Nostr notes by Dark Web Informer :verified_paw:

🚨 Suspected hardware implant found inside Trezor Safe 5 wallet ...

2026-10-30T15:04:25Z

🚨 Suspected hardware implant found inside Trezor Safe 5 wallet

Trezor is warning customers after receiving a credible report of an extra circuit board inside a Safe 5 purchased from former authorized reseller CryptoBilis through Tokopedia.

The suspected implant reportedly sits between the wallet’s main board and screen, allowing it to capture displayed information, including the recovery phrase, and transmit it over a mobile network when connected.
⠀
Trezor has not yet received or examined the device. No customer funds have been reported stolen, and four other CryptoBilis devices inspected by the company showed no signs of tampering.

Anyone who purchased any Trezor model supplied by CryptoBilis from March 2026 onward should:

• Move funds to a newly created wallet
• Generate a completely new recovery phrase
• Never restore the potentially exposed phrase on another device
• Keep the original device and contact Trezor Support for a replacement

Source: https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being ...

2026-10-27T16:29:45Z

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks

CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
⠀
Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk.
⠀
Both vulnerabilities have a CVSS 4.0 score of 9.2.

Fixed versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
⠀
CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29.

The PHP team says there are no complete mitigations and that updating is the only safe solution.

Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

A user on Dread is promoting Dark Empire RPG, a browser-based ...

2026-10-26T18:34:53Z

A user on Dread is promoting Dark Empire RPG, a browser-based multiplayer cyberpunk RPG built with PHP, HTML/CSS and Python. The game features a marketplace, crafting, guilds, territory wars and law-enforcement career paths.

Dread Announcement: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/bc7cbb5e64f166778e4c

Dark Web: http://kd67wsybyev4mxqbizgw2hizs76jezqgc5eea5b6k7ftccfc65qeibid[.]onion/

🚨 Crimeflare releases emergency WAF rules for critical Brotli ...

2026-10-26T17:19:30Z

🚨 Crimeflare releases emergency WAF rules for critical Brotli vulnerability

Crimeflare has added two detection rules for CVE-2026-111497 to its Managed Ruleset, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint.
⠀
The vulnerability is an out-of-bounds write in the Brotli decoder. Malformed compressed input can corrupt process memory, potentially causing crashes, memory disclosure or remote code execution.

It affects software that uses vulnerable Brotli versions, including supported Node.js 22.x, 24.x and 26.x releases.
⠀
Crimeflare’s new rules are enabled by default in Log mode. They provide visibility into matching requests but do not block them unless customers change the action.

Crimeflare warns that blocking the Next.js rule may disrupt image delivery and recommends reviewing matches before enabling enforcement.
⠀
Node.js users should update to:

• 22.23.4
• 24.22.1
• 26.12.1

The WAF rules are an additional mitigation, not a replacement for patching.

Source: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release

🚨 Aesthetic infostealer source code shared on a forum The ...

2026-10-23T16:28:14Z

🚨 Aesthetic infostealer source code shared on a forum

The actor "procurator" has shared what is described as the source code for Aesthetic, a Windows infostealer with remote access capabilities, a web-based control panel, and a built-in payload builder.

The malware reportedly targets Chromium and Firefox browsers, cryptocurrency wallets, messaging apps, gaming accounts, and developer tools. It also claims support for bypassing Chrome's App-Bound Encryption.

Aesthetic includes persistent remote access, screen and webcam monitoring, keylogging, file management, and remote command execution. Its control panel is built using Flask and SQLite, with subscription-based access.

The source code and advertised capabilities have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Ready for my YouTube year in review Ready for my Spotify year in ...

