BRIEFOtherhighP45
BlackBasta ransomware group chat logs leaked
BlackBasta (ransomware group)
Detected30 October 2026 · 19:24 UTC
User 'Markelok' posted 'BlackBasta Chat logs Leaked' on DarkForums. Internal chat logs of a major ransomware-as-a-service group can reveal victim lists, negotiation tactics, tooling and affiliate identities of high CTI value. This helps defenders anticipate BlackBasta TTPs and identify prior or planned intrusions.
CategoryOther
Severityhigh
Priority score45
Detected30 October 2026 · 19:24 UTC
Other● 74
Config de credential stuffing dirigido a la teleco chilena VTRA credential-stuffing/cracking configuration aimed at the login of VTR, one of Chile's largest telecom and ISP operators, was posted in DarkForums' Configs section by user 'Mekdural'. Such configs enable automated password-guessing against subscriber and staff accounts, risking account takeover of critical telecommunications infrastructure. This is directly relevant to Latin American critical-infrastructure defenders.Other● 48
Venta de planos de motores de misiles Tomahawk, JASSM y TaurusAn account using the handle 'NobawkeyKostao' is advertising what it claims are top-secret engineering drawings sufficient to manufacture engines for the Tomahawk, JASSM and Taurus cruise missiles, a listing reposted repeatedly across Spear and DarkForums seller sections. If authentic, the material would affect several Western defense programs and export-controlled technology; if fabricated, it indicates fraud aimed at state or broker buyers. Neither authenticity nor attribution has been verified.Other● 38
Publican detalles de explotación de una vulnerabilidad en GenieACSA Cracked.st user (bbxx7) is circulating information on a weakness in GenieACS, the open-source TR-069 auto-configuration server many ISPs use to manage customer routers and CPE at scale. Compromise of an ACS instance can push configuration changes to large subscriber fleets, enabling DNS hijacking, credential capture or mass device reconfiguration. The post is informational rather than an access sale, but telecom operators running exposed GenieACS instances should treat it as an actionable exposure check.Other● 62
Venta de planos de misiles de crucero Tomahawk, JASSM y TaurusA seller using the handle NobawkeyKostao, registered in October 2026 on the Spear marketplace, is advertising cruise-missile and business-jet engine blueprints covering US Tomahawk, JASSM and European Taurus systems. If the material is authentic it represents controlled defence technical data whose circulation would aid reverse engineering and countermeasure development; if fraudulent it is still a lure for defence contractors and procurement staff. Either way it warrants verification and monitoring by military and aerospace supply-chain security teams.Other● 45
PoC público de carga de archivos en el plugin Contact ManagerA working proof-of-concept for an unauthenticated arbitrary file upload in the Contact Manager plugin for WordPress (versions <= 9.1.2) was published today on the SpyHackerz forum. The flaw lets an unauthenticated attacker drop a web shell, which normally leads to full site compromise and hosting of further malware. Because the plugin is widely deployed on small business and public-sector sites, mass scanning is expected within days.Other● 24
Comprador busca documentos de identidad argentinos en BreachForumsA BreachForums user (kBpXuXJUsD) posted a buying request this morning for Argentine identity documents, signaling active demand for stolen DNI/passport data in the local market. There is no sample or named source yet, but such requests typically precede bulk sales of impersonation kits used for bank onboarding and benefit fraud in Argentina. It is worth watching as an early indicator of a circulating Argentine identity-data set rather than a confirmed breach.