CRITICAL
Extremely high global threat
- Ransomware surging48
BRIEF OF THE DAY· 06:47 PM UTC
RANSOM145.0LEAK900kKEV4
Active day in the underground: 48 ransom victims claimed vs 33.1/day baseline — above the average. Medusalocker leads with 17 claims in Technology / Manufacturing (United States, India) — Msn, baiapai, followed by Braincipher with 8. On leaks, 851k accounts flowed into the feed over 7d (largest: “Harvard - 850,537 breached accounts”). 4 CVEs entered the KEV catalog over 7d (CVE-2024-27834). Kalir surfaced 5 critical underground items in the last 24h (top: Leak — Registro Civil / Registraduría Nacional (Colombia)).
LIVE PULSE · NOWAUTO
RANSOM IDX
145.0▲ +73% vs yesterday
48 victims claimed today against an average of 33.1 per day: activity above the average.
Most active groups
Top countries (7d)
- USUnited States84
- DEGermany15
- MXMexico7
Kalir Brief · 24h
CROSS-SOURCELeak● 96
Registro Civil de Colombia: 41,4 millones de datos biométricos a la ventaA seller on DarkForums is offering 41.4 million alleged biometric records from Colombia's National Civil Registry, including fingerprints and citizen identity data. If genuine, this is one of the largest breaches of a Latin American government database, enabling identity fraud, impersonation and targeted attacks on citizens, banks and state services. Colombian authorities should treat it as a national security incident.Leak● 93
Filtración de 31 GB del Poder Judicial de Lima Norte, PerúThe user 'Prymutir' published on DarkForums a 31.10 GB archive attributed to the Superior Court of Justice of Lima Norte, a Peruvian judicial body that handles criminal, civil and family cases. At that volume the dump likely contains case files, filings and personal data of litigants, employees and possibly judicial operators. A leak of a national judiciary is a high-value target for extortion, doxxing and follow-on fraud against citizens, and it is a direct reputational and legal risk for the Peruvian state.Leak● 93
Base de datos del Ejército de Venezuela a la ventaA forum user ('Opkonar') on DarkForums posted a database attributed to the Venezuelan Army, a national military force. Any exposure of military personnel or logistics records is high-impact for regional security and enables targeted phishing or targeting of service members. Defenders in the region should verify authenticity and scope immediately.Leak● 92
Filtración de la base de datos completa de Cultura.gob.mx (México)Actor 'Frouzenx' posted on DarkForums what is claimed to be the full database of Cultura.gob.mx, the Mexican Ministry of Culture's portal. A complete dump of a .gob.mx site risks exposing staff credentials, internal contacts and program data useful for follow-on intrusion. Defenders should verify authenticity and hunt for reused passwords.Latest victims 24h
● REAL-TIME- 7hAOQINSistelBR
- 9hBYODFirst and Final Warning - IHG Hotels & Resorts (Estate)
- 10hQILINCalvary Christian CollegeAU
- 10hEVERSTAKEne*****h.com
- 10hAUDITTEAMkx***omCN
- 11hPIXELLEAKSDisclosed
- 12hDARK PROJECTCustom BakehouseUS
- 13hDESTELLOMAPFRE Brasil 2026BR
External feed
CURATED- Dark Reading[Virtual Event] Cybersecurity Outlook 2027now
- Dark Reading[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AInow
- SecurityWeekAI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research1h
Underground Market · groupsVICTIMS · 7D
SymGroup7dΔTrend
QILQilin25-36%NNN0n24+33%SAFSafepay18+100%MEDMedusalocker17+100%AKIAkira11+83%BRABraincipher11+100%THEThegentlemen10+233%SILSilentransomgroup10+67%View Ransomware Wing →Global IncidenceBY REGION · 24H
48events · 24h
RANSOM
LEAK
VULN
19
NA
5
EU
3
APAC
5
LATAM
1
MEA
Top Origins (7d)VIEW WIRE →
US
United States84
DE
Germany15
MX
Mexico7
GB
United Kingdom7
CA
Canada5
MY
Malaysia4
BR
Brazil4
AR
Argentina4
Pulse ResearchORIGINAL · CTI
Kalir · Underground BriefCROSS-SOURCE
Leak● 76