2026-10-22T21:04:45Z

Ready for my YouTube year in review

Ready for my Spotify year in review

Ready for my Netflix year in review

Ready for my Instagram year in review

Ready for my TikTok year in review

Ready for my X year in review

Ready for my Reddit year in review

Ready for my Discord year in review

Ready for my Twitch year in review

Ready for my Steam year in review

Ready for my PlayStation year in review

Ready for my Xbox year in review

Ready for my Nintendo year in review

Ready for my Amazon year in review

Ready for my Google year in review

Ready for my Apple year in review

Ready for my Microsoft year in review

Ready for my Snapchat year in review

Ready for my Facebook year in review

Ready for my LinkedIn year in review

Ready for my Uber year in review

Ready for my DoorDash year in review

Ready for my Airbnb year in review

Ready for my PayPal year in review

Ready for my Venmo year in review

Ready for my Duolingo year in review

Ready for my ChatGPT year in review

Ready for my GitHub year in review

Ready for my Cloudflare year in review

Ready for my Wikipedia year in review

Ready for my FBI watchlist year in review 😬

Ready for my therapist's year in review

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to ...

2026-10-22T20:01:31Z

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution

PoC: https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-

Passed the security audit. ...

2026-10-22T19:13:49Z

Passed the security audit.

🚨 Two critical Linux KSMBD remote code execution flaws ...

2026-10-22T18:51:18Z

🚨 Two critical Linux KSMBD remote code execution flaws disclosed before fixes were available

The vulnerabilities, tracked as ZDI-CAN-33774 and ZDI-CAN-33549, both carry CVSS scores of 9.0 and affect KSMBD, the Linux kernel’s built-in SMB server.
⠀
ZDI-CAN-33774 can reportedly be triggered without authentication against systems running KSMBD on port 445.

ZDI-CAN-33549 affects the SMB Direct path and requires an RDMA-capable interface, a writable KSMBD share and a client using SMB Direct.
⠀
Neither vulnerability currently has a CVE identifier. As of October 22, fixes had not been added to the mainline Linux kernel or linux-next.

Administrators should determine whether KSMBD is active and consider restricting network access until fixes become available.

A look at critical PHP vulnerabilities from a darknet forum ...

2026-10-21T19:44:22Z

A look at critical PHP vulnerabilities from a darknet forum operator's perspective, revealing just how quickly new exploits are turning into real-world threats.

Dread Thread: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/14d9b2557ae62186394e

Bro Said Real Devs Don’t Use PHP, Then Got Hit With a $90,000 ...

2026-10-21T16:22:40Z

Bro Said Real Devs Don’t Use PHP, Then Got Hit With a $90,000 Reality Check

🚨🇦🇪 Dubai International Financial Centre (DIFC) ...

2026-10-21T15:51:22Z

🚨🇦🇪 Dubai International Financial Centre (DIFC) allegedly breached, with $5 million ransom demanded

The "Reze" ransomware group, alongside "BBK", claims to have compromised DIFC, a major financial hub in Dubai, UAE.

The actors claim to have obtained approximately 200 GB of data, including 432,178 email addresses, 324,239 phone numbers, 391,382 names, 37,352 passport records, Emirates ID information, and thousands of internal documents.

The group has published samples and is demanding $5 million, giving DIFC 10 days to respond.

Claim is currently unverified.

Note: This alert was captured before this forum went down due to PHP2Shell.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Discord mass-reporting tool shared on a forum An actor known ...

2026-10-20T15:36:05Z

🚨 Discord mass-reporting tool shared on a forum

An actor known as "WrlBreach" has shared a Python-based tool called "Discord Mass Reporter," designed to automate large numbers of reports against Discord messages.
⠀
The tool reportedly supports reporting categories such as harassment, spam, phishing, illegal content, and other policy violations.
⠀
The archive contains a Python script, README, and dependencies. It has only undergone static analysis, and its functionality has not been verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 ...

2026-10-18T18:21:55Z

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty.

Write-up: https://samchen.blog/blog/vscode-nested-form-to-rce

🚨🇧🇷 $470,000 shipment of RTX 5090 graphics cards goes ...

