the Qilin ransomware group lists 3 new victims: - Kessler Soils Engineering Products - Cole Manufacturing - Oregon Linen
CTI Updates
@ctiupdates.bsky.social
Updates about all things threat intelligence & updates about stuffs going on in the cybersec, ransomware, OSINT, SOCMINT, and hacking communities #threatintel
a threat actor named databreach000 claims to be selling data on 800K Azerbaijan Airlines (AZAL) passengers, including PII, passport/ID details, contact info, loyalty data, and upcoming flight/route information
the n0n ransomware group lists several new victims: =. Starbucks =. Timberland =. Airport Appliance =. Alo Yoga =. Gap Inc. =. Samsung Electronics Co., Ltd. =. VF Corporation =. Steeden Financial =. Pollstar =. MM Insurance Agency
ello traveller give me an add if you are into threat intelligence, malware, ransomware, OSINT, or hacking <3
the Qilin ransomware group has listed Kayaku Safety Systems Malaysia Sdn Bhd, a manufacturing subsidiary of Japan’s Nippon Kayaku Co. Ltd. that produces automotive safety devices
the Endzone ransomware group lists two new victims - Absolute Bail Bonds - Momentum Telecom also an interesting observation: both Endzone and BYOD list the same victim, Eteam
An IAB (ducky23) is advertising a bespoke “access-on-request” service targeting Fortune 500-tier corporations ($5 - 20B+ revenue), with pricing starting around $20,000 per target, settled via escrow.
the initial access broker ducky23 is advertising RDP access to a Vice Presidents account at LPL Financial (http://lpl.com), a $16B revenue risk management/brokerage firm, including MFA persistence and claimed access to full customer databases (many 7-figure balances), OneDrive, Teams, Outlook, 1/2
the WallStreet ransomware group has just listed Walgreens on their DLS
the INC ransomware group has listed Sportsman's Guide (https://sportsmansguide.com), a US e-retailer of outdoor sporting goods, firearms, and hunting/camping gear. Listed revenue: ~$10M.
the Vexy ransomware group lists 3 new victims ░ Upper Web (Brazil) ░ Osiiminppal ░ Franc-Oil (Nigeria)
the Cracked hacking forum is down because DDoS Guard has suspended services to them. they are actively working on alternative solutions.
digga is a free and open-source domain and infrastructure research toolkit. It combines DNS lookups, RDAP with WHOIS fallback, passive subdomain discovery, IP and ASN information, email authentication checks, and TLS certificate inspection in one interface. https://digga.dev/
digga · Domain & Infrastructure research
Free domain lookup for DNS records, RDAP, WHOIS, subdomains, IPs, and email security. Research any domain in one fast report.
digga.dev
wake up babe we got a new Op Endgame video drop about Gootloader
the Metaencryptor ransomware group has published a listing for ProMantra, Inc., a US-based healthcare IT/BPO company (Somerset, NJ) specializing in revenue cycle management, medical billing, coding, and claims processing. ~50GB of data claimed, 7-day deadline before further action.
the Barracuda ransomware group claims to have exfiltrated 1.23TB from ProLiant (Payroll/HR services provider), including contracts, financial data, and employee information for the company and its partners. Asking price: $50,000.
the Qilin ransomware group has just listed The University of Texas at Arlington and UTA Libraries
the Play ransomware group has listed Minor League Baseball (MiLB) MiLB Scheduled publication date: Nov 15, 2026. Claimed data: confidential client documents, budget, payroll, IDs, tax, and financial information.
the initial access broker skra is advertising bot based access to a Singapore transportation company (~$300M revenue), claiming SYSTEM-level and local admin credentials across a domain environment with ~500 users and 150 AD computers and will install the implant for the buyer. (claim unverified)
a new RaaS group named Curious Worm has appeared and dropped a few victims on their DLS today. Is this some AI powered skid group, a 0APT style fake group, or actual threat actors?? Time will tell! 1/2
VPN Detection - checks whether an IP is a VPN, proxy, Tor exit or hosting address. Free, no signup. Also a Chrome extension that looks up an IP you select on any page. https://vpndetection.io/
The Qilin ransomware group has listed Oral Roberts University (ORU), a liberal arts university in Tulsa, Oklahoma, offering programs in business, biology, engineering, computer science, nursing, criminal justice, and theology
an initial access broker named Aero is advertising access to a US industrial machinery/manufacturing company (~$259M revenue) (claim unverified)
the INC ransomware group has listed Game Changer Wealth, a full-service financial services firm with three offices located in the heart of Baton Rouge, Lafayette, and Metairie in Louisiana
