#threat-intelligence — Public Fediverse posts

🚨New ransom group blog posts!🚨

Group name: play
Post title: New Tec Tool Limited
Location: 🇨🇦 CA
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/play/New%20Tec%20Tool%20Limited

Group name: play
Post title: WSBI-ESBG
Organization: Walloon Society for Business and Industry – ESBG
Location: 🇧🇪 BE
Sector: Professional Services
Info: https://cti.fyi/#disclosure/play/WSBI-ESBG

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: play
Post title: Pure Options
Location: 🇺🇸 US
Sector: Financial Services
Info: https://cti.fyi/#disclosure/play/Pure%20Options

Group name: play
Post title: MicroSearch Corporation
Location: 🇺🇸 US
Sector: Technology
Info: https://cti.fyi/#disclosure/play/MicroSearch%20Corporation

Group name: Redact
Post title: ONEOK, Inc.
Location: 🇺🇸 US
Sector: Energy & Utilities
Info: https://cti.fyi/#disclosure/Redact/ONEOK%2C%20Inc.

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: titan
Post title: Grupo Hospifar S.R.L.
Location: 🇩🇴 DO
Sector: Healthcare
Info: https://cti.fyi/#disclosure/titan/Grupo%20Hospifar%20S.R.L.

Group name: titan
Post title: Sherman Chan, DDS, Inc.
Location: 🇺🇸 US
Sector: Healthcare
Info: https://cti.fyi/#disclosure/titan/Sherman%20Chan%2C%20DDS%2C%20Inc.

Group name: THE SEVEN DEADLY SINS
Post title: iHeartJane
Location: 🇺🇸 US
Sector: Technology
Info: https://cti.fyi/#disclosure/THE%20SEVEN%20DEADLY%20SINS/iHeartJane

Group name: THE SEVEN DEADLY SINS
Post title: Harness Inc.
Location: 🇺🇸 US
Sector: Technology
Info: https://cti.fyi/#disclosure/THE%20SEVEN%20DEADLY%20SINS/Harness%20Inc.

Group name: THE SEVEN DEADLY SINS
Post title: Verano Holdings
Location: 🇺🇸 US
Sector: Other
Info: https://cti.fyi/#disclosure/THE%20SEVEN%20DEADLY%20SINS/Verano%20Holdings

Group name: THE SEVEN DEADLY SINS
Post title: Hospital Sírio-Libanês
Organization: Hospital Sírio‑Libanês
Location: 🇧🇷 BR
Sector: Healthcare
Info: https://cti.fyi/#disclosure/THE%20SEVEN%20DEADLY%20SINS/Hospital%20S%C3%ADrio-Liban%C3%AAs

Group name: THE SEVEN DEADLY SINS
Post title: Canva
Location: 🇦🇺 AU
Sector: Technology
Info: https://cti.fyi/#disclosure/THE%20SEVEN%20DEADLY%20SINS/Canva

Group name: THE SEVEN DEADLY SINS
Post title: Globeia Inc.
Location: 🇨🇦 CA
Sector: Professional Services
Info: https://cti.fyi/#disclosure/THE%20SEVEN%20DEADLY%20SINS/Globeia%20Inc.

Group name: THE SEVEN DEADLY SINS
Post title: Cradlewise Inc.
Location: 🇺🇸 US
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/THE%20SEVEN%20DEADLY%20SINS/Cradlewise%20Inc.

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: bravox
Post title: Minkon 🇩🇪
Organization: Minkon International
Location: 🇩🇪 DE
Info: https://cti.fyi/#disclosure/bravox/Minkon%20%F0%9F%87%A9%F0%9F%87%AA

Group name: Vexy Ransomware
Post title: Data-Core Systems
Sector: Technology
Info: https://cti.fyi/#disclosure/Vexy%20Ransomware/Data-Core%20Systems

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: N0n
Post title: Company #29
Info: https://cti.fyi/#disclosure/N0n/Company%20%2329

Group name: N0n
Post title: Company #71
Info: https://cti.fyi/#disclosure/N0n/Company%20%2371

Group name: N0n
Post title: Company #72
Info: https://cti.fyi/#disclosure/N0n/Company%20%2372