2026-10-18T17:37:04Z

🚨🇧🇷 $470,000 shipment of RTX 5090 graphics cards goes missing at Brazilian airport

Brazilian technology distributor Oderço says two pallets of Zotac GeForce RTX 5090 GPUs disappeared after reportedly arriving at São Paulo’s Guarulhos International Airport.
⠀
The company valued the shipment at R$2.5 million, approximately $470,000, based on its acquisition cost.

Oderço said it has sought information about the shipment but received no official explanation. The distributor described the incident as unprecedented in its 38-year history.
⠀
The number of missing graphics cards remains unknown. No arrival date, tracking information or other shipment records have been made public.

Authorities have not confirmed that the shipment was stolen, and the circumstances of its disappearance remain unclear.

Source: https://www.tomshardware.com/pc-components/gpus/nvidia-rtx-5090-shipment-worth-usd470-000-goes-missing-in-brazilian-airport-two-pallets-disappear-distributor-seeks-explanations-but-met-with-zero-answers

I have added 8 new incidents to the Physical Bitcoin Attacks ...

2026-10-16T19:16:31Z

I have added 8 new incidents to the Physical Bitcoin Attacks page. Be safe.

https://darkwebinformer.com/physical-bitcoin-attacks/

🚨 Ledger Wallet zero-day exploit advertised for $2,000, claims ...

2026-10-16T15:17:40Z

🚨 Ledger Wallet zero-day exploit advertised for $2,000, claims to steal wallet recovery information

An actor known as "work159" is advertising what they claim is a zero-day exploit targeting the Ledger Wallet desktop application on Windows and macOS.
⠀
The seller claims the exploit can display a fake wallet recovery process directly inside the legitimate application, rather than redirecting victims to an external phishing website.
⠀
According to the listing, the attack requires just one click, with no further user interaction needed.
⠀
The advertised capabilities include:

• Custom phishing overlays displayed inside Ledger Wallet
• Fake wallet recovery screens
• Support for Windows and macOS
• Exfiltration of private keys to a Telegram bot
• Integration into existing Ledger Wallet interface pages
⠀
The seller also claims to provide unobfuscated source code and customizable templates. The asking price has been reduced from $7,500 to $2,000.
⠀
No working demonstration or technical evidence confirming the claimed zero-day vulnerability was included in the visible listing.
⠀
The exploit's existence and capabilities remain unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 Giant Food websites taken offline after ...

2026-10-12T20:08:54Z

🚨🇺🇸 Giant Food websites taken offline after cybersecurity incident at parent company Ahold Delhaize

Websites for The GIANT Company, Giant Food, Food Lion, Hannaford and Stop & Shop were taken offline after Ahold Delhaize detected a security issue within its network.

Online grocery ordering and deliveries have been disrupted while systems are kept offline as a precaution. The company’s physical stores remain open and continue serving customers.
⠀
The incident is also affecting several European Ahold Delhaize brands, including Albert Heijn, Etos, Gall & Gall and Delhaize.

Ahold Delhaize has not disclosed how its network was compromised, identified an attacker or confirmed whether any data was stolen. There is currently no estimated restoration time.

Source: https://lancasteronline.com/news/local/giants-website-taken-down-following-cyber-attack-on-parent-company/article_808bae86-cb7b-41f5-8b1d-8c006c65e569.html

‼️🇩🇪 Black X ransomware names Bayer Bayer is a German ...

2026-10-09T23:43:27Z

‼️🇩🇪 Black X ransomware names Bayer

Bayer is a German multinational life sciences company specializing in pharmaceuticals, consumer healthcare products, and agricultural solutions.

🚨🇯🇵 enTouch Administrator Access Offered for Sale for ...

2026-10-09T14:52:13Z

🚨🇯🇵 enTouch Administrator Access Offered for Sale for $90

An actor is selling administrator access to enTouch, a Japanese healthcare technology company that connects pharmaceutical and medical device companies with healthcare professionals.

