashboard tracks dark-web disclosures, ransomware claims, data leaks and active threat actors. Full event list, threat-actor profiles and historical archive are available to subscribers.
Events
showing 0
Category
Title
Actor
Country
Date
- Data BreachAlleged sale of data of KVSMrDarkRootEgypt27 Aug
- Data BreachAlleged Sale of Data from club-edu.tambov.ruMrDarkRootRussia27 Aug
- Data BreachAlleged sale of data of Language Link VietnamMrDarkRootVietnam27 Aug
- Data BreachAlleged Sale of Data from UPF Barcelona School of Management (UPF-BSM)MrDarkRootSpain27 Aug
- Data BreachAlleged Sale of Data from resh.eduMrDarkRootUnited States27 Aug
- Data BreachAlleged data breach of Dayawati Dharamvira Public SchoolMrDarkRootIndia27 Aug
- Data BreachAlleged Sale of Data from Near East University (NEU)MrDarkRootTurkey27 Aug
- Data BreachAlleged data breach of The University of South-East AsiaMrDarkRootCambodia27 Aug
- Access BrokerageAlleged Sale of Schema Admin Access to an Unidentified Manufacturing Company in FrancemalaryFrance27 Aug
- Data BreachAlleged Sale of Data from Israeli Ministry of EducationMrDarkRootIsrael27 Aug
- Data BreachAlleged Sale of Data from Loyola University ChicagoMrDarkRootUnited States27 Aug
- Data BreachAlleged Sale of Data from Stenden University QatarMrDarkRootQatar27 Aug
- Data BreachAlleged Sale of Data from Institute of Space TechnologyMrDarkRootPakistan27 Aug
- Web DefacementTeam Hazardous Pakistan targets the website of Territorial ArmyTeam Hazardous PakistanIndia27 Aug
- Access BrokerageAlleged sale of unauthorized webshell access to Bástya CsárdaDeepCore NetworkSlovakia27 Aug
- Data BreachAlleged Sale of Atlantic International UniversityMrDarkRootUnited States27 Aug
- Access BrokerageAlleged sale of unauthorized webshell access to FigureateDeepCore NetworkAustralia27 Aug
- Data BreachAlleged Sale of Data from Fatec LinsMrDarkRootBrazil27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of JerusalemOnline Ltd.RBL LEVIATHAN GHOSTIsrael27 Aug
- Access BrokerageAlleged sale of unauthorized webshell access to ELECDeepCore NetworkCzech Republic27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of JDIH BPKRBL LEVIATHAN GHOSTIndonesia27 Aug
- Data BreachAlleged Sale of Data from sstu.edu.iqMrDarkRootIraq27 Aug
- Data BreachAlleged Sale of Data from University of MiamiMrDarkRootUnited States27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of Regional Office of the Ministry of Agrarian Affairs and Spatial PlanningRBL LEVIATHAN GHOSTIndonesia27 Aug
- Data BreachAlleged Sale of Data from University of PennsylvaniaMrDarkRootUnited States27 Aug
- Access BrokerageAlleged sale of unauthorized webshell access to Huntington Area Development CouncilDeepCore NetworkUnited States27 Aug
- Data BreachAlleged Sale of Data from Stanford UniversityMrDarkRootUnited States27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of Sekretariat DPRD Provinsi BantenRBL LEVIATHAN GHOSTIndonesia27 Aug
- Malware OpsAlleged Sale of Malware Crypting and EDR Bypass ServiceCryptor—27 Aug
- Access BrokerageAlleged sale of unauthorized webshell access to multiple websites from ThailandDeepCore NetworkThailand27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of Israel Government TourismRBL LEVIATHAN GHOSTIsrael27 Aug
- Access BrokerageAlleged Sale of Domain Admin Access to an Unidentified Grocery Retail Organization in FrancemalaryFrance27 Aug
- RansomwareMAT Holdings, Inc. falls victim to iah647 Ransomwareiah647United States27 Aug
- Access BrokerageAlleged sale of unauthorized webshell access to Guitares au BeffroiDeepCore NetworkFrance27 Aug
