Cyber Breaches

Dark Web News Analysis A threat actor, “ByteToBreach,” is advertising the alleged sale of the entire GLPI IT system database from Eurofiber. This claim, if true, represents one of the most severe supply chain attacks imaginable, compromising the “crown jewels” of a core European critical infrastructure provider. My analysis confirms ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the alleged sale of a “full archive” of Japanese citizens’ data. The entire package is priced at an exceptionally low $150, with samples available via Telegram. This claim, if true, represents a low-cost, bulk sale of ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the sale of 1,783 alleged identity documents of Chinese citizens. The seller is offering the IDs for $3 each, with a stock date of November 14, 2025, indicating this is a brand new, fresh batch of ...

Web News Analysis Multiple credible reports indicate that Samsung smartphones sold in the Middle East and North Africa come preloaded with an unremovable spyware app called Aura, developed by Israeli firm IronSource. This software, integrated via Samsung system updates, allegedly collects sensitive personal data—biometrics, location, and device identifiers—without user consent. ...

Dark Web News Analysis A threat actor, identified as “@CCLand,” has dramatically escalated their attack against Thinline Technologies, an IT consulting and Managed Service Provider (MSP). This claim, if true, represents a critical and active supply chain attack. This is not a new, isolated incident. This is a direct and ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the sale of an exploit for CVE-2025-31324, a critical vulnerability in SAP NetWeaver. The seller, who is asking for a starting price of $20,000, is marketing this as a “1-day exploit.” This claim, if true, represents ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the alleged sale of a massive database compilation from Russia’s top job search platforms: SuperJob, HH.ru (HeadHunter), and Trudvsem. This is not a new breach. The seller explicitly dates the data to 2022. My analysis confirms ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the sale of a “1-day” exploit for CVE-2025-59287, a critical (CVSS 9.8) Remote Code Execution (RCE) vulnerability in Microsoft Windows Server Update Services (WSUS). This claim, if true, represents an immediate and catastrophic threat to any ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the sale of unauthorized Remote Desktop Web (RDWeb) access to a Canadian company. This is a classic Initial Access Broker (IAB) listing, representing an immediate and severe threat. The seller is not a ransomware group; they ...