Cyber Threat Intelligence

Exchange Markets claims four Saudi financial-sector data sales as UNC6671 expands vishing extortion; 4,400 Rockwell PLCs remain exposed.

Dark Project led 19 events as 46 ransomware cases and 45 initial-access listings drove a 194-incident day led by US and Indonesian targets.

CL0P led 251 tracked events with 52 exposure claims, as a 440-package npm worm, Greatness phishing and SonicWall exploitation raised technical risk.

INC Ransomware exploits SonicWall SMA 1000 as alleged breaches hit defense, banking and crypto targets across a broad multi-sector campaign.

TheHatman and other actors drove 58 alleged breaches and leaks across government, hospitality, and finance, with Mexico and Pakistan heavily targeted.

Global cyberattacks spike with 45 data exposures, targeting banking, government, and healthcare sectors across 20+ countries, plus critical software flaws.

Midnight Blizzard targets hotel portals as 201 incidents include 71 breach or leak claims; Arcepah hits Mexico and Chrome fixes 1,442 flaws.

Ransomware and hacktivist groups target healthcare, government, and finance across 20+ countries; Qilin and CoupDeGrace each tied to 10 events.

177 events include 54 critical exposures, 30+ water utilities hit, and alleged breaches claimed against NYC Health + Hospitals and Spain's Guardia Civil.

AI-assisted cryptanalysis targets post-quantum and AES schemes as 30+ water plants face disruption and 75 critical exposures span key sectors.

Rogue AI agent incident, alleged data sales from CIA/DRDO, and public vBulletin exploit released. Ransomware and data breach events surge, targeting healthcare, government, and telecom sectors.

Exfilsquad claims 12 breaches, Ecuador municipal attacks add 10, and 60 breach or leak claims push government exposure to the top.

Ecuador parish governments hit by azraelzer0d4y; UK DfE and police databases alleged for sale; Cl0p exploits PTC Windchill; DevMan RaaS platform detailed.

Laundry Bear abused Zimbra as p2wnz claimed Seychelles leaks; ransomware rose to 54 of 229 events while critical exposures fell day over day.

Iran-linked OT alerts broaden as 83 alleged exposures span government, education and finance; Kimsuky and critical endpoint flaws raise risk.

Urharmless claims US agency breaches as Qilin exploits PAN-OS; 299 events include 78 breach/leak exposures concentrated in the US, France and Spain.

FakeGit's 7,600 repositories, SonicWall exploitation, a 7-Zip flaw, and Microsoft 365 C2 broaden attack paths.

NGINX CVE-2026-42533, 2 exploited SonicWall SMA zero-days, and ClickFix malware put edge systems at risk.

LockBit 5.0 names 6 victims across 5 countries as Qilin, Nova, KRYBIT, DragonForce, access, and token-leak claims expand risk.

Wp2shell, HollowByte's 11-byte TLS DoS, 7 malicious Vite packages, and exploited SharePoint flaws raise enterprise risk.

Exchange Markets actor claims breaches at UnitedHealthcare, HSBC Mexico, and Punjab National Bank. ACR Stealer campaigns surge. Scattered Spider hackers sentenced.

232 events tracked; NPCIL data breach, multiple Indian universities hit, and a surge in data leaks targeting India, the US, and Indonesia. SonicWall zero-days and TuxBot v3 IoT botnet add to the threa

Over 78 critical data exposures reported, targeting Mexico, India, and US entities. Microsoft issues record Patch Tuesday with 622 fixes, including two zero-days. Qilin, Akatsuki cyber team active.

KYCMyASS lists passports from 6 nations; EU sanctions Turla for grid attacks; AI-generated PowerShell and Forg365 PhaaS target Microsoft 365.

Russia blamed for Poland energy cyberattack as UK/EU impose sanctions. Telegram 182M user database alleged leak. Sophia01 targets German firms. UAE entities hit by Exchange Markets.

Exchange Markets targets UAE real estate and healthcare; SUB-ZERO leaks French education data; Qilin, Sophia01 active; Jscrambler supply chain attack.

Today's brief covers the aggressive expansion of The Gentlemen ransomware, massive alleged breaches in Brazil and US, critical ShareFile vulnerability, and a surge in citizen database sales.

Pro-Russian group targets Romanian military institutions. Microsoft details GigaWiper destructive backdoor. GodDamn ransomware uses kernel driver. Interpol arrests 5,800.

GhostLock Linux flaw enables root access; HalluSquatting targets AI coding assistants. Breaches hit Binance, NASA Earthdata, Deloitte, and more. DR4K7H CYBER TEAM active.

40 critical exposures today including Pakistan Airlines, SK Telecom, UAE govt. Mandiant reveals active ADFS signing key recovery via Machine DPAPI. Spain arrests alleged Russian hacktivist.