The seller claims access to 45,572 doctor records, 6,003 user accounts, and 33,010 online meeting records, including attendee passwords.

The database also reportedly contains 18,714 survey responses and 15,801 medical representative activity reports.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 🇺🇸 Empire Market co-creator sentenced to 40 years for ...

2026-10-08T17:36:16Z

🚨 🇺🇸 Empire Market co-creator sentenced to 40 years for operating $430 million dark web marketplace

Raheim Hamilton, 30, also known online as “Sydney” and “ZeroAngel,” has been sentenced to 40 years in federal prison and fined $5 million.

Hamilton and co-creator Thomas Pavey operated Empire Market from 2018 until its shutdown in 2020.

At its peak, the marketplace had approximately 1.68 million registered users, including more than 5,000 vendors and nearly 360,000 buyers.

More than four million transactions worth over $430 million were completed through the marketplace.

Drug sales accounted for nearly $375 million, while vendors also sold stolen credentials, personal information, counterfeit currency and hacking tools.

Hamilton pleaded guilty earlier this year to a federal drug conspiracy charge. He also agreed to forfeit approximately 1,230 bitcoin, 24.4 Ether and three properties in Virginia.

Pavey has also pleaded guilty and is scheduled to be sentenced later this month.

Source: https://www.justice.gov/usao-ndil/pr/co-creator-dark-web-marketplace-sentenced-40-years-federal-prison

🚨 New Ransomware Group: SCARLETTGROUP Dark Web: ...

2026-10-07T16:34:53Z

🚨 New Ransomware Group: SCARLETTGROUP

Dark Web: http://scarlettgugldabhgz3uertpnxglxytddxbd5vnoma5pihfk6k5q2sid[.]onion/

Forum claim: https://x.com/DarkWebInformer/status/2107862989701316939

🚨 Windows 11 Zero-Day LPE and Pre-Auth RCE Exploits Offered ...

2026-10-06T17:19:45Z

🚨 Windows 11 Zero-Day LPE and Pre-Auth RCE Exploits Offered for Sale

A forum actor is advertising an alleged Windows 11 zero-day local privilege escalation exploit claimed to work across all versions.

The seller also claims to have pre-auth RCE exploits for Ivanti Connect Secure SSLVPN and Zimbra, along with an RCE exploit targeting Switchvox SMB.

Pricing is negotiable, with transactions offered through escrow.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Teenagers suspected of leading ransomware group arrested in ...

2026-10-01T14:57:19Z

🚨 Teenagers suspected of leading ransomware group arrested in international operation

Authorities from nine countries have disrupted KillSec, a ransomware group linked to almost 1,000 attacks worldwide.
⠀
A 16-year-old is suspected of serving as the group’s administrator and main operator.

Another suspected developer recently turned 18 and was a minor during several of the alleged offenses.
⠀
The operation resulted in:

• Three arrests
• Eight searches in Spain, Greece, the UK and Romania
• Five servers seized
• KillSec-operated domains seized
• At least 110 TB of stolen data secured
⠀
KillSec allegedly exploited poorly secured access points, particularly cloud storage, to steal sensitive data.

Victims were threatened with publication unless they paid a ransom.

The investigation remains ongoing.

Source: https://www.eurojust.europa.eu/news/teenagers-suspected-leading-ransomware-group-arrested-during-international-operation

🚨 Akuma Stealer Advertised With Free 3-Day Trial A new ...

2026-09-30T15:48:51Z

🚨 Akuma Stealer Advertised With Free 3-Day Trial

A new information-stealing malware called Akuma Stealer is being advertised on a forum, with the developer offering a free three-day trial.

The seller claims the malware has been in development for more than a year and is primarily written in C, with additional C++ and Assembly components.

According to the listing, Akuma Stealer is designed to collect browser data, cryptocurrency wallet information, password manager data, 2FA-related information, VPN credentials, corporate and cloud access details, messaging data, gaming accounts, system information, and screenshots.

