X-VDP-X

Owner : X-VDP-X • diablefire

telegram : diablefire - #France

[VECERT Analyzer @VECERTRadar]

🚨 CYBER INTELLIGENCE ALERT: 🇸🇪 [UNCONFIRMED] ADMINISTRATIVE ACCESS AND INTELLECTUAL PROPERTY INFRASTRUCTURE COMPROMISE — VOLVO

[STATUS: UNCONFIRMED / INITIAL ACCESS / DATA EXFILTRATION / AUTOMOTIVE INTELLECTUAL PROPERTY]

A social media post attributed to the threat actor X-VDP-X has been detected, claiming to have gained administrative-level access to the web infrastructure of the international automotive company Volvo (https://t.co/Cpr3OA37tD).

The attacker claims to have compromised internal production dashboards and extracted confidential technical documentation related to vehicle design and automotive engineering.

Threat Actor: X-VDP-X

Compromise Vector: Administrator access to production portals and document databases.

Types of Data Exposed: Construction drawings in PDF format, wiring diagrams, type approval certificates, and advance commercial information for new automotive models.

📂 Technical Analysis of the Sample and Affected Infrastructure

Through the proof-of-concept (PoC) provided in the screenshot, explicit evidence of the extent of the intrusion can be verified:

Compromise of Internal Production Panels:

The screenshots above show access to two distinct web environments. One corresponds to a Volvo heavy truck fleet management or design panel, while the second exposes an internal search engine for managing and issuing factory technical certificates ("Search Certificate"), revealing fields for selecting the engine type, engine type, engine position, and body variant.

Exfiltration of Engineering Drawings and Intellectual Property (IP):
The mosaic below shows a batch of confidential PDF files associated with the technical development of hybrid engines and heavy-duty electric systems for the brand.

🛡️ Recommended Actions (Defensive Level)

Audit of Sessions and External Portals: It is recommended to proactively alert global IT teams to audit Volvo’s development, documentation, and vendor management portals, immediately revoking active administrative tokens and mandating credential renewal with Multi-Factor Authentication (MFA).

VECERT TOOLS

Strategic Monitoring Tools & Intelligence Platform:

🌐 https://t.co/wk9bZJ2Nli

Security Verification & Monitoring:

🛡️ https://t.co/5LuqwzYuS6

#CyberSecurity 🔐 #ThreatIntelligence 📊 #Volvo #DataBreach 📁 #AutomotiveRisk #IndustrialEspionage #XVDPC #VECERT 🏢

[VECERT Analyzer @VECERTRadar]

🚨 CONSOLIDATED CYBER INTELLIGENCE ALERT: MASSIVE CAMPAIGN AGAINST FRENCH INFRASTRUCTURE 🇫🇷

[STATUS: MULTIPLE INCIDENTS / UNCONFIRMED / INDEXING DATE: JUNE 22, 2026]

EXFILTRATION OF GOVERNMENT DATA, PAYMENT GATEWAYS, AND POLICE RECORDS

Forensic analysis of the consolidated dashboard revealed a coordinated offensive by multiple threat actors. Claims point to the perimeter compromise of strategic French repositories, including government portals (.gouv.fr), police search records (FPR), and medical databases.

🔍 FORENSIC BREAKDOWN OF AFFECTED TARGETS

🏛️ 1. Government and Police Infrastructure (Critical Priority)
[FR] FPR Fichier Personne Recherchée Police (Police Wanted Person File): Claimed by the actor shabat. If confirmed, this would imply the leak of the official file of people wanted by the national police, exposing identity records and arrest warrants.

https://t.co/E8PhfFH0yF: Official portal of the French Civic Service, indexed under the authorship of efraim.

https://t.co/u9bm3L5oL9: Server of the French Ministry of Sports, allegedly compromised by the actor peluche911.

https://t.co/4bfxmf5fNN: Digital infrastructure for regional institutional management, reported by xMetah.

