Cyber Breaches

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the sale of 1,783 alleged identity documents of Chinese citizens. The seller is offering the IDs for $3 each, with a stock date of November 14, 2025, indicating this is a brand new, fresh batch of ...

Web News Analysis Multiple credible reports indicate that Samsung smartphones sold in the Middle East and North Africa come preloaded with an unremovable spyware app called Aura, developed by Israeli firm IronSource. This software, integrated via Samsung system updates, allegedly collects sensitive personal data—biometrics, location, and device identifiers—without user consent. ...

Dark Web News Analysis A threat actor, identified as “@CCLand,” has dramatically escalated their attack against Thinline Technologies, an IT consulting and Managed Service Provider (MSP). This claim, if true, represents a critical and active supply chain attack. This is not a new, isolated incident. This is a direct and ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the sale of an exploit for CVE-2025-31324, a critical vulnerability in SAP NetWeaver. The seller, who is asking for a starting price of $20,000, is marketing this as a “1-day exploit.” This claim, if true, represents ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the alleged sale of a massive database compilation from Russia’s top job search platforms: SuperJob, HH.ru (HeadHunter), and Trudvsem. This is not a new breach. The seller explicitly dates the data to 2022. My analysis confirms ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the sale of a “1-day” exploit for CVE-2025-59287, a critical (CVSS 9.8) Remote Code Execution (RCE) vulnerability in Microsoft Windows Server Update Services (WSUS). This claim, if true, represents an immediate and catastrophic threat to any ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the sale of unauthorized Remote Desktop Web (RDWeb) access to a Canadian company. This is a classic Initial Access Broker (IAB) listing, representing an immediate and severe threat. The seller is not a ransomware group; they ...

Dark Web News Analysis A threat actor, identified as “@KaruHunters,” claims to have breached the Franklin County Engineer’s Office in Ohio, a government agency responsible for critical infrastructure and civil engineering projects. The group claims to have leaked 2,500 sensitive documents on a hacker forum. This claim, if true, represents ...

Dark Web News Analysis A threat actor on a known cybercrime forum is advertising the alleged leak of a database from Conasems (Conselho Nacional de Secretarias municipais de Saúde), Brazil’s National Council of Municipal Health Secretariats. This claim, if true, represents a critical, active data breach at the heart of ...