intel
threat feed assembled at build time from ransomware.live and four news wires · refreshed daily · last pull just now
*feed window = the 100 most recent claims upstream publishes on the free tier · archive grows daily since 2026-08
latest ransomware claims
newest first · names as published by the groups| when | victim | group | sector | country |
|---|---|---|---|---|
| 6h ago | nbcuniversal.com · nbcuniversal.com | Scarlettgroup | Technology | US |
| 6h ago | Xylanpicks | N0n | — | US |
| 9h ago | GSE-M Technology Sdn. Bhd. · www.gse.com.my | bravox | Technology | MY |
| 9h ago | Bruin Group LLC | emperador | Other | US |
| 15h ago | M... M... | SilentRansomGroup | — | — |
| 15h ago | P... H... | SilentRansomGroup | — | — |
| 15h ago | Graves Fireplaces, Inc. · www.gravesfireplaces.com | Global Secret Group | Manufacturing | US |
| 15h ago | centralrogers.com · centralrogers.com | incransom | Other | US |
| 17h ago | Asensus Surgical · www.asensus.com | Dark Project | Healthcare | US |
| 17h ago | The Excalibur Group · theexcaliburgroup.com | Dark Project | — | US |
| 18h ago | P...S...R... | SilentRansomGroup | — | — |
| 21h ago | Duarte Nursery, Inc. | aurora | Agriculture and Food Production | US |
| 21h ago | 51Ridge (Newark NJ hosting/IT) | N0n | Technology | US |
| 21h ago | Research Foundation of The City University of New York · www.rfcuny.org | Booba Project | Education | US |
| 21h ago | Chicago Vein Institute · www.chicagoveininstitute.com | Booba Project | Healthcare | US |
| 21h ago | Pearland Pediatrics · www.pearlandpediatrics.com | Booba Project | Healthcare | US |
| 21h ago | City of Mt. Angel, Oregon · www.ci.mt-angel.or.us | Booba Project | Government & Defense | US |
| 21h ago | City Hall - Everett, MA · ci.everett.ma.us | Booba Project | Government & Defense | US |
| 21h ago | OpenText · opentext.com | Mimori | Technology | CA |
| 21h ago | Aveva · aveva.com | Mimori | Manufacturing | GB |
most active (window)
- N0n 30 claims 1 DLS
- qilin 15 claims 3 DLS
- Helix 7 claims 2 DLS
- Booba Project 6 claims 1 DLS
- everest 4 claims 3 DLS
- play 4 claims 4 DLS
full dossiers and raw leak-site addresses in the researcher vault.
security wire
the hacker news · bleepingcomputer · krebs on security · dark reading- Microsoft says October updates didn’t actually fix VPN issues
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. [...]
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an ou…
- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. T…
- CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]
- U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of H…
- State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned b…
- CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server tha…
- Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to…
- Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]
- Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted cer…
- Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.
- PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled d…
- Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environ…
- Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ
The perp, who has Saudi ties, was arrested for allegedly bugging an OpenAI conference room, highlighting a preventable insider threat vector.
- OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. [...]
- Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that web…
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, track…
- Close Identity Gaps in Software Development Before Unleashing AI
Artificial Intelligence is complicating security in the software development lifecycle, but a Dark Reading roundtable found collaboration, better identity visibility, and reduced testing costs offer CISOs a way ahead.
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.…
- Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.
- DHS bans DeepSeek products across US federal civilian agencies
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. [...]
- Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on…
- CJIS v6.1 Compliance: 5 Practical Priorities for Agencies
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, pa…
- Hacker gets 8 years for stealing $3.3 million from taxpayers
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...]
- Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19.…
- Windows Server 2025 gets support for quick machine recovery
Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]
- WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators
WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's…
- OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]
- Researchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
- 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.
- ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.
- OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explai…
- The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.
- Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually…
- BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
- Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.
- Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform
The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.
- U.K. Sanctions Cryptomus for RU Money Laundering
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud…
- Microsoft Patches More Than 1,400 Security Flaws
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was alr…
- FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved t…
- ShinyHunters Extorted Boeing Spin-off Prior to Arrests
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. Kre…
- Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the su…
- U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in fede…
- Data Broker Radaris Loses Domains in Privacy Fight
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recen…
- Microsoft Plugs Nearly 1,000 Security Holes
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping…
- FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose…
darknet watchlist
official onion services, verified against publisher announcementsnews & media
major outlets that publish official Tor mirrors for readers under censorship
- BBC News
www.bbcnewsd73hkzno2ini43t4gblxvycyac5aw4gnv7t2rccijh7745uqd.onion/
official BBC News Tor mirror for censored regions
✓ verified 2026-08-23 · clearnet mirror
- The New York Times
www.nytimes3xbfgragh.onion/
NYT onion service, live since October 2017
✓ verified 2026-08-23 · clearnet mirror
- ProPublica
p53lf57qovyuvwsc6xnrppyply3vtqm7l6pcobkmyqsiofyeznfu5uqd.onion/
first major newsroom on Tor; full site mirror
✓ verified 2026-08-23 · clearnet mirror
privacy & tools
infrastructure you should only ever reach over its onion when privacy matters
- Tor Project
2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/
download Tor Browser without leaving the network
✓ verified 2026-08-23 · clearnet mirror
- DuckDuckGo
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/
no-tracking search engine, native onion endpoint
✓ verified 2026-08-23 · clearnet mirror
- Proton Mail
protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/
encrypted mail over Tor; address unchanged since launch
✓ verified 2026-08-23 · clearnet mirror
government & reference
the odd but real corners: intelligence agencies, archives, and status trackers
- Facebook
facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion/
largest consumer site running an official onion since 2014
✓ verified 2026-08-22 · clearnet mirror
- CIA
ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion/
the agency's official onion contact portal
✓ verified 2026-08-22 · clearnet mirror
- Archive.today
archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/
webpage snapshot archive, reachable when clearnet blocks you
✓ verified 2026-08-22 · clearnet mirror
- dark.fail
darkfailenbsdla5mal2mxn2uz66od5vtzd5qozslagrfzachha3f3id.onion/
pgp-verified uptime tracker for popular onion services
✓ verified 2026-08-22 · clearnet mirror
claim archive
every claim the daily ingest has ever seen · …| discovered | victim | group | sector | country |
|---|
archive accumulates daily since 2026-08 · full export incl. leak-post links is a pro download in the vault