Group name: N0n
Post title: Company #76
Info: https://cti.fyi/#disclosure/N0n/Company%20%2376

Group name: N0n
Post title: Company #77
Info: https://cti.fyi/#disclosure/N0n/Company%20%2377

Group name: N0n
Post title: Company #78
Info: https://cti.fyi/#disclosure/N0n/Company%20%2378

Group name: N0n
Post title: Company #79
Info: https://cti.fyi/#disclosure/N0n/Company%20%2379

Group name: N0n
Post title: Company #80
Info: https://cti.fyi/#disclosure/N0n/Company%20%2380

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: Redact
Post title: Parker-Hannifin Corporation
Location: 🇺🇸 US
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/Redact/Parker-Hannifin%20Corporation

Group name: Wallstreet
Post title: Girl Scouts of Eastern Massachusetts
Location: 🇺🇸 US
Sector: Education
Info: https://cti.fyi/#disclosure/Wallstreet/Girl%20Scouts%20of%20Eastern%20Massachusetts

Group name: N0n
Post title: BladeTech Inc
Location: 🇺🇸 US
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/N0n/BladeTech%20Inc

Group name: N0n
Post title: Xinos Construction Corp and its accounting group
Organization: Xinos Construction Corp
Location: 🇺🇸 US
Sector: Construction
Info: https://cti.fyi/#disclosure/N0n/Xinos%20Construction%20Corp%20and%20its%20accounting%20group

Group name: N0n
Post title: Company #83
Info: https://cti.fyi/#disclosure/N0n/Company%20%2383

Group name: N0n
Post title: Company #81
Info: https://cti.fyi/#disclosure/N0n/Company%20%2381

Group name: N0n
Post title: Company #82
Info: https://cti.fyi/#disclosure/N0n/Company%20%2382

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: N0n
Post title: EnVision Eye Care
Location: 🇺🇸 US
Sector: Healthcare
Info: https://cti.fyi/#disclosure/N0n/EnVision%20Eye%20Care

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: aurora
Post title: Adams Warehouse & Delivery, Inc.
Location: 🇺🇸 US
Sector: Other
Info: https://cti.fyi/#disclosure/aurora/Adams%20Warehouse%20%26%20Delivery%2C%20Inc.

#ransomware #cti #threatintelligence #cybersecurity #infosec

🆒 Cool new feature at Scan Malware:

You can now explore relationships between websites using interactive graph visualizations, with multiple layout options

This makes it easier to discover connections between malicious websites that share common indicators, even when they're one or two hops away

The feature is on the "Pivot" tab ➡ and click "Open in graph". Also useful in OSINT investigations

#CyberSecurity #ThreatIntelligence #MalwareAnalysis #OSINT #GraphVisualization #ThreatHunting #ScanMalware

🚨New ransom group blog post!🚨

Group name: qilin
Post title: Via Credit Union
Sector: Financial Services
Info: https://cti.fyi/#disclosure/qilin/Via%20Credit%20Union

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: N0n
Post title: Company #74
Info: https://cti.fyi/#disclosure/N0n/Company%20%2374

Group name: N0n
Post title: Company #75
Info: https://cti.fyi/#disclosure/N0n/Company%20%2375

#ransomware #cti #threatintelligence #cybersecurity #infosec

Cloudflare telemetry reveals Russian bot traffic swiftly migrated to alternative clouds following drone strikes on Yandex data center infrastructure.

#Cybersecurity #Cloudflare #ThreatIntelligence #Yandex #TechNews

https://securityonline.info/russian-bot-traffic-data-center-strikes/?utm_source=mastodon&utm_medium=jetpack_social

🚨New ransom group blog post!🚨

Group name: N0n
Post title: Evolution Spine / All Labs
Organization: Evolution Spine
Location: 🇺🇸 US
Sector: Healthcare
Info: https://cti.fyi/#disclosure/N0n/Evolution%20Spine%20%2F%20All%20Labs

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: incransom
Post title: verveba.com \ www.att.com
Organization: Verveba
Sector: Technology
Info: https://cti.fyi/#disclosure/incransom/verveba.com%20%5C%20www.att.com