The developer also claims the stealer includes anti-analysis, anti-VM, persistence, obfuscation, and geographic blocking features, while marketing it as capable of evading several major antivirus and EDR products.

Pricing starts at $49.99 for seven days, with lifetime access listed at $1,499.99.

These claims have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇧🇷 Vakinha Dataset Allegedly Leaked After Ransom Demand ...

2026-09-28T23:27:45Z

🚨🇧🇷 Vakinha Dataset Allegedly Leaked After Ransom Demand

A dataset allegedly belonging to Brazilian crowdfunding platform Vakinha has been shared on a forum after the actor claimed a ransom was not paid.

The post claims the dataset contains approximately 18 million records and includes donor and recipient information.

According to the actor, exposed fields include names, email addresses, phone numbers, CPF numbers, IP addresses, payment methods, transaction values, campaign information, and other account-related data.

A sample of the purported data was included in the post, which lists the material as dating from July 2026.

These claims have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 ShinyHunters 104[.]192[.]2[.]46 ASN: 27176 Org: DataWagon ...

2026-09-28T16:31:34Z

🚨 ShinyHunters

104[.]192[.]2[.]46
ASN: 27176
Org: DataWagon LLC

🚨 Companies are being urged to shut down their NetScaler ...

2026-09-26T17:41:28Z

🚨 Companies are being urged to shut down their NetScaler instances immediately due to multiple unpatched Citrix NetScaler RCE vulnerabilities.

Source: https://x.com/watchtowrcyber/status/2103891689857228803

Added 1 new incident to the Physical Bitcoin Attacks page. ...

2026-09-25T17:58:05Z

Added 1 new incident to the Physical Bitcoin Attacks page.

https://darkwebinformer.com/physical-bitcoin-attacks/

🚨 🇮🇳 Data allegedly related to India’s Astra missile ...

2026-09-25T16:25:56Z

🚨 🇮🇳 Data allegedly related to India’s Astra missile program offered for sale
⠀
The Astra is an air-to-air missile developed by India’s Defence Research and Development Organisation (DRDO).
⠀
The actor "0x4ziz" is offering a 1 GB collection for $800. The advertised material allegedly includes:
⠀
• Astra Mk-1 documents
• Computer and account information
• Contacts and deal records
• Passports and other identity documents
⠀
The actor shared screenshots as purported proof but did not disclose how the material was obtained. The post does not establish that DRDO systems were breached.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️[POC] CVE-2026-94127: When a BIG-IP APM access policy and ...

2026-09-24T19:41:58Z

‼️[POC] CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)

GitHub: https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127/

‼️🇺🇸 An actor claims to be offering full GitHub ...

2026-09-23T18:02:49Z

‼️🇺🇸 An actor claims to be offering full GitHub organization access for Pfizer, including internal repositories, source code, and developer infrastructure.

🚨 Windows password and PIN sniffer tool shared on a forum ⠀ ...

2026-09-23T16:04:39Z

🚨 Windows password and PIN sniffer tool shared on a forum
⠀
An actor using the handle "Apollinaris" is distributing a tool advertised as capturing local Windows user and administrator passwords or PINs.
⠀
The screenshots show a Windows Update impersonation prompt asking the victim to enter credentials to approve a supposed Wi-Fi driver update.
⠀
The actor provides separate password and PIN versions and claims compatibility with remote access tools. The screenshots demonstrate the credential prompts, but do not establish successful credential capture.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️🇩🇪 ShinyHunters names a German healthcare company ...

2026-09-22T23:04:17Z

‼️🇩🇪 ShinyHunters names a German healthcare company

🇩🇪 Fresenius Medical Care - A Germany-headquartered healthcare company specializing in dialysis products, services, and treatments for people with kidney disease.