🔑 2. Corporate Services, Medical Services, and Payment Gateways

[FR] Tebex (Partial): Two parallel threads created by the actor notanvaliduser that ensured the partial exfiltration of data from Tebex, a monetization and e-commerce gateway widely used on video game platforms.

Medical Directory [FR]: Exfiltration attributed to the actor cyberjuif that compromised the directory or database of medical professionals in France (healthcare PII).

[FR] Kodex Global Access: Reported by shabat; points to a compromise of credentials or global access points for the Kodex compliance and security platform.

Other commercial and informational domains: Breaches affecting servylo .com and formalog. info (by LunarisSec), as well as point-core. com and boaz-study. com (by X-VDP-X).

⚠️ PREVENTIVE RISK ASSESSMENT

👤 Identity and National Security Impact: The potential compromise of the police FPR file elevates this alert to a critical level regarding public safety, potentially facilitating profiling or the evasion of legal controls by criminal groups.

📋 Monitoring Status: As of June 22, 2026, no ministries or private firms in France have officially verified these incidents; therefore, the reports are being treated preventively as UNCONFIRMED.

📊 MONITORING AND ASSESSMENT

Intelligence System: https://t.co/wk9bZJ2Nli

Quickly assess your website's security at: https://t.co/QZhWp0kFrO

#CyberSecurity #France #GouvFR #PoliceBreach #FPRLeak #Tebex #DataLeaks #ThreatIntelligence #CyberAlert #VECERT #Infosec #UnverifiedBreaches

[VECERT Analyzer @VECERTRadar]

🚨 CYBER INTELLIGENCE ALERT: DEFACTION AND ALLEGED ACADEMIC INTRUSION — FRANCE 🇫🇷

[STATUS: THREAT UNDER INVESTIGATION / UNCONFIRMED / DEFACTION & DATA EXFILTRATION / SOURCE: SOCIAL MEDIA]

The threat actor identified by the alias X-VDP-X has publicly announced the alleged complete compromise and defacement of the URIT institutional website belonging to Université Paris 13 (Sorbonne University Paris North).

The attackers claim to have gained superuser-level privileges on the infrastructure and have published screenshots of the defaced internal administration interface, as well as listing the data packages allegedly stolen during the intrusion campaign.

🏢 Allegedly Affected Entity: URIT Research Unit or Portal - Université Paris 13 (France - https://t.co/BrSpNgb3Vz).

👤 Threat Actors: X-VDP-X / diable'fire.

⚔️ Potential Attack Vector: Exploitation of known vulnerabilities or outdated plugins in the Joomla Content Management System (CMS), facilitating authentication bypass or the loading of malicious scripts to gain control of the root server.

⚠️ CRITICAL RISK ANALYSIS AND CLAIMED REPOSITORIES

If the legitimate access claimed by the X-VDP-X collective is confirmed, the metrics of the recovered material represent a scenario of severe impact on the academic portal:

🔐 Joomla Administrator Access: This shows verified access to the French administration panel (Panneau d'administration). Control of this console empowers attackers to permanently alter the portal, inject malicious JavaScript code, or use the infrastructure to distribute secondary malware campaigns.

📋 Exfiltration of the Complete Database (76 tables): The file named dump.sql would consolidate the entire relational structure of the CMS. This implies the direct exposure of user tables, system configurations, internal logs, and potentially indexed personal data.

✉️ Leak of User Accounts and Emails: The leak of institutional emails and the files detailed in credentials.md provide attackers with valid databases for deploying targeted Spear-Phishing campaigns against researchers, faculty, and students of the institution.

📁 Server File Hijacking (13,049 files / 35 MB): The packaging of the entire directory reflected in the varwwwhtml file exposes the source code, backend scripts, and documents stored in the root directory of the university's web server.

🛡️ TECHNICAL RECOMMENDATIONS AND PREVENTIVE MITIGATION

🛑 Immediate Isolation of the Web Portal (Emergency Corporate Action): The IT team and the academic CSIRT of Université Paris 13 are urgently urged to disconnect or put the subdomain https://t.co/BrSpNgb3Vz into maintenance mode to interrupt any malicious persistence or ongoing data downloads.