- Access BrokerageAlleged sale of unauthorized webshell access to the subdomains of HostingerDeepCore NetworkLithuania27 Aug
- Data BreachAlleged Data Breach of IPMAByteToBreachPortugal27 Aug
- RansomwareKenEp Group Falls Victim to Qilin RansomwareQilinMalaysia27 Aug
- Access BrokerageAlleged sale of unauthorized webshell access to multiple websites from IndonesiaDeepCore NetworkIndonesia27 Aug
- Data LeakAlleged Data leak of Regear.ccdalvecorp—27 Aug
- RansomwareSanatorio Modelo de Caseros Falls Victim to Qilin RansomwareQilinArgentina27 Aug
- Access BrokerageDisrupt0r targets the website of Government Polytechnic College, KooduveliDisrupt0rIndia27 Aug
- Data LeakAlleged Sale of Document Verified Google Ads AccountsPalmaMediaGoogle—27 Aug
- Access BrokerageAlleged unauthorized access to unidentified CCTV systems in AsiaShadow ClawZ 404—27 Aug
- Data LeakAlleged Data Leak of Indonesian bankBaseKnoxIndonesia27 Aug
- Data LeakAlleged Sale of 100 Italian Driver’s License and ID RecordsCodeStudioItaly27 Aug
- Data LeakAlleged sale of 100 German driving license imagesCodeStudioGermany27 Aug
- Data BreachAlleged data breach of TeleCoopX-VDP-XFrance27 Aug
- Data LeakAlleged Sale of 100 Switzerland Driver’s License RecordsCodeStudioSwitzerland27 Aug
- Data LeakAlleged sale of 100 UK driving license imagesCodeStudioUnited Kingdom27 Aug
- RansomwareWMI Emporium Co., Ltd. Falls Victim to Krybit RansomwareKRYBITThailand27 Aug
- Data LeakAlleged Sale of 160K Casino User Databaseignix—27 Aug
- RansomwareCONSEIL GABONAIS DES CHARGEURS Falls Victim to Krybit RansomwareKRYBITFrance27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of OatlyRBL LEVIATHAN GHOSTIsrael27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of Oshi Oshi Sushi BarRBL LEVIATHAN GHOSTIsrael27 Aug
- RansomwareLemon Farm Falls Victim to Krybit RansomwareKRYBITThailand27 Aug
- Access BrokerageAlleged Sale of Web Shell Access to a UK Parking Booking Websitex52024United Kingdom27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of SodaStream International, Ltd.RBL LEVIATHAN GHOSTIsrael27 Aug
- DDoSRBL LEVIATHAN GHOST targets the website of MyBenefitsRBL LEVIATHAN GHOSTIsrael27 Aug
- Access BrokerageAlleged Unauthorized SFTP Access to baseltradedomainbreachkaduuSwitzerland27 Aug
- Access BrokerageAlleged Unauthorized SFTP Access to limmat.domainbreachkaduuSwitzerland27 Aug
- Access BrokerageAlleged Unauthorized SFTP Access to matterhorndomainbreachkaduuSwitzerland27 Aug
- Data BreachAlleged Data Breach of 77 DiamondsJurakUnited Kingdom27 Aug
- Access BrokerageAlleged Unauthorized SFTP Access to Ricardo AGdomainbreachkaduuSwitzerland27 Aug
- Access BrokerageAlleged Unauthorized SFTP Access to winterhostdomainbreachkaduuSwitzerland27 Aug
- Access BrokerageAlleged sale of unauthorized access to Binghamton UniversityVSS MARKET SHELLUnited States27 Aug
- RansomwareSimplex Engineering & Foundry Works Pvt. Ltd. Falls Victim to Eclipse RansomwareEclipseIndia27 Aug
- Web DefacementFor Close System - F.C.S targets the website of Brissón Real EstateFor Close System - F.C.SArgentina27 Aug
- Data BreachAlleged breach of Vercel database19581951United States27 Aug
- DDoSK3LLLEAKERS targets the website of DrachimK3LLLEAKERSIsrael27 Aug
- Access BrokerageAlleged sale of unauthorized access to Easily Ltdevill Scattered spiderUnited Kingdom27 Aug
- RansomwareJindal Life Science Falls Victim to Krybit RansomwareKRYBITIndia27 Aug
No events match your filters.
Page 1 of 1
Active threat actors
click any actor to filter the list aboveNo active actors in this view.