Nostr event nevent1qqs2hx7m9xy6nxr9vsr3rw20utx9vstpvx0mrk80wk7adaqm8xfmsuqzyp6998arezklyrtnar3y25mv2e3akgq9xlusvcwhjlz0e2urj3vaw4h57t3

2026-09-22T22:46:44Z

Lul

‼️ ShinyHunters has shared a message on their pay or leak ...

2026-09-22T17:27:22Z

‼️ ShinyHunters has shared a message on their pay or leak portal to Director Brett Leatherman of the FBI Cyber Division and Director Kash Patel of the FBI:

"Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI,

During Quarter Two of this year the Federal Bureau of Investigation (FBI) made substantial false allegations regarding our organisation in a FLASH report. We have been severely offended.

We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to "disrupt" our operations, an effort that ultimately proved unsuccessful.

For us to properly address and correct these unfounded allegations, we were compelled to adopt a forceful and assertive posture to ensure our response was fully acknowledged. This PSA today does just that.

Our PSA today works to address these allegations and correct them.

We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job. Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medlink, and more.

We are willing to allow you a time of 1 week to correct or simply REMOVE the 2026 Quarter 2 FLASH report on us that includes several FALSE allegations:

- "Threat actors often use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims. "
- "To exert pressure on victims[1], SH actors commonly use harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting"
- " Threat actors may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist."

We wish to state unequivocally our threats and claims are very real. Not exaggerated and never a bluff. This PSA today is living evidence of that.
We wish to state unequivocally we have NEVER conducted swatting attacks against corporate victims personnel nor have we ever texted victims personnel family members any threats.
We wish to state unequivocally we have NEVER claimed to have sensitive or compromising information, including embarrassing photographs and videos of victims. WE ARE NOT SEXTORTIONISTS.

Finally, we wish to STATE UNEQUIVOCALLY we are NOT apart of "The Com". We have NEVER been apart of "The Com". "The Com" is a propaganda started by the Information Security Industry which has brainwashed past FBI and DOJ officials into formalising this nonsense.

As a big believer and supporter of the U.S. Constitution - we are exercising the First Amendment and actively combating disinformation. This is not a ransom, coercion, or extortion. Your federal policies do not apply here. This PSA is NOT financially motivated.

We recognise that certain statements within your FLASH report appear to stem from biased public reporting by certain journalists who have previously and intentionally propagated false narratives about our organisation in an attempt to "disrupt" our operations and hinder clients trust in our organisation hoping nobody pays us. Should those certain journalists and you know very well who you are, continue these unwarranted attacks and defamatory statements, we will be forced to respond in a civil manner with a commensurate and forceful defence of our reputation. As any human being would do.

We welcome any and all journalists to inquire us at shinygroup@onionmail.com to hear our side of the story.

Make the right decision, don't be the next headline.

Thank you for your attention to this matter. -SH"

Interesting way to launder 💸 ...

2026-09-20T22:57:48Z

Interesting way to launder 💸

‼️ ShinyHunters has a message for Cl0p ransomware after ...

2026-09-19T23:42:43Z

In reply to nevent1q…u3hx
_________________________

‼️ ShinyHunters has a message for Cl0p ransomware after hacking and defacing Cl0p's DLS earlier today.

"Email us from your official email at shinygroup@onionmail.com and lets see how rich you really are. 2.333% of my networth is a 8 figure amount, I hope you can pay that much because that is the demand, negotiable. Get your bosses in front of the white board in the war room. Clock is ticking moron. Kindly excuse our unprofessionalism."

‼️ ShinyHunters defaced the Cl0p Ransomware site ...

2026-09-19T16:09:09Z

‼️ ShinyHunters defaced the Cl0p Ransomware site

http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad[.]onion/

Dread user looking for a "US or EU citizen for marriage" ...

2026-09-13T23:40:54Z

Dread user looking for a "US or EU citizen for marriage" 🫡

https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/d5f0f031d14d431dca5d

‼️ A forum actor is seeking to purchase a Claude AI account ...