🔑 Revocation of Joomla Credentials and Renewal of SALTS: Forcibly invalidate all accounts and passwords of the CMS administrators and editors visible in the screenshot. It is a priority to purge active sessions in the database and audit the creation of any new users created anomalously.

📊 MONITORING AND EVALUATION

Intelligence System:

https://t.co/wk9bZJ2Nli

Quickly assess your website's security with:

https://t.co/QZhWp0kFrO

#CyberSecurity #France #SorbonneParisNord #Paris13 #JoomlaBreach #Defacement #XVDPArmy #DataLeak #AcademicSector #ThreatIntelligence #CyberAlert #VECERT #Infosec #UnverifiedBreach

[VECERT Analyzer @VECERTRadar]

🚨 CONSOLIDATED CYBER-INTELLIGENCE ALERT: ALLEGED DATA LEAKS, GOVERNMENT COMPROMISES, AND GLOBAL WEBSHELL ACTIVITY — 🇨🇱 CHILE | 🇮🇳 INDIA | 🇷🇺 RUSSIA | 🇯🇴 JORDAN | 🇫🇷 FRANCE | 🇺🇸 UNITED STATES | 🇮🇩 INDONESIA | 🇲🇺 MAURITIUS

DATA EXFILTRATION AND COMPROMISED INFRASTRUCTURE ACROSS MULTIPLE SECTORS (HEALTHCARE, MILITARY EDUCATION, MEDIA, AND GOVERNMENT)

[STATUS: MULTIPLE ACTIVE THREATS / MANY UNCONFIRMED / DATE: JUNE 26, 2026]

Through the interception, correlation, and passive analysis of cyber-threat traces from open sources and underground forums, a unified report on simultaneously detected global incidents is issued; detailed below is the technical inventory of assets potentially compromised by various threat actors, though many remain unverified.

🏛️ SECTION I: GOVERNMENT SECTOR, HEALTHCARE, AND DEMOGRAPHIC DATA

1. 🇨🇱 Chile — Compromise of Regional Health Portal (https://t.co/afSpSQOTcJ)

Summary: Regional Ministerial Secretariat of Health of Tarapacá, Chile (https://t.co/afSpSQOTcJ).

Threat Actor: Cortex-group.

Classification: Government / Healthcare.

2. 🇮🇳 India — Massive Demographic and Health Data (815 Million)

Summary: Healthcare and population registry infrastructure in India (Healthcare & Demographic Data 815M).

Threat Actor: Edric.

Classification: Healthcare / Massive PII. Due to the claimed volume (815 million records), the incident poses a critical risk of social profiling.

3. 🇲🇺 Mauritius — CRM Data Structure
(https://t.co/GZ15a2psVH)

Summary: Database/CRM for residential or hospital portals in Mauritius (https://t.co/aMlEcnc3Ea CRM Data Structure).

Threat Actor: Royal_Empire. Classification: Health / Customer Management.

⚔️ SECTION II: EDUCATION, MILITARY, AND INTELLIGENCE SECTORS

1. 🇷🇺 Russia — Military Training and Intelligence Data (Bauman University)

Summary: Bauman Moscow State Technical University - Military and Intelligence Training Systems.

Threat Actor: Losyash.

Classification: Education / Military Intelligence.

2. 🇯🇴 Jordan — University Infrastructure Compromise (Arab Amman University)

Summary: Arab Amman University, Jordan (https://t.co/5j1q24JagX).

Threat Actor: mrx20.
Classification: Education.

📰 SECTION III: MEDIA, RETAIL, AND FINANCIAL TRANSACTIONS SECTORS

1. 🇫🇷 France — Massive Media Dataset Exfiltration (https://t.co/SZvoA32OP2)

Summary: Media or marketing platform in France (https://t.co/SZvoA32OP2 Dataset ~ 49M+).

Threat Actor: Royal_Empire.

Claimed Metric: Over 49 million records exfiltrated.

