BreachForums Targeted, AI Injection Attacks, and Military Data Leaks

Summary

Today's intelligence reveals a dual threat landscape: opportunistic actors targeting high-profile platforms like BreachForums and Monday.com, alongside state-aligned groups focusing on military and government targets in Russia, South Korea, and India. The convergence of AI-powered attack techniques -- from prompt injection to skill-packing evasion -- signals a shift in how adversaries will compromise autonomous systems. Defenders should prioritize monitoring for OAuth device code phishing and cross-platform RATs, as these methods lower the barrier for initial access.

Today's developments

BreachForums targeted twice. Two separate actors, FastSeek and ShinyHunters, each claim to have breached the notorious cybercrime forum BreachForums. While the veracity of both claims is unconfirmed, the targeting of a platform central to the underground economy suggests either internal infighting or an attempt to discredit the forum's operators. Separately, actor trueadam claims a data breach of the dating app Bumble, which if confirmed, would expose a large user base in the United States.

Military and government sectors under fire. Multiple incidents target defense and government entities:

• Actor Cyb3R_Shubh4M claims a breach of Pakistan's National Aerospace Science & Technology Park (NASTP), a defense and space research hub.
• Actor SudoDragon claims a data leak of a South Korean military database.
• Actor Slepra claims a data leak related to India's Astra missile program.
• Two separate actors -- mosad and Data Hoarder -- each claim breaches of Russia's Main Military Medical Directorate, suggesting coordinated or copycat activity against Russian military medical infrastructure.
• Actor sqx claims breaches of the Argentine Ministry of Health and the broader Ministerio De Salud Argentina, indicating a campaign against Argentine healthcare data.

AI and authentication threats escalate. Industry researchers highlight three emerging attack vectors:

• Prompt injection for crypto theft: Researchers uncovered campaigns where malicious websites inject indirect prompts into autonomous AI agents, tricking them into making unauthorized cryptocurrency payments. This represents a new class of supply-chain risk for organizations deploying AI web agents.
• Device code phishing via Microsoft: Securelist reports that threat actors are weaponizing the OAuth 2.0 Device Authorization Grant specification, using legitimate Microsoft websites to phish credentials from users of Smart TVs, IoT devices, and printers. This technique bypasses traditional URL inspection.
• SkillCloak evasion for AI agents: Researchers at HKUST demonstrated that malicious "skills" for AI coding agents can evade static scanners using self-extracting packing techniques. Their strongest variant bypassed all tested scanners over 90% of the time, underscoring the inadequacy of current detection for AI agent ecosystems.

Cross-platform RAT emerges. LevelBlue researchers flagged QuimaRAT, a Java-based remote access trojan advertised as a malware-as-a-service (MaaS) product. Priced from $150/month to $1,200 for lifetime access, QuimaRAT targets Windows, Linux, and macOS, lowering the barrier for attackers seeking persistent access across heterogeneous environments.

Other notable incidents. Actor misere claims breaches of three French entities: The Burning Descent (entertainment), Terr'Alta Immobilier (real estate), and the Ministry of Culture. Actor legionx claims a breach of Brazil's Detran (government administration). Actor azraelzer0d4y claims a breach of the International Anti-Corruption Academy (IACA) in Austria. Actor Tanaka claims a breach of Université Jean Lorougnon Guédé in Ivory Coast.

Threat landscape signals

Actor concentration is shifting. The Gentlemen dominated with 18 events, but their focus appears distributed. NOTCTBER (11 events) and NoName057(16) (10 events) show sustained DDoS and defacement activity, primarily targeting Ukraine and Germany. Pharaoh's Team Channel (8 events) and Simsimi (7 events) continue low-to-mid intensity campaigns. The reappearance of ShinyHunters targeting BreachForums signals that high-profile forum takedowns remain a priority for some actors.

Geographic clustering. The United States and Thailand each saw 11 events, but the nature differs: US incidents skew toward data breaches and ransomware, while Thailand events are dominated by defacement and DDoS from hacktivist groups. Ukraine (8 events) and Germany (8 events) remain focal points for pro-Russian hacktivist campaigns. Mexico (7 events) sees a mix of ransomware and data leaks.

Ransomware vs. DDoS balance. Ransomware (24 events) and DDoS (26 events) are nearly equal, but the strategic implications differ. DDoS is often noise from hacktivists; ransomware represents direct financial extortion. The 23 data breaches and 4 data leaks suggest that exfiltration-based extortion continues to outpace encryption-only attacks. Defenders should prepare for hybrid attacks combining DDoS distraction with data theft.

Emerging technique: air-gap exfiltration. Researchers at Shandong University demonstrated TrojPix, a technique that leaks data from air-gapped systems by modulating on-screen pixels to emit faint radio signals via video cable emissions. While requiring prior malware installation, this method shows that physical isolation is no longer a guarantee against data exfiltration.