2026-09-07T16:35:59Z

‼️ A forum actor is seeking to purchase a Claude AI account that has the Mythos feature enabled, requesting sellers to provide price and account details via private message.

🚨🇪🇸 Spain SIPS energy supply dataset allegedly leaked, ...

2026-09-06T15:53:47Z

🚨🇪🇸 Spain SIPS energy supply dataset allegedly leaked, 40M+ CUPS records claimed
⠀
SIPS (Sistema de Información de Puntos de Suministro), Spain’s electricity and gas supply-point information system, is named in a cybercrime forum post where a threat actor claims to have obtained a full dataset covering more than 40 million CUPS records.
⠀
Claimed exposure
⠀
• Customer names and NIF/CIF identifiers
• Dates of birth and customer addresses
• CUPS supply-point identifiers
• Electricity and gas supply information
• Supply addresses and municipalities
• Distribution companies and tariffs
• Contracted power and voltage data
• Meter information and access rights
• Consumption profiles and billing frequency
• Annual energy consumption figures
• Meter readings and BIE-related dates
⠀
The actor describes the dataset as fresh and claims it contains detailed information associated with electricity and gas supply points throughout Spain.
⠀
A sample record containing personal, address and supply information was also published in the forum post.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ Exploit disclosed for CVE-2026-52924... 9.8 CVSS Linux ...

2026-09-04T17:05:45Z

‼️ Exploit disclosed for CVE-2026-52924... 9.8 CVSS Linux Root Privilege Escalation

GitHub: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/

Nostr event nevent1qqst6ss6wgw90ugy0d476sp6zdwd6matrgdgywa5sdudxa6quj7dw9szyp6998arezklyrtnar3y25mv2e3akgq9xlusvcwhjlz0e2urj3vawq340af

2026-09-03T16:08:35Z

Need.

‼️ Security researcher Nightmare Eclipse has released a new ...

2026-09-03T13:14:56Z

‼️ Security researcher Nightmare Eclipse has released a new zero-day called FalconFlank, a CrowdStrike Falcon local privilege escalation (LPE) vulnerability.

GitHub: https://github.com/MSNightmare/FalconFlank

‼️ A forum actor claims to represent an experienced pentester ...

2026-08-11T17:26:58Z

‼️ A forum actor claims to represent an experienced pentester team seeking ongoing partnerships with suppliers of initial access, specifying revenue thresholds for Tier1 (10M+) and Tier2 (100M+) targets.

Windows is the only landlord that charges rent, installs a ...

2026-07-20T17:39:21Z

Windows is the only landlord that charges rent, installs a billboard in your living room, and calls it a feature.

‼️ Telegram's t[.]me domain is down with WHOIS now ...

2026-07-13T20:44:25Z

‼️ Telegram's t[.]me domain is down with WHOIS now showing a "serverHold" status which is a registry-level suspension that stops the domain from resolving entirely.

All t[.]me links are currently broken. The app itself still works, but link sharing is toast until this gets lifted. 🤣

How hackers pivot after initial access ...

2026-06-29T18:27:58Z

How hackers pivot after initial access

Priorities: save the codebase, then yourself. ...

2026-06-28T17:16:22Z

Priorities: save the codebase, then yourself.

‼️🇨🇳 Root RCE and full admin panel access to a Chinese ...

2026-02-10T22:13:52Z

‼️🇨🇳 Root RCE and full admin panel access to a Chinese agentic AI edge-as-a-service (EaaS) corporation is being sold for $200. The target runs Linux with firewall device access.

‼️🇺🇸 Polycom now by the name Poly Inc. has fallen ...

2026-02-01T22:50:11Z

‼️🇺🇸 Polycom now by the name Poly Inc. has fallen victim to Everest Ransomware

Allegedly 90 GB of data stolen

Revenue: $1.73 Billion (FY, 2021)

Beware of cat ...

2026-02-01T21:26:48Z

Beware of cat

❗️Chronomaly: Android kernel exploit for CVE-2025-38352, ...