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: incransom
Post title: fairfeelegalservices.com
Organization: Fair Fee Legal Services
Sector: Legal
Info: https://cti.fyi/#disclosure/incransom/fairfeelegalservices.com

Group name: incransom
Post title: nowaszkola.com
Organization: Nowa Szkoła
Location: 🇵🇱 PL
Sector: Education
Info: https://cti.fyi/#disclosure/incransom/nowaszkola.com

Group name: incransom
Post title: www.coopecaja.fi.cr
Organization: Coopecaja
Location: 🇨🇷 CR
Sector: Financial Services
Info: https://cti.fyi/#disclosure/incransom/www.coopecaja.fi.cr

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: qilin
Post title: Kemlows Diecasting Products Limited
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/qilin/Kemlows%20Diecasting%20Products%20Limited

Group name: qilin
Post title: Keio Corporation
Location: 🇯🇵 JP
Sector: Professional Services
Info: https://cti.fyi/#disclosure/qilin/Keio%20Corporation

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: Wallstreet
Post title: TGM Manufacturing, Inc
Info: https://cti.fyi/#disclosure/Wallstreet/TGM%20Manufacturing%2C%20Inc

Group name: qilin
Post title: Telcoe Federal Credit Union
Info: https://cti.fyi/#disclosure/qilin/Telcoe%20Federal%20Credit%20Union

Group name: qilin
Post title: The Excalibur Group
Info: https://cti.fyi/#disclosure/qilin/The%20Excalibur%20Group

Group name: qilin
Post title: Shield Wall Systems of Florida
Info: https://cti.fyi/#disclosure/qilin/Shield%20Wall%20Systems%20of%20Florida

Group name: qilin
Post title: Segres Systec
Info: https://cti.fyi/#disclosure/qilin/Segres%20Systec

Group name: qilin
Post title: KD Corp
Info: https://cti.fyi/#disclosure/qilin/KD%20Corp

Group name: qilin
Post title: Brame Telecom
Info: https://cti.fyi/#disclosure/qilin/Brame%20Telecom

Group name: qilin
Post title: Commune Du Tampon
Info: https://cti.fyi/#disclosure/qilin/Commune%20Du%20Tampon

Group name: qilin
Post title: Chattanooga Shooting Supplies
Info: https://cti.fyi/#disclosure/qilin/Chattanooga%20Shooting%20Supplies

Group name: qilin
Post title: HyperGen
Info: https://cti.fyi/#disclosure/qilin/HyperGen

Group name: qilin
Post title: Hocon Gas
Info: https://cti.fyi/#disclosure/qilin/Hocon%20Gas

#ransomware #cti #threatintelligence #cybersecurity #infosec

In GreyNoise data this week, a recurring pool of malicious IPs checked Microsoft Exchange servers for ProxyNotShell in passes no more than two days apart.

About a thousand malicious IPs ran the check on every odd-numbered day. Separately, attempts on a known exploited Metabase flaw stepped up more than threefold from 11 October.

GreyNoise customers get the full weekly brief, our public At The Edge Clear one-pager is below + 🔗 https://www.greynoise.io/resources/at-the-edge-clear-101226

#ThreatIntelligence #CyberSecurity #GreyNoise #InfoSec

October 2026: worst month yet for MCP security.

Langflow RCE (CVSS 9.9)
SSRF in the official MCP fetch server
Unauthenticated debugger on 0.0.0.0
Same SSRF found at Google, JPMorgan, 5 unpatched US federal servers

97M installs. No normative security requirements in the spec. 72.8% attack success rate in benchmarks.

