CRITICAL
Extremely high global threat
- Ransomware surging57
BRIEF OF THE DAY· 05:47 PM UTC
RANSOM178.0LEAK900kKEV4
Active day in the underground: 59 ransom victims claimed vs 33.1/day baseline — above the average. Medusalocker leads with 17 claims in Technology / Manufacturing (United States, India) — Msn, baiapai, followed by Braincipher with 11. On leaks, 851k accounts flowed into the feed over 7d (largest: “Harvard - 850,537 breached accounts”). 4 CVEs entered the KEV catalog over 7d (CVE-2024-27834). Kalir surfaced 5 critical underground items in the last 24h (top: Leak — Registro Civil / Registraduría Nacional (Colombia)).
LIVE PULSE · NOWAUTO
RANSOM IDX
178.0▲ +128% vs yesterday
59 victims claimed today against an average of 33.1 per day: activity above the average.
Most active groups
Top countries (7d)
- USUnited States84
- DEGermany15
- MXMexico7
Kalir Brief · 24h
CROSS-SOURCELeak● 96
Registro Civil de Colombia: 41,4 millones de datos biométricos a la ventaA seller on DarkForums is offering 41.4 million alleged biometric records from Colombia's National Civil Registry, including fingerprints and citizen identity data. If genuine, this is one of the largest breaches of a Latin American government database, enabling identity fraud, impersonation and targeted attacks on citizens, banks and state services. Colombian authorities should treat it as a national security incident.Leak● 93
Filtración de 31 GB del Poder Judicial de Lima Norte, PerúThe user 'Prymutir' published on DarkForums a 31.10 GB archive attributed to the Superior Court of Justice of Lima Norte, a Peruvian judicial body that handles criminal, civil and family cases. At that volume the dump likely contains case files, filings and personal data of litigants, employees and possibly judicial operators. A leak of a national judiciary is a high-value target for extortion, doxxing and follow-on fraud against citizens, and it is a direct reputational and legal risk for the Peruvian state.Leak● 93
Base de datos del Ejército de Venezuela a la ventaA forum user ('Opkonar') on DarkForums posted a database attributed to the Venezuelan Army, a national military force. Any exposure of military personnel or logistics records is high-impact for regional security and enables targeted phishing or targeting of service members. Defenders in the region should verify authenticity and scope immediately.Leak● 92
Filtración de la base de datos completa de Cultura.gob.mx (México)Actor 'Frouzenx' posted on DarkForums what is claimed to be the full database of Cultura.gob.mx, the Mexican Ministry of Culture's portal. A complete dump of a .gob.mx site risks exposing staff credentials, internal contacts and program data useful for follow-on intrusion. Defenders should verify authenticity and hunt for reused passwords.Latest victims 24h
● REAL-TIME- 7hAOQINSistelBR
- 8hBYODFirst and Final Warning - IHG Hotels & Resorts (Estate)
- 9hQILINCalvary Christian CollegeAU
- 9hEVERSTAKEne*****h.com
- 9hAUDITTEAMkx***omCN
- 10hPIXELLEAKSDisclosed
- 12hDARK PROJECTCustom BakehouseUS
- 12hDESTELLOMAPFRE Brasil 2026BR
External feed
CURATED- Dark Reading[Virtual Event] Cybersecurity Outlook 2027now
- Dark Reading[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AInow
- SecurityWeekBank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns4h
Underground Market · groupsVICTIMS · 7D
SymGroup7dΔTrend
QILQilin25-36%NNN0n24+33%SAFSafepay18+100%MEDMedusalocker17+100%AKIAkira11+83%BRABraincipher11+100%THEThegentlemen10+233%SILSilentransomgroup10+67%View Ransomware Wing →Global IncidenceBY REGION · 24H
57events · 24h
RANSOM
LEAK
VULN
21
NA
9
EU
4
APAC
5
LATAM
1
MEA
Top Origins (7d)VIEW WIRE →
US
United States84
DE
Germany15
MX
Mexico7
GB
United Kingdom7
CA
Canada5
MY
Malaysia4
BR
Brazil4
AR
Argentina4
Pulse ResearchORIGINAL · CTI
Kalir · Underground BriefCROSS-SOURCE
Leak● 78