Base de datos completa del Gobierno de México (gob.mx) publicada en foroA DarkForums user (Frouzenx) posted a claimed full database linked to the Mexican federal government domain gob.mx; the thread is now closed and content removed, but the dump likely circulated before takedown. Such a release, if authentic, exposes citizen PII and potentially internal accounts tied to federal portals. Defenders should treat it as a possible precursor to credential stuffing and phishing against government services.Leak● 82
Datos de alumnos de 19 primarias de la Secretaría de Educación (México)Fresh post by SUB-ZER0 on DarkNetArmy advertises student data from 19 primary schools under a Mexican Secretaría de Educación, published less than an hour ago. The records involve minors, which raises the impact far above a normal breach: exposure enables extortion, grooming, and identity fraud against children and their families. School datasets typically also carry parent contacts and staff accounts useful for follow-on intrusions.Leak● 87
Base de datos de 125.000 contribuyentes del gobierno de Coahuila, MéxicoA forum actor (SUB-ZER0) published a database of roughly 125,000 taxpayer/contributor records belonging to the Coahuila state government in Mexico, posted minutes ago on the DarkNetArmy onion forum. The data appears to be citizen PII tied to a state tax administration, which enables identity fraud, targeted phishing and extortion against residents. Government records of this type also expose internal identifiers that can be abused for tax-refund and benefit fraud.Leak● 88
Base de datos del Gobierno de Colombia publicada en DarkForumsA DarkForums user (Krezqatorn) posted what is presented as a Colombian government database on 5 November 2026, suggesting a fresh exfiltration of public-sector records. The exact agency and record count are not disclosed in the listing, which raises the risk that citizen, tax or registry data is being circulated. Any leak of national government data in Colombia exposes citizens to identity fraud and gives attackers material for credential and social-engineering campaigns against public entities.Global WiresCURATED
Underground1h agoNEW
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI ResearchUnderground2h agoNEW
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaignUnderground2h agoNEW
OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrailsUnderground5h agoNEW
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade TakedownsUnderground6h agoNEW
Cyberattack Hits French Blood Bank Site but No Blood Products Are CompromisedUnderground6h agoNEW
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS FlawsUnderground7h agoNEW
The Agent Smith Dilemma: Governing Agentic IdentitiesUnderground8h agoNEW
CISO Conversations: Ryan Davis – The Unknown Is Where Security Meets RealityUnderground8h agoNEW
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-DayUnderground8h agoNEW
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering HolesUnderground9h agoNEW
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit TasksUnderground14h ago
Want to Rent an Internet Address at the White House?Underground Indices· daily reading
The WireLATEST 10 EVENTS
ransom
aoqin reclama a Sistel · BR · Technology
7h agoUnderground · Ransom
ransom
byod reclama a First and Final Warning - IHG Hotels & Resorts (Estate) · Hospitality
9h agoUnderground · Ransom
ransom
qilin reclama a Calvary Christian College · AU · Education
10h agoUnderground · Ransom
ransom
everstake reclama a ne*****h.com
10h agoUnderground · Ransom
ransom
auditteam reclama a kx***om · CN · Technology
10h agoUnderground · Ransom
ransom
pixelleaks reclama a Disclosed · Other
11h agoUnderground · Ransom
ransom
dark project reclama a Custom Bakehouse · US · Retail & E-Commerce
12h agoUnderground · Ransom
ransom
destello reclama a MAPFRE Brasil 2026 · BR · Financial Services
13h agoUnderground · Ransom
ransom
thegentlemen reclama a MKG Kirchrode · DE · Manufacturing
13h agoUnderground · Ransom
ransom
n0n reclama a Delta Dental of Missouri · US · Healthcare
14h agoUnderground · Ransom