BRIEFOtherhighP55
First communiqué from actor leaking Ecuadorian state data
Pheisito (actor)
Detected20 October 2026 · 21:39 UTC
A 'first communiqué' posted by the same actor who is simultaneously publishing ECU911/Police, military, CNEL and Judicial Council databases from Ecuador. It likely states the group's motives, demands or leak schedule, which helps defenders anticipate the next victims. Content was not fully readable, so treat as context rather than confirmed intelligence.
CategoryOther
Severityhigh
Priority score55
Detected20 October 2026 · 21:39 UTC
Other● 45
Reportan compromiso de Gcore a través del panel ISPsystemA hosting community thread claims Gcore, a global cloud/CDN and hosting provider, was compromised through an ISPsystem control panel. If accurate, this means attacker control over provisioning infrastructure used by many downstream customers, including regional resellers and hosted services in Latin America. The claim is unverified and undated, so treat it as a lead to validate against Gcore's own advisories rather than confirmed fact.Other● 68
Documento interno de SpaceX sobre la constelación Starshield a la ventaA seller is offering an internal SpaceX document describing the technical baseline and architecture of the Starshield constellation, a defense-oriented satellite program. If authentic, it exposes system design details of interest to military intelligence and adversary space programs. Technical and defense-sector defenders should monitor downstream distribution.Other● 52
Reclutan infiltrados en bancos, telcos y gobiernosA buyer is openly recruiting insiders among bank, telecom and government staff, seeking employees willing to provide access or data. Insider recruitment is a precursor to fraud and intrusions against regulated sectors. Defenders in finance, telco and the public sector should reinforce insider-threat monitoring and access controls.Other● 55
Código fuente del troyano bancario BTMOB 3.6.3 a la ventaComplete source code, reseller panel/server code and video tutorials for the BTMOB Android banking trojan are being shared, lowering the bar for new operators to build ATS/overlay campaigns. BTMOB is used against Latin American banks and their customers, so wider availability directly increases fraud risk for Argentine and regional financial institutions. Banks should update mobile-fraud detection for the 3.6.3 build and monitor for new reseller-distributed variants.Other● 50
Reclutamiento de infiltrados en bancos, telcos y gobiernoA buyer on BreachForums and RaidForums is openly soliciting insiders at banks, telecom operators and government agencies, presumably to obtain privileged access or credentials. The fresh post dated October 19, 2026 signals active demand for insider access to financial, telco and public-sector targets. Defenders in these sectors should tighten insider-threat monitoring and privileged-access controls.Other● 27
Se buscan datos de Serasa Experian e inmobiliaria brasileñaA forum buyer posted a standing request for complete Serasa Experian data plus Brazilian real estate records, indicating continued demand for LATAM credit-bureau and property datasets. It is a demand-side post from August 2025, not a leak, so there is no confirmed exposure of the credit bureau itself. Useful only as context on buyer interest in Brazilian financial and property data.