Underground · what matters today
The underground stories that broke through this window. Gov/mil, access sales, ransomware, leaks, stealers. Screenshots and context on each.
Distribution by category · window
- Gov / Military50
- Access sale27
- Ransomware29
- Leak376
- Stealer0
- Other4
Window
Category
Severity
Ransomware n0n publica a integrador de videovigilancia de California
California smart-building & surveillance integrator (n0n victim, unnamed)
n0n ransomware listed a California smart-building and surveillance integration firm, with data slated to publish on 2026-10-14. Such integrators hold network access and camera/system credentials for many client sites, so a breach can cascade to downstream customers. It is fresh but outside Latin America, worth monitoring rather than escalating now.
Incransom publica al centro médico Health Sciences Centre de Winnipeg
Health Sciences Centre (Winnipeg)
The Incransom ransomware group has listed the Health Sciences Centre in Winnipeg, one of Canada's largest medical institutions, claiming a major healthcare data breach. Healthcare ransomware victims face clinical disruption, patient-safety risk and regulatory exposure, and the leaked data fuels downstream fraud. Cross-border providers and LATAM health-sector defenders should watch for shared tactics.
Ransomware cifra los sistemas de rime Net Global
rime Net Global
A DarkForums post claims the systems of 'rime Net Global' have been encrypted, posted only minutes before collection. If legitimate, it indicates operational disruption at a corporate target that could affect partners and supply chains. The claim is unverified and the entity ambiguous, so confirm the victim's identity and sector before acting.
Ransomware publica a la empresa GOLDUNITED de Brunéi
GOLDUNITED SDN BHD (Brunéi)
A forum post names GOLDUNITED SDN BHD, a Brunei-based company, as a ransomware victim, indicating a published extortion leak. It is a fresh victim disclosure but outside Argentina/LATAM, so its direct relevance to regional defenders is limited. Track only for regional supply-chain or affiliate-tracking context.
Ransomware Nightspire publica a la italiana Valvorobica Industriale
Valvorobica Industriale S.p.A
The Nightspire ransomware group posted Italian manufacturer Valvorobica Industriale S.p.A. to its leak site, a freshly-published victim in the manufacturing sector. While outside the AR-LATAM region, it confirms an active extortion campaign and offers TTPs (initial access, exfiltration patterns) defenders can track. No AR-LATAM entity is named, so relevance is indirect.