Datos de alumnos de 19 escuelas primarias de la Secretaría de Educación de México en ventaA DarkNetArmy post by SUB-ZER0 claims data from 19 primary schools under Mexico's Secretaría de Educación, covering minors, and was published today. Records tied to children carry an elevated duty of care: names, school affiliation and guardian contacts are highly sensitive and enable extortion, bullying and identity fraud. Educational authorities in the region should treat this as a serious breach given the vulnerable population involved.Leak● 85
Base de datos de 125.000 contribuyentes del gobierno de Coahuila, México, a la ventaUnder the handle SUB-ZER0, a listing on DarkNetArmy offers a database of roughly 125,000 contributors tied to the Coahuila state government in Mexico, published and bumped today. Taxpayer and contributor records typically include names, identifiers and contact data that enable identity theft and targeted fraud. Because the data is tied to a specific state government, it also provides credible pretext material for phishing campaigns impersonating Mexican tax authorities.Leak● 88
Base de datos del Gobierno de Colombia publicada en DarkForumsA DarkForums user (Krezqatorn) posted what is presented as a Colombian government database on 5 November 2026, suggesting a fresh exfiltration of public-sector records. The exact agency and record count are not disclosed in the listing, which raises the risk that citizen, tax or registry data is being circulated. Any leak of national government data in Colombia exposes citizens to identity fraud and gives attackers material for credential and social-engineering campaigns against public entities.Leak● 80
Filtración de base de datos del gobierno de Coahuila, México, con 2 millones de registrosA database attributed to the Mexican state government of Coahuila, reportedly around 2 million records, was posted for download on DarkForums by user SUB-ZER0. Citizen data at this scale can enable identity fraud, phishing and targeting of state services. Mexican public-sector defenders should verify the claim and watch for leaked personal records.Global WiresCURATED
Underground4h agoNEW
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade TakedownsUnderground5h agoNEW
Cyberattack Hits French Blood Bank Site but No Blood Products Are CompromisedUnderground5h agoNEW
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS FlawsUnderground7h agoNEW
The Agent Smith Dilemma: Governing Agentic IdentitiesUnderground7h agoNEW
CISO Conversations: Ryan Davis – The Unknown Is Where Security Meets RealityUnderground7h agoNEW
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-DayUnderground7h agoNEW
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering HolesUnderground8h agoNEW
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit TasksUnderground13h ago
Want to Rent an Internet Address at the White House?Underground18h ago
Smashing Security podcast #491: How AI agents are spooking the banksUnderground18h ago
Ukraine fires two senior security officials amid corruption probe into scam call centersUnderground18h ago
Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniquesUnderground Indices· daily reading
The WireLATEST 10 EVENTS
ransom
aoqin reclama a Sistel · BR · Technology
7h agoUnderground · Ransom
ransom
byod reclama a First and Final Warning - IHG Hotels & Resorts (Estate) · Hospitality
8h agoUnderground · Ransom
ransom
qilin reclama a Calvary Christian College · AU · Education
9h agoUnderground · Ransom
ransom
everstake reclama a ne*****h.com
9h agoUnderground · Ransom
ransom
auditteam reclama a kx***om · CN · Technology
9h agoUnderground · Ransom
ransom
pixelleaks reclama a Disclosed · Other
10h agoUnderground · Ransom
ransom
dark project reclama a Custom Bakehouse · US · Retail & E-Commerce
12h agoUnderground · Ransom
ransom
destello reclama a MAPFRE Brasil 2026 · BR · Financial Services
12h agoUnderground · Ransom
ransom
thegentlemen reclama a MKG Kirchrode · DE · Manufacturing
12h agoUnderground · Ransom
ransom
n0n reclama a Delta Dental of Missouri · US · Healthcare
13h agoUnderground · Ransom