ELEVATED
Elevated global threat
DarkSide
DOMINANT7530CLAIMS · 7D—
BRIEF OF THE DAY· 03:37 AM UTC
RANSOM91.0LEAK21.6MKEV10
Moderate window in the underground: 29 ransom victims claimed vs 31.8/day baseline — in line with the average. Thegentlemen leads with 16 claims in Professional Services / Manufacturing (United States, India) — Glassdoor, G R Infraprojects. followed by Qilin with 4. On leaks, 21.6M accounts flowed into the feed over 7d (top: Carhartt - 12,933,413 breached accounts). 10 CVEs entered the KEV catalog over 7d (CVE-2023-49105). Kalir surfaced 1 critical underground item in the last 24h (top: Leak — a top-priority item).
LIVE PULSE · NOWAUTO
RANSOM IDX
91.0▲ +65%
29 victims claimed today vs baseline 31.8/day — activity in line with the average.
Most active groups
Top countries (7d)
- USUnited States54
- GBUnited Kingdom14
- BRBrazil8
Kalir Brief · 24h
CROSS-SOURCELeak● 90
Filtración masiva de 250 millones de credenciales de registros stealerA private dump of 250 million URL:LOGIN:PASSWORD entries from stealer logs was published on August 30, 2026. This represents a massive trove of credentials that could be used to access diverse online services, including potentially corporate and personal accounts. Defenders should treat any credentials from stealer logs as compromised and enforce password resets, MFA, and dark web monitoring.Leak● 80
Filtración de base de datos de control vehicular de la Fiscalía de CoahuilaThe Coahuila Prosecutor's Office vehicle control database has been leaked on a dark web forum. The dataset likely contains vehicle registration and ownership records from a Mexican state government, useful for identity fraud and extortion. This is a fresh, government-related data exposure relevant to Latin American defenders.Leak● 78
Filtración de base de datos de la empresa de IA mercor.comA seller is offering the source code, user database, and contractor database of mercor.com, an AI training company based in the USA. The leak likely contains source code and personal data of users and contractors, which could facilitate further attacks. This is a significant breach of a real organization and warrants immediate monitoring.Leak● 75
Divulgación de más de 10 millones de credenciales URL:LOGIN:PASSWORD de StarLinkCloudsA large dump containing more than 10 million URL:LOGIN:PASSWORD lines attributed to Secretline.top and StarLinkClouds has been posted on a breach forum. The data likely originates from stealer malware and could facilitate account takeovers across many platforms. Organizations should check these credentials for exposure and implement phishing-resistant MFA.Latest victims 24h
● REAL-TIME- 12hQILINAFSARDMK
- 12hWALLSTREETAndoverUS
- 13hDIREWOLFTHQ NordicSE
- 13hDIREWOLFErdem HospitalTR
- 13hDIREWOLFHospital Clnico Universidad de ChileCL
- 13hFALCONGlobus MedicalUS
- 13hFALCONDistributionNOW (DNOW Inc.)US
- 14hQILINCrystalpharmatech
External feed
CURATED- Dark Reading[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AInow
- Dark Reading[Virtual Event] Building a Secure AI Strategy for the Enterprisenow
- Dark ReadingGISEC GLOBALnow
Pulse's first editorial note is about to publish. Meanwhile, here's what the data says.
Enter the admin →Underground Market · groupsVICTIMS · 7D
SymGroup7dΔTrend
QILQilin42+22%THEThegentlemen21-25%KRYKrybit12+100%AKIAkira12+83%SILSilentransomgroup10+233%DARDark Project6-50%LOCLockbit56+200%CHAChaos6+100%View Ransomware Wing →Global IncidenceBY REGION · 24H
0events · 24h
RANSOM
LEAK
VULN
0NA
0EU
0APAC
0LATAM
0MEA
Top Origins (7d)VIEW WIRE →
US
United States54
GB
United Kingdom14
MX
Mexico8
BR
Brazil8
DE
Germany7
AU
Australia6
AR
Argentina5
IN
India4
Pulse ResearchORIGINAL · CTI
More editorial coming.
Kalir · Underground BriefCROSS-SOURCE
Leak● 95
Filtración de Serasa: respaldo de 500 GB a la ventaA 500 GB backup from Serasa, Brazil's largest credit bureau, is being sold on a darknet forum. The archive likely contains personal, financial and credit data of millions of Brazilian consumers. This is a critical exposure that requires immediate verification and fraud monitoring.Gov / Military● 92
Filtración de la base de datos del Boletín Oficial de ArgentinaAn unknown actor has leaked the database of Argentina's official gazette (Boletín Oficial Electrónico). The post claims to offer records from the BOE, which may include official government notices and sensitive administrative data. This constitutes a direct compromise of a national government platform and warrants immediate incident response.Leak● 90
Filtración masiva de 250 millones de credenciales de registros stealerA private dump of 250 million URL:LOGIN:PASSWORD entries from stealer logs was published on August 30, 2026. This represents a massive trove of credentials that could be used to access diverse online services, including potentially corporate and personal accounts. Defenders should treat any credentials from stealer logs as compromised and enforce password resets, MFA, and dark web monitoring.Access sale● 90
Venta de acceso a API de RENAPER y bases de datos gubernamentales de ArgentinaA seller is offering access to an API service tied to RENAPER, Argentina's national identity registry, along with other government databases. This would allow doxing, identity theft, and large-scale fraud against Argentine citizens. It is a direct threat to critical government infrastructure and must be treated as a high-priority incident.Global WiresCURATED
Undergroundjust nowNEW
[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AIUndergroundjust nowNEW
[Virtual Event] Building a Secure AI Strategy for the EnterpriseUndergroundjust nowNEW
GISEC GLOBALUnderground2d ago
ATF confirms cyberattack hit system containing info on its investigation targetsUnderground2d ago
Hundreds of OpenAI Agents Invaded Hugging Face ServersUnderground2d ago
Offensive Security Investments Surge as AI Threats IncreaseUnderground2d ago
PaperCut warns of hackers using printer management software flaw in attacksUnderground2d ago
In Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker SanctionsUnderground3d ago
You Need Cyber Deception for OTUnderground3d ago
ATF Confirms Cyber Incident After Ransomware Group Claims AttackUnderground3d ago
Defining an AI Kill Switch Is Hard, But NecessaryUnderground3d ago
The Vulnpocalypse Is Repricing the Bug Bounty EconomyUnderground Indices· daily reading
The WireLATEST 10 EVENTS
vuln
KEV agrega CVE-2023-49105 — ownCloud / ownCloud
4d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2026-53362 — Linux / Kernel
4d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2026-66384 — JFrog / Artifactory
4d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2021-23758 — Ajax.NET Professional / Ajax.NET Professional
5d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2015-3246 — Red Hat / Libuser
5d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2015-5287 — Red Hat / Automatic Bug Reporting Tool
5d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2022-0995 — Linux / Kernel
5d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2026-8452 — Citrix / NetScaler ADC and NetScaler Gateway
5d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2019-1068 — Microsoft / SQL Server
5d agoUnderground · Vulnerability
vuln
KEV agrega CVE-2026-60004 — Gitea / Gitea
6d agoUnderground · Vulnerability