Ido Cohen: Country Spotlight: Canada Over the past 7 days, our AI-powered platform tracked ransomware and cyber extortion attacks targeting Canada.2026-06-25
ido_cohen2ransomwareCanadaT1566
Independent cyber threat research covering malware campaigns, phishing infrastructure and vulnerability exploitation.
Ido Cohen: Sector Spotlight: HealthCare Over the past 7 days, our AI-powered platform tracked ransomware and cyber extortion groups actively targeting the HealthCare sector.2026-06-25
ido_cohen2ransomwareUnited StatesT1566
Independent cyber threat research covering malware campaigns, phishing infrastructure and vulnerability exploitation.
Group-IB Threat Intelligence: The Y2K Operators threat actor is using sophisticated #socialengineering lures, disguising payloads as legitimate software, cracked applications, gaming cheat tools (e.g., Roblox), and used PDF decoy documents.2026-06-25
x-cticampaignUnknown
Group-IB Threat Intelligence feed featuring APT research, ransomware analysis and cybercrime investigations.
Group-IB Threat Intelligence: Group-IB telemetry has identified over 62,000 compromised endpoints across more than 160 countries infected with #MilleniumRAT (4.x). The infection velocity is alarming, with over 39,000 of these detections occurring in Q1 2026 alone, representing 64% of all infections. This demonstrates a rapidly accelerating global campaign.2026-06-25
x-cticampaignUnknown
Group-IB Threat Intelligence feed featuring APT research, ransomware analysis and cybercrime investigations.
Group-IB Threat Intelligence: Pinned: #MilleniumRAT (v4.x) marks a significant evolution in the threat landscape. The #malware has been completely rewritten from .NET to a native C++ application, removing .NET dependencies. This architectural shift enables greater stealth and resilience, making detection more challenging. The #Telegram Bot API remains the core C2 mechanism.2026-06-25
x-ctimalwareUnknown
Group-IB Threat Intelligence feed featuring APT research, ransomware analysis and cybercrime investigations.
Ransomware News: «Ðобилизовали веÑÑ ÐºÐ¾Ð»Ð»ÐµÐºÑив»: «УÑагоÑмолзавод» пеÑевели в «ÑÑÑной Ñежим» из-за кибеÑаÑаки2026-06-24
anggipradanareportUnknown
«Ðобилизовали веÑÑ ÐºÐ¾Ð»Ð»ÐµÐºÑив»: «УÑагоÑмолзавод» пеÑевели в «ÑÑÑной Ñежим» из-за кибеÑаÑаки Noticia sobre ransomware publicad...
StealthMole: RT by @stealthmole_int: Following the Money: Mapping KidBin's Cryptocurrency Infrastructure Across Darkweb Note: When visiting this blog, you may see a "Sensitive Content" warning from Blogger. This warning is automatically generated by Google's systems based on the topics discussed on the site and does not necessarily indicate the presence of graphic or inappropriate material.2026-06-24
stealthmole_intcampaignUnknown
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.
Ido Cohen: We continue to monitor additional sources in the darknet. Here are some of the events that were added to our platform in the last week. 1 A major breach exposed over 500GB of sensitive personal information from job seekers, posing a high risk of identity theft and fraud. 2 Remote access to POS systems is being sold, threatening financial data and sensitive customer information across large retail businesses globally.2026-06-24
ido_cohen2breachUnknownT1566
Independent cyber threat research covering malware campaigns, phishing infrastructure and vulnerability exploitation.
Hackmanac: RT by @H4ckmanac: Cyber Alert ‼ Japan - 𝗞𝗗𝗗𝗜 KDDI warned users to change their passwords after disclosing unauthorised access to its email system used by six internet service providers (ISPs), potentially exposing up to 14.22 million email accounts. The compromised information may include email addresses and passwords.2026-06-24
H4ckmanacbreachJapan
Threat intelligence and cyber alert feed covering data breaches, ransomware incidents and vulnerability disclosures.
Beran Concrete2026-06-24
thegentlemenransomwareCzech RepublicT1566
Una empresa de construcción y mezcla in situ en Wichita, Kansas, ha sido afectada por un ataque de ransomware. La organización, Beran Concrete, se especializa en proyectos comerciales y resi...
CHIFENG GOLD SEPON2026-06-24
thegentlemenransomwareLaos
Una alerta de ransomware ha sido reportada contra CHIFENG GOLD SEPON, una empresa minera líder en Laos que opera en la provincia de Savannakhet. El ataque, atribuido al grupo cybercriminal "...