2. 🇺🇸 United States — Massive Transactional Leak (115 Million)

Summary: Massive financial or user transaction record in the US (115M+ user transaction entries).

Threat Actor: zkSNARK.

Classification: Financial / Transaction Data.

3. 🇮🇩 Indonesia — Commercial Database Structure (https://t.co/Ox3xHpx8tv)

Summary: Automotive/commercial platform in Indonesia (https://t.co/Ox3xHpx8tv Database Structure).

Threat Actor: Royal_Empire.

Classification: Retail.

4. 🇺🇸 United States — Commercial Portal Compromise (https://t.co/ShWnWsAXKf)

Summary: E-commerce or retail portal (https://t.co/ShWnWsAXKf).

Threat Actor: Ridley. 5. 🇫🇷 France — Compromise of Unclassified Entity (https://t.co/2nx6M7GFF4)

Summary: Web infrastructure in France (https://t.co/2nx6M7GFF4).

Threat Actor: X-VDP-X.

🌐 SECTION IV: COMPROMISED GLOBAL INFRASTRUCTURE (DARK WEB SIGNALS)

1. 🌍 Global — Distribution and Sale of Multiple Global Webshells
Threat Actor: JAX7.

Summary: The publication of inventories containing multiple logical remote command execution gateways (webshells)—actively implanted on servers worldwide—was detected.

UNCONFIRMED BY THE SPECIFIC ENTITIES. None of the health ministries, universities, or commercial operators listed in the Dark Web matrix have issued official forensic statements confirming the loss of server integrity as of June 26, 2026. These incidents are being processed under the principle of Perimeter Surveillance and Early Warning, given the high technical reputation held by the actors indexed within the cybercrime ecosystem.

📊 MONITORING AND EVALUATION

Intelligence System: https://t.co/wk9bZJ2Nli

Quickly assess your website's security at: https://t.co/QZhWp0kFrO

#CyberSecurity #DataLeak #DarkWebMonitoring #Webshell #SaludTarapaca #Chile #BaumanUniversity #MilitaryLeak #InfluentiaFR #Coppel #Temu #ThreatIntelligence #CyberAlert #VECERT #Infosec #GlobalThreats #UnverifiedSignals

[Dark Web Informer @DarkWebInformer]

‼️🇯🇴 A French hacker collective calling themselves "X-VDP-X" claims to have compromised https://t.co/Z3cSIszrMn, a Jordanian government site under the Ministry of Water and Irrigation.

The group states they have extracted sensitive information from the databases, with sample data available in CSV format.

[VECERT Analyzer @VECERTRadar]

🌐 Victim: https://t.co/gAdOYPxffk "Fédération française des Clubs"
👤 Threat Actor: X-VDP-X
📅 Date: January 30, 2026
🇫🇷 Origin: France

Significant malicious activity targeting French digital infrastructure has been detected. The threat actor identified as X-VDP-X has published information related to a data breach directly affecting the domain https://t.co/gAdOYPxffk.

🔍 Detailed monitoring: https://t.co/wk9bZJ2Nli

#CyberSecurity #DataBreach #X_VDP_X #FranceCyber ​​#ThreatIntelligence #SQLInjection #InfoSec #CyberAlert #Hacking #DataLeak #VECERT

[Raaz @solostalking]

New leaker "X-VDP-X or diablefire"
Claiming data of multiple French organizations
Active on X and TG

[FrenchBreaches @Frenchbreaches]

🔴 Fuite de données revendiquée chez AXESS, entreprise française de services numériques : X-VDP-X affirme avoir exfiltré 67 bases contenant les données de 18 875 utilisateurs, dont e-mails, mots de passe en clair, téléphones, SIRET, IBAN/BIC, devis et factures.

https://t.co/stermjnubp

[Cyberattaque.org @CyberattaqueOrg]

🚨@AxessGroupe visé par une importante revendication de cyberattaque.