Full breakdown: [https://blog.relayshield.net/mcp-server-attack-surface]

#MCP #AISecurity #ThreatIntelligence

🚨New ransom group blog posts!🚨

Group name: N0n
Post title: Company #73
Info: https://cti.fyi/#disclosure/N0n/Company%20%2373

Group name: N0n
Post title: Company #27
Info: https://cti.fyi/#disclosure/N0n/Company%20%2327

Group name: N0n
Post title: Company #70
Info: https://cti.fyi/#disclosure/N0n/Company%20%2370

Group name: 0x00
Post title: BienestarEmpresarial
Sector: Professional Services
Info: https://cti.fyi/#disclosure/0x00/BienestarEmpresarial

Group name: iah6477
Post title: hilmar-cheese
Organization: Hilmar Cheese
Location: 🇺🇸 US
Sector: Agriculture & Food
Info: https://cti.fyi/#disclosure/iah6477/hilmar-cheese

Group name: iah6477
Post title: trc-companies
Organization: CINDER
Info: https://cti.fyi/#disclosure/iah6477/trc-companies

Group name: iah6477
Post title: sunshine-mills
Organization: Sunshine Mills
Sector: Agriculture & Food
Info: https://cti.fyi/#disclosure/iah6477/sunshine-mills

Group name: iah6477
Post title: regencycenters
Organization: Regency Centers Group, Inc.
Location: 🇺🇸 US
Sector: Real Estate
Info: https://cti.fyi/#disclosure/iah6477/regencycenters

Group name: iah6477
Post title: middleby
Organization: Middleby Corporation
Location: 🇺🇸 US
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/iah6477/middleby

Group name: iah6477
Post title: mat-holdings-inc
Organization: MAT Holdings Inc
Location: 🇺🇸 US
Info: https://cti.fyi/#disclosure/iah6477/mat-holdings-inc

Group name: iah6477
Post title: hensley
Info: https://cti.fyi/#disclosure/iah6477/hensley

#ransomware #cti #threatintelligence #cybersecurity #infosec

5 years of data science at CrowdSec, told by Matthieu Mazzolini (Data Team Lead).

How do we count our network? Why do we run honeypots, and why only 30? Why are there canaries in our blocklists? And why does the team call malicious IPs "pokemons"? 🙂

An honest look behind our IP reputation, and at what our code really shows, from one of the people who builds it.

Read it here: https://www.crowdsec.net/blog/5-years-of-crowdsec-data-science-what-our-code-really-shows

#datascience #threatintelligence

🚨New ransom group blog posts!🚨

Group name: Vexy Ransomware
Post title: Enchanted Fine Jewellery
Info: https://cti.fyi/#disclosure/Vexy%20Ransomware/Enchanted%20Fine%20Jewellery

Group name: iah6477
Post title: camden-living
Info: https://cti.fyi/#disclosure/iah6477/camden-living

Group name: iah6477
Post title: buckle
Info: https://cti.fyi/#disclosure/iah6477/buckle

#ransomware #cti #threatintelligence #cybersecurity #infosec

Following recent arrests, impostors are attempting to hijack the ShinyHunters hacker group brand using a compromised cryptographic signing key.

#ShinyHunters #Cybercrime #ThreatIntelligence #Cybersecurity #InfoSec

https://meterpreter.org/shinyhunters-hacker-group-impostor-takeover/?utm_source=mastodon&utm_medium=jetpack_social

🚨New ransom group blog post!🚨

Group name: Emperador
Post title: MPI LTDA
Info: https://cti.fyi/#disclosure/Emperador/MPI%20LTDA

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: N0n
Post title: Company #66
Info: https://cti.fyi/#disclosure/N0n/Company%20%2366

Group name: N0n
Post title: Company #68
Info: https://cti.fyi/#disclosure/N0n/Company%20%2368

Group name: N0n
Post title: Company #67
Info: https://cti.fyi/#disclosure/N0n/Company%20%2367

Group name: N0n
Post title: Company #69
Info: https://cti.fyi/#disclosure/N0n/Company%20%2369

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: spacebears
Post title: Alma Center Servizi Medicali S.r.l.
Location: 🇮🇹 IT
Sector: Healthcare
Info: https://cti.fyi/#disclosure/spacebears/Alma%20Center%20Servizi%20Medicali%20S.r.l.