2026-01-12T17:52:24Z

❗️Chronomaly: Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable Linux kernels v5.10.x.

GitHub: https://github.com/farazsth98/chronomaly

X suspended Twitter. 😭 ...

2026-01-11T23:02:59Z

X suspended Twitter. 😭

Nostr event nevent1qqsf7xsv8nf74k7kvhzk6ayfc7hr3tw5yle6nyr59q6fk26va3p2gaczyp6998arezklyrtnar3y25mv2e3akgq9xlusvcwhjlz0e2urj3vawgwpyf8

2026-01-03T23:59:04Z

😂

📰Tor is upgrading its relay encryption with a new algorithm ...

2025-11-25T00:12:33Z

📰Tor is upgrading its relay encryption with a new algorithm called Counter Galois Onion (CGO). CGO prevents tampering, adds forward secrecy, and brings Tor’s encryption up to modern security standards.

https://blog.torproject.org/introducing-cgo/

Expectation vs Reality ...

2025-10-07T18:22:55Z

Expectation vs Reality

🔥Disable Javascript: Full Technical Explanation with Examples, ...

2025-10-01T17:12:13Z

🔥Disable Javascript: Full Technical Explanation with Examples, Proof, Why & How JS NEGATIVELY Affects Your Security

Dread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/b5e83a29b2217a21a0dd

Note: This is a good read, but very long.

Nostr event nevent1qqsxa9s9xnkytsgw7ya05r2dd9kzlgpvdwtjjn88nd6furpnxsplhsszyp6998arezklyrtnar3y25mv2e3akgq9xlusvcwhjlz0e2urj3vaw9g2kvq

2025-09-23T15:40:58Z

In reply to nevent1q…apnz
_________________________

🚨The U.S. Secret Service uncovered and shut down a hidden ...

2025-09-23T15:40:45Z

🚨The U.S. Secret Service uncovered and shut down a hidden network of devices across the New York tri-state area. The setup included more than 300 SIM servers and over 100,000 SIM cards, spread out in multiple locations. Investigators say it was being used to make threats against senior government officials.

But it went beyond just phone calls. The equipment could disrupt cell towers, block communications through denial-of-service attacks, and give criminals or foreign agents a way to talk secretly without being traced. Early findings suggest that some of the activity involved contacts between nation-state actors and people already on law enforcement’s radar.

The discovery came at a tense moment, just miles from where world leaders are gathering for the U.N. General Assembly in New York. Officials moved quickly to dismantle the threat, and the investigation is still underway with help from federal, state, and local partners.

Source: https://www.secretservice.gov/newsroom/releases/2025/09/us-secret-service-dismantles-imminent-telecommunications-threat-new-york

Linux Networking Commands Credit: sysxplore.com ...

2025-09-21T23:57:26Z

Linux Networking Commands

Credit: sysxplore.com

SIGIT: Simple Information Gathering Toolkit GitHub: ...

2025-07-22T20:52:08Z

SIGIT: Simple Information Gathering Toolkit

GitHub: https://github.com/termuxhackers-id/SIGIT

🚨🇺🇸Alleged Sale of 51M User Data from Social Security ...

2025-06-09T18:13:58Z

🚨🇺🇸Alleged Sale of 51M User Data from Social Security Administration

Windows: Would you like to end this process?🥺 Linux: ...

2025-02-18T17:30:37Z

Windows: Would you like to end this process?🥺

Linux: Terminate. No negotiations.🔫

It's been there for a bit, but looking at your other posts ...

2024-12-20T16:22:52Z

In reply to nevent1q…ghns
_________________________

It's been there for a bit, but looking at your other posts with some showing concerns of this being a phishing url is incorrect. You're using the correct link which comes from: http://ngemgrlhmdqi3zsgscjgjrbwpietxf3kbwjfzrarb4h6f3nimjsiu7yd.onion/