Le hacker diable’fire revendique l’exfiltration de 67 bases de données, 7 841 tables et près de 19 000 comptes utilisateurs.

https://t.co/eifYYjwkM1

[X-VDP-X @6xvdpx]

We were breached by diable'fire - X-VDP-X: https://t.co/8beUPar5Eb

Entire database exfiltrated:
• 67 databases · 7841 tables · 1.1 GB

• 18,875 user emails passwords, names, addresses, phone numbers, dates of birth, SIRET numbers, IBAN/BIC numbers, IBANs

• Quotes / Invoices

[Cyberattaque.org @CyberattaqueOrg]

Klaro est visé par une cyberattaque : 22 369 utilisateurs seraient concernés.

Les hackers revendiquent l’exfiltration de 5 bases, 4 746 tables et 267 Mo de données, avec notamment noms, e-mails, téléphones, dates de naissance et adresses.

👉 https://t.co/O7NxNSrPRZ

[X-VDP-X @6xvdpx]

We were breached by diable'fire - X-VDP-X: https://t.co/3EWaW2X23Q

Entire database exfiltrated:
• 5 databases · 4746 tables · 267 MB

• 22,369 user emails, decodable JWTs, Firebase tokens, names, dates of birth, phone numbers, addresses

• Admin access + SMTP

#XVDPX #France

[Cyberattaque.org @CyberattaqueOrg]

4 122 personnes exposées après le piratage du Syndicat Départemental d’Énergie de l’Allier (SDE 03) : IBAN, identités, contrats et factures figurent parmi les données.

Les hackers affirment également disposer d’accès administrateur et SMTP.

https://t.co/AU0OJSIb2i

[X-VDP-X @6xvdpx]

We breached by diable'fire - X-VDP-X : https://t.co/B4tiMPIorb

Entire database exfiltrated:

• 7 bases · 2440 tables · 238 Mo

• 4122 members (name adresse iban nom prenom numéro)

• contrats , siret , facture , iban
• Acces admin + SMTP

#XVDPX #Hacking #France

[Cyberattaque.org @CyberattaqueOrg]

Nous nous sommes procuré un échantillon qui corrobore les informations de notre article sur la #cyberattaque d'https://t.co/ZG38GCRyWg.

Le hacker nous précise posséder également les coordonnées bancaires, actuellement chiffrées et restant à décrypter.

https://t.co/bGWlBAFqEx

[FrenchBreaches @Frenchbreaches]

🔴 Fuite de données revendiquée visant Evy, spécialiste de l’assurance et de la protection de produits : environ 13 870 utilisateurs seraient concernés. Noms, e-mails, comptes, contrats, transactions, données de paiement, assurances et sinistres auraient été exfiltrés.

https://t.co/0vQR395QJ8

[X-VDP-X @6xvdpx]

We breached by diable'fire - X-VDP-X : https://t.co/c55Z7HeQ6Q

Entire database exfiltrated:
• 16 bases · 2645 tables · 238 Mo
• 13 870 members + plans + transactions + card
• contrats d'assurance , sinistres , payement
• Acces admin + SMTP

#XVDPX #Hacking #France

[X-VDP-X @6xvdpx]

We were breached by diable'fire- X-VDP-X: https://t.co/z2jvuOYKok

Data retrieved:

- Full dump database , config WordPress

- access SMTP

X-VDP-X

#XVDPX #HACKING #TARGET #FRANCE�  #RCE #cybersecurite #hacked #fuckchatcontrol

[X-VDP-X @6xvdpx]

We were breached by diable'fire- X-VDP-X:
https://t.co/wGgjSmLaeU

6,852 user accounts (emails hashed passwords)
121 tables: private messages + sessions
490 MB of post views 200 million records
Media AI results mode API logs
Premium payments ads products + auctions
We have 1.9 GB

[X-VDP-X @6xvdpx]

We were breached by diable'fire- X-VDP-X: https://t.co/wAQ6FpubKB

Data retrieved:

- Full dump database , config WordPress

- admin access

- deface

X-VDP-X

#XVDPX #HACKING #TARGET #FRANCE�  #RCE #cybersecurite #hacked #fuckchatcontrol