Tag: DARK WEB

Inside Hunters International Group: How a Retailer Became the Latest Ransomware Victim
Summary: In February 2025, the eSentire Threat Response Unit (TRU) uncovered a sophisticated ransomware campaign by the Hunters International group against a retail organization, utilizing vulnerabilities in FortiOS for initial access. The attack involved the creation of a super admin account, lateral movement within the network, and the deployment of a new variant of ransomware designed to evade detection and prevent data recovery.…
Read More
New VanHelsing ransomware targets Windows, ARM, ESXi systems
Summary: A new multi-platform ransomware-as-a-service operation called VanHelsing has emerged, targeting various operating systems, including Windows and Linux. It allows affiliates to keep 80% of ransom payments and employs sophisticated encryption methods and stealth tactics in its operations. The ransomware has already been used in attacks against at least three victims, with ransoms set at 0,000.…
Read More
23andMe files for bankruptcy, putting customers’ genetic data at risk
Summary: The genetic testing company 23andMe has initiated Chapter 11 bankruptcy proceedings, which alarmed regulators and privacy advocates who are urging customers to delete their genetic data. Following the bankruptcy announcement, CEO Anne Wojcicki resigned, while the company’s significant data breach earlier in October 2023 raised concerns over the safety of customer information.…
Read More
Part 2: Validating the Breach Oracle Cloud Denied – CloudSEK’s Follow-Up Analysis
On March 21, 2025, a user claimed to have accessed Oracle Cloud’s login servers, selling sensitive data, including authentication credentials. CloudSEK authenticated the data, warning the community of potential supply chain attacks. Oracle denied any breach, but CloudSEK’s investigation confirmed the exposure of real customer data linked to the compromised servers.…
Read More
⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More
Summary: Recent cyber threats highlight vulnerabilities in open-source tools, escalating ad fraud through mobile apps, and advanced ransomware tactics targeting critical defenses. Notably, attacks have leveraged AI, and a supply chain breach at Coinbase exemplifies these risks. A rise in stolen credentials further underscores the urgent need for improved cybersecurity measures.…
Read More
Summary: After a four-year investigation, law enforcement successfully apprehended a cybercriminal known by multiple aliases, including ALTDOS and Omid16B. The criminal, motivated by financial gain, executed various attacks on companies, primarily focusing on extortion through data breaches. Group-IB played a pivotal role in tracking the actor’s activities across different identities until his arrest in Thailand on February 26, 2025.…
Read More

Summary: The video discusses the new automated brute-forcing framework developed by Black Basta ransomware, termed “Brute D.” This framework is designed to compromise Edge firewalls and VPNs, raising concerns about the security practices of users who often use default passwords on their devices.

Keypoints:

Black Basta ransomware has created an automated brute-forcing framework called “Brute D.”…
Read More
The Biggest Supply Chain Hack Of 2025: 6M Records For Sale Exfiltrated from Oracle Cloud Affecting over 140k Tenants
A significant data breach occurred involving a threat actor known as “rose87168,” who sold 6 million records extracted from Oracle Cloud’s SSO and LDAP systems. The compromised data includes sensitive credentials and key files, affecting over 140,000 tenants. The actor’s activities suggest they exploited a web application vulnerability, raising severe concerns regarding Oracle Cloud’s security.…
Read More
Alleged Data Breach of Mexican Citizen Information Exposed 1.8M Records
Summary: A threat actor claims to have acquired a database with personal information of about 1.8 million Mexican citizens, including 1.2 million email addresses. The compromised data is said to be approximately 200MB and in CSV format. This incident follows the significant “Guacamaya” breach from September 2022, involving sensitive communications related to national security.…
Read More

Summary: The video discusses Jack Rhysider’s interview with Chris Monteiro, a cybersecurity expert who explores the dark web, particularly the hitman-for-hire site, Besa Mafia. Chris reveals the challenges and dangers of investigating such sites, including threats and real-life consequences stemming from the scams taking place. Throughout the discussion, they delve into the ethics of intervening in potentially lethal situations and the broader implications of dark web crimes.…
Read More
Threat Spotlight: Credential Theft vs. Admin Control—Two Devastating Paths to VPN Exploitation
This report discusses the ongoing exploitation of older VPN vulnerabilities, particularly CVE-2018-13379 and CVE-2022-40684, highlighting how attackers, including cybercriminal and state-sponsored groups, continue to target these flaws for credential theft and administrative control. The research indicates substantial growth in discussions around Fortinet VPN vulnerabilities on cybercriminal forums, illustrating their significance in the current threat landscape.…
Read More