Cyber Threat Intelligence

245 incidents included 90 initial-access listings and 52 breach/leak claims, as ShinyHunters and imdbtech targeted public and financial data.

Fifty-nine breach and leak claims joined 51 defacements as GitLab, PaperCut and Cisco flaws drew exploitation and Trezor warned 347,000 users.

CoupDeGrace leads 20 of 152 tracked events as 41 alleged exposures hit finance, healthcare and government targets across multiple regions.

Zasnit's alleged Telegram data sale leads 179 tracked events, while CoupDeGrace and wpdealer drive government, telecom and finance exposure.

Zasnit and aha alleged broad account and university breaches as Microsoft fixed 974 flaws, including two exploited zero-days.

The Gentlemen leads 200 tracked claims as ransomware reaches 42 events; N-central, Magento, ScreenConnect and PEEP raise urgent defense priorities.

Fifty-seven alleged exposures span DOJ/FBI, ASUS, CoinPayments, and Odido as MikroTik router hijacks and REVSTEALER persistence add operational risk.

Forty-six alleged breaches and leaks hit public agencies, finance and retail as Magento, TeamCity, Elementor Pro and PaperCut flaws drew attacks.

GrayscaleInsight cyber threat intelligence brief for 2026-09-04: tracked incidents, threat actor activity, and external analysis.

Threat actors target France, Brazil, US with breaches spanning telecom, health, government; AI-driven attacks hit Latin America.

FORUM SHOP ROSTAM claims 25+ Taiwan breaches. Dropbox, Ticketmaster, Coinbase alleged leaks. Microsoft warns of Teams IT support impersonation attacks.

MrDarkRoot claims 18 education-sector data sales across 12 countries, hitting US universities and Israeli Ministry of Education. DDoS and initial access activity also tracked.

GrayscaleInsight cyber threat intelligence brief for 2026-08-26: tracked incidents, threat actor activity, and external analysis.

Market Exchange bank claims join 59 alleged exposures as active WebLogic and WordPress flaws raise patching and identity risks.

GrayscaleInsight cyber threat intelligence brief for 2026-08-23: tracked incidents, threat actor activity, and external analysis.

GrayscaleInsight cyber threat intelligence brief for 2026-08-22: tracked incidents, threat actor activity, and external analysis.

GrayscaleInsight cyber threat intelligence brief for 2026-08-21: tracked incidents, threat actor activity, and external analysis.

UNC7005 and GARUDA claims coincide with 192 incidents, while CVE-2026-73570 exploitation and a Rust supply-chain attack sharpen response priorities.

220 events included 60 breach or leak claims; DarkMafiaX and BLACK HAT HACKERS FORCE appeared as CISA flagged four actively exploited flaws.

Exchange Markets claims HSBC and Manulife data sales as 53 critical exposures coincide with Medusa passing 500 victims and active Ray exploitation.

Trenggalek Cyber Army led 252 alleged events; 64 breach or leak claims hit government, telecom and healthcare as GitLab and Forminator flaws emerged.

Shadow Protocol and Qilin feature in 346 alleged incidents, including 93 exposure claims across government, education, and major brands.

X0Frankenstein, TeamPrabal and ZoneX404 drove 76 alleged exposures among 178 events, spanning banks, government and identity systems.

ShipMonk exposure affected 14,000 Trezor customers as alleged finance breaches and GeoServer exploitation shaped a 184-event CTI day.

DeepCore Network led 170 events as 67 alleged exposures hit public and financial targets while two critical CVEs drew active exploitation.

Sophia and Sophia01 claim 14 breaches, mostly in France; Lazarus exploits a Windows zero-day as 231 events include 69 breach or leak exposures.

301 events included 151 exposure claims; kyoshin33 targeted Indian defense data as Kimwolf v7 and an exploited Windows flaw raised urgency.

Across 362 events, 175 alleged exposures joined Gunra ransomware, Polish energy sabotage, and public-sector breach claims.

Disrupt0r claims OKX and Binance; Evilx targets six Syrian institutions as 90 breach and leak claims span finance, government and education.

ShinyHunt, K3LLLEAKERS and Iron Atlas appear among 56 alleged exposure events as Metabase, Rovo AI and LoadMaster flaws draw urgent action.