Group name: spacebears
Post title: Holistic Health Group, Inc. (d/b/a Suncrafted)
Organization: Holistic Health Group, Inc.
Location: 🇺🇸 US
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/spacebears/Holistic%20Health%20Group%2C%20Inc.%20%28d%2Fb%2Fa%20Suncrafted%29

Group name: Bavacai
Post title: BABAOAD
Organization: Junta de Andalucía
Location: 🇪🇸 ES
Sector: Government & Public Sector
Info: https://cti.fyi/#disclosure/Bavacai/BABAOAD

Group name: Bavacai
Post title: BAWARAA
Organization: Junta de Andalucía
Location: 🇪🇸 ES
Sector: Government & Public Sector
Info: https://cti.fyi/#disclosure/Bavacai/BAWARAA

Group name: Bavacai
Post title: BATAAAB
Organization: Juntadeandalucia
Location: 🇪🇸 ES
Sector: Government & Public Sector
Info: https://cti.fyi/#disclosure/Bavacai/BATAAAB

Group name: iah6477
Post title: alera
Location: 🇺🇸 US
Sector: Healthcare
Info: https://cti.fyi/#disclosure/iah6477/alera

#ransomware #cti #threatintelligence #cybersecurity #infosec

https://www.semperis.com/press-release/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families

#Ransomware #CyberSecurity #ThreatIntelligence #Semperis #InfoSec #PsychWarfare (3/3)

🚨New ransom group blog post!🚨

Group name: lockbit3
Post title: crinetics.com
Organization: Crinetics
Sector: Technology
Info: https://cti.fyi/#disclosure/lockbit3/crinetics.com

#ransomware #cti #threatintelligence #cybersecurity #infosec

If your Palo Alto management interface is internet-exposed, you might notice even more traffic on it today. But if that was your security posture, maybe you're fine with that.

Anyway this is exploited in the wild. Authenticated, so creds required.

https://ifin.network/t/cve-2026-0322-authenticated-rce-in-pan-os/903

#ThreatIntel #ThreatIntelligence #IFIN

🧊 Field CTO Sean Tufts breaks down a 𝗺𝗮𝗷𝗼𝗿 𝗰𝘆𝗯𝗲𝗿𝗮𝘁𝘁𝗮𝗰𝗸 𝘁𝗮𝗿𝗴𝗲𝘁𝗶𝗻𝗴 𝗮𝗻 𝗲𝘀𝘁𝗶𝗺𝗮𝘁𝗲𝗱 𝟯𝟬𝟬–𝟲𝟬𝟬 𝘀𝘂𝗽𝗲𝗿𝗺𝗮𝗿𝗸𝗲𝘁𝘀, where vulnerabilities in Copeland and Danfoss industrial controllers allowed attackers to manipulate refrigeration temperatures, potentially causing millions of dollars in spoiled food and waste.

Sean also explains how attackers exploited firmware vulnerabilities to gain remote code execution, and how 𝗔𝗜 𝗶𝘀 𝗮𝗰𝗰𝗲𝗹𝗲𝗿𝗮𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗽𝗮𝘁𝗵 𝗳𝗿𝗼𝗺 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗱𝗶𝘀𝗰𝗼𝘃𝗲𝗿𝘆 𝘁𝗼 𝗲𝘅𝗽𝗹𝗼𝗶𝘁𝗮𝘁𝗶𝗼𝗻.

🔎 Read #Team82’s newest research here: https://claroty.com/team82/research/firmware-to-root-in-30-minutes-how-ai-is-changing-threat-intelligence

#Cybersecurity #OTSecurity #IndustrialCybersecurity #AI #ThreatIntelligence #CPSecurity #CyberResilience

🚨New ransom group blog posts!🚨

Group name: N0n
Post title: Interior Technologies
Location: 🇺🇸 US
Sector: Technology
Info: https://cti.fyi/#disclosure/N0n/Interior%20Technologies

Group name: lockbit3
Post title: bnpmedia.com
Organization: BNP Media
Location: 🇺🇸 US
Sector: Media & Entertainment
Info: https://cti.fyi/#disclosure/lockbit3/bnpmedia.com

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog posts!🚨

Group name: kairos
Post title: Oceania Digital Communications
Location: 🇻🇺 VU
Sector: Technology
Info: https://cti.fyi/#disclosure/kairos/Oceania%20Digital%20Communications

Group name: Eclipse
Post title: Taiwan Otsuka Pharmaceutical
Location: 🇹🇼 TW
Sector: Healthcare
Info: https://cti.fyi/#disclosure/Eclipse/Taiwan%20Otsuka%20Pharmaceutical

