KYCMyASS Passport Listings, Turla Sanctions, and AI-Coded Attacks

Summary

Today's intelligence reveals a dual threat: opportunistic data brokers are flooding markets with high-value identity documents while state-sponsored actors continue to refine their operational tempo. The emergence of AI-generated attack scripts and a new phishing-as-a-service platform targeting Microsoft 365 signals that defenders must now contend with adversaries who are both automating their tradecraft and commoditizing their access. The volume of alleged passport and identity document listings from a single actor, KYCMyASS, is a notable outlier that warrants immediate attention from organizations handling cross-border identity verification.

Today's developments

The actor KYCMyASS has allegedly listed passport data from six countries -- the United Kingdom, Germany, Czech Republic, Norway, Poland, and Brazil -- alongside Philippine ID documents. This concentration of identity-related listings from a single actor is unusual and suggests either a coordinated data aggregation campaign or access to a common source. Separately, actor Exchange Markets is allegedly selling data from an unidentified Italian oil company and Kuwaiti digital coin investors, while S82 ETHX claims to have Ecuadorian Armed Forces and National Police databases. These listings, if verified, represent a broad cross-section of high-value targets spanning energy, military, and financial sectors.

In the breach category, pwn2dd claims to have compromised France Pare-Brise (manufacturing, France) with over 100,000 records, while SUB-ZER0 alleges a breach of TELMEX (Mexico, telecommunications) involving 214,418 records. Vandal allegedly breached City Security Systems (United Kingdom, security services), and Roiese claims access to cbip.com.my (Malaysia). NightBroker has allegedly leaked data from Suitable AI, a dark web entity, and 1877 claims a breach of PagBank (Brazil, financial services). The Indian Defense Missiles Program 2024-2029 is allegedly exposed by actor Ruhi, and Arcepah claims a breach of INFO CDMX (Mexico, government administration).

Industry analysis from the past week provides critical context. The European Union, its member states, and the United Kingdom have sanctioned Russian intelligence officers linked to the Turla group, attributing winter cyberattacks against Poland's energy grid to the FSB. SecurityWeek reports that officials are warning defenders that Russian state-sponsored hackers are actively targeting network devices across defense, communications, energy, finance, government, and healthcare sectors. This aligns with a joint advisory urging organizations to prioritize network device hardening.

A new phishing-as-a-service operation called Forg365 is targeting Microsoft 365 accounts using device code phishing, adversary-in-the-middle session theft, and AI-assisted lure creation. Distributed via Telegram for $400/month, it represents a significant evolution in credential theft capabilities. Separately, researchers have flagged an intrusion where an attacker used a suspected AI-generated PowerShell script for Active Directory enumeration, mapping users, computers, and domains before exporting a report. This "vibe-coded" approach suggests adversaries are leveraging generative AI to lower the technical barrier for network reconnaissance.

Threat landscape signals

The event distribution today shows a pronounced tilt toward data exposure incidents, with 53 critical events (breach + leak) out of 179 total tracked events. This represents approximately 30% of all activity, a high proportion that may reflect increased market activity on underground forums. The actor concentration is notable: Market X (22 events) and NoName057(16) (8 events) dominate, but KYCMyASS (7 events) is an outlier in the identity document space. Germany and the United States are the most targeted countries (15 events each), followed by Mexico and Iran (12 each). The ransomware count (17 events) is lower than typical, but the DDoS count (17 events) suggests continued disruptive activity, likely from hacktivist groups. Defenders should monitor for follow-on attacks leveraging the identity data being listed, particularly in the financial services and government sectors.