Group name: HYFLOCK
Post title: merkezilac_archives leaks
Organization: Merkez İlaç
Location: 🇹🇷 TR
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/HYFLOCK/merkezilac_archives%20leaks

Group name: HYFLOCK
Post title: Ecuador police headquarters leak
Organization: Policía Nacional del Ecuador
Location: 🇪🇨 EC
Sector: Government & Public Sector
Info: https://cti.fyi/#disclosure/HYFLOCK/Ecuador%20police%20headquarters%20leak

Group name: HYFLOCK
Post title: tdotnet
Organization: T Dot Net
Location: 🇧🇩 BD
Sector: Telecommunications
Info: https://cti.fyi/#disclosure/HYFLOCK/tdotnet

Group name: HYFLOCK
Post title: ocean beverages leaks
Organization: Ocean Beverages
Location: 🇮🇳 IN
Sector: Agriculture & Food
Info: https://cti.fyi/#disclosure/HYFLOCK/ocean%20beverages%20leaks

Group name: HYFLOCK
Post title: IGPL Leaks
Organization: IGPL
Location: 🇮🇳 IN
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/HYFLOCK/IGPL%20Leaks

Group name: HYFLOCK
Post title: nodhom.com leaks
Organization: Nodhom
Location: 🇸🇦 SA
Sector: Technology
Info: https://cti.fyi/#disclosure/HYFLOCK/nodhom.com%20leaks

Group name: HYFLOCK
Post title: Cooper Tec Solutions
Location: 🇧🇷 BR
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/HYFLOCK/Cooper%20Tec%20Solutions

Group name: HYFLOCK
Post title: YYC Advisors
Location: 🇲🇾 MY
Sector: Professional Services
Info: https://cti.fyi/#disclosure/HYFLOCK/YYC%20Advisors

#ransomware #cti #threatintelligence #cybersecurity #infosec

📈 Malicious domains sponsored by Nameslink (Hong Kong) Private Limited increased 776% from 3,643 to 31,914 in 30 days – it’s now #1 on our list of registrars associated with malicious domains.

🌐 See the full statistics here:
https://www.spamhaus.org/reputation-statistics/registrars/domains/

#ThreatIntelligence #CyberSecurity #DNS #DomainAbuse

An Ivanti 0-day auth bypass is being exploited in the wild with significant post-exploitation activity.

https://ifin.network/t/cve-2026-104935-ivanti-connect-secure-auth-bypass-exploited-for-privilege-escalation-code-execution/900

#ThreatIntel #ThreatIntelligence #IFIN

🚨New ransom group blog posts!🚨

Group name: incransom
Post title: Wolf & Sofsky GmbH
Location: 🇩🇪 DE
Sector: Construction
Info: https://cti.fyi/#disclosure/incransom/Wolf%20%26%20Sofsky%20GmbH

Group name: AuditTeam
Post title: Sa***ge
Location: 🇬🇧 None
Info: https://cti.fyi/#disclosure/AuditTeam/Sa%2A%2A%2Age

Group name: AuditTeam
Post title: Ze***ce
Location: 🇮🇹 IT
Info: https://cti.fyi/#disclosure/AuditTeam/Ze%2A%2A%2Ace

Group name: AuditTeam
Post title: AD***ed
Location: 🇬🇧 GB
Info: https://cti.fyi/#disclosure/AuditTeam/AD%2A%2A%2Aed

Group name: Vexy Ransomware
Post title: Guarufilme
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/Vexy%20Ransomware/Guarufilme

Group name: N0n
Post title: Company #63
Location: 🇺🇸 US
Sector: Professional Services
Info: https://cti.fyi/#disclosure/N0n/Company%20%2363

#ransomware #cti #threatintelligence #cybersecurity #infosec

I just pushed a new misp-module to support PTR classification on hostname and IP addresses in MISP.

🔗 MISP modules available https://www.misp-project.org/modules/
🖇️ ptrclassify library https://github.com/adulau/ptrclassify

@misp

#cti #threatintel #threatintelligence #cybersecurity