Dark Web Informer

One guy. Global cybercrime. Tracked so you don't have to. Ransomware, data breaches, dark web activity, darknet markets, IOCs & emerging threats. Stay informed!

[Dark Web Informer @DarkWebInformer]

‼️ Footage of the LeakBase domain administrator getting arrested in Taganrog, Russia.

https://t.co/RqCmNhSbn7

[Dark Web Informer @DarkWebInformer]

Source: https://t.co/wxF78OBQn9

[Dark Web Informer @DarkWebInformer]

🚨 Nvidia CEO Jensen Huang reportedly had a 2nd affair with his direct report, healthcare chief Kimberly Powell, according to The New York Times.

[Dark Web Informer @DarkWebInformer]

@VECERTRadar "The incident, caused by strong wind gusts and thunderstorms affecting the region"

[Dark Web Informer @DarkWebInformer]

When you harden Windows but leave the backdoor wide open.

[Dark Web Informer @DarkWebInformer]

John “Lick” Daghita has an arraignment tomorrow at a federal courthouse in Alexandria, Virginia, in connection with allegations he stole more than $46 million in cryptocurrency from the U.S. Marshals Service.

[Crumb @CrumbOSRS]

John "Lick" Daghita, who stole over $46M, has seemingly been extradited to the US and will appear in court tomorrow (Nov. 12th).

[Dark Web Informer @DarkWebInformer]

‼️🇺🇸 PLAY ransomware claims Minor League Baseball, with publication scheduled for November 15, 2026.

🇺🇸 Minor League Baseball (MiLB) - The professional baseball development system affiliated with Major League Baseball, consisting of teams across the United States and Canada.

The listing claims access to private and confidential data, client documents, budget and payroll records, IDs, tax records, financial information, and other internal files. The total data size has not been disclosed.

Claim is currently unverified.

[Dark Web Informer @DarkWebInformer]

Source: https://t.co/zMGkrF5rmZ

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/hXp6zyrZaS

Need API access? https://t.co/H0l3L44QTL

Check out the Telegram channel: https://t.co/KgFecRMigq

[Dark Web Informer @DarkWebInformer]

🚨 Node.js patches 16 security vulnerabilities, including a serious flaw that could expose TLS private keys

The Node.js project has released security updates addressing 16 vulnerabilities, including seven high-severity flaws affecting its widely used JavaScript runtime.

Among the most concerning is CVE-2026-123864, which could allow unauthenticated attackers to extract sensitive server memory, potentially exposing TLS private keys and other users' requests under specific conditions.

Additional vulnerabilities could allow attackers to crash servers remotely, leak sensitive information, bypass TLS authentication protections, and exhaust system resources.

Security updates are now available in Node.js 22.23.5, 24.22.3, and 26.13.1. Administrators are urged to upgrade affected deployments immediately.

[Dark Web Informer @DarkWebInformer]

🚨 A vulnerability in Telegram’s widget engine can lead to native code execution on affected clients

Research: https://t.co/sV01sQKweE

The issue stems from a QuickJS-ng parser bug that can trigger out-of-bounds memory corruption when a crafted Telegram widget is processed. According to the researcher, exploitation can occur during message rendering without requiring the user to open the widget.

Telegram Widgets | Remote Code Execution:

Impact: Native code execution
Android: RCE demonstrated on affected builds
iOS: RCE demonstrated on affected builds
Status: Later Telegram builds include mitigations

The research also documents additional memory corruption and use-after-free issues affecting Telegram’s widget engine and underlying QuickJS-ng implementation.

Per Telegram... "This issue in Telegram for Android was fixed yesterday, and the fix was deployed to all users earlier today."

[Dark Web Informer @DarkWebInformer]

‼️🇺🇸 n0n ransomware claims DraftKings, threatening to publish large datasets tied to customers and advertising audiences.

🇺🇸 DraftKings - A U.S.-based digital sports entertainment and gaming company offering sports betting, fantasy sports, and online casino products.

The listing claims the data includes:

• 6.3 million mobile advertising identifiers across three gaming audiences
• 7.4 million hashed consumer email addresses, with 2,886,388 allegedly resolved to named individuals
• Campaign demographic analytics covering 11,421 devices, including age, gender, language, handset, carrier, and app-profile data

Claim is currently unverified.

[Dark Web Informer @DarkWebInformer]

Source: https://t.co/kQdlpbOzXS

Enterprise-level intel, without the enterprise price tag. Plans for everyone. https://t.co/hXp6zyrZaS

Need API access? https://t.co/H0l3L44QTL

Check out the Telegram channel: https://t.co/KgFecRMigq

[Dark Web Informer @DarkWebInformer]

🚨 Hackers weaponize AntiFox AI agents to breach servers and steal AWS production secrets

Security researchers at Arctic Wolf have uncovered attacks using AntiFox, an open-source AI-powered penetration testing platform, to compromise internet-facing servers and steal sensitive AWS credentials.

Attackers hosted AntiFox on Alibaba Cloud infrastructure, deploying webshells, extracting database credentials, and abusing legitimate AWS identities to access cloud environments.

In one intrusion, attackers made hundreds of AWS API requests in just 30 minutes, successfully obtaining production secrets. Another incident involved unauthorized access to Amazon S3, where attackers read, copied, and deleted stored files.

The findings highlight how AI-powered hacking tools are increasingly being used in real-world attacks to automate reconnaissance and credential abuse.

[Dark Web Informer @DarkWebInformer]

🚨 Ubuntu reports a data center outage affecting multiple services, including its websites.

The Ubuntu archive is unaffected, and the team is investigating.

[Dark Web Informer @DarkWebInformer]

‼️🇫🇷 ARTE TV Data Leak Claim Lists 673,760 Records With 604,083 Email Addresses

https://t.co/Utri1xN2C3

[Dark Web Informer @DarkWebInformer]

Source: https://t.co/QsChOFRJq7

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/hXp6zysx0q

Need API access? https://t.co/H0l3L45oJj

Check out the Telegram channel: https://t.co/KgFecRMQ5Y

[Dark Web Informer @DarkWebInformer]

🚨🇩🇰 Shipping giant Maersk confirms data breach as @WhiteArmorxd ransomware demands $5 million

Danish shipping giant Maersk has confirmed that hackers gained unauthorized access to a legacy system inherited through a previous acquisition and stole data.

The WhiteArmor ransomware group claims to have stolen approximately 100GB of information from Maersk's logistics platform, including nearly 30,000 driver records, plaintext passwords, administrator accounts, delivery receipts, and mobile device logs.

The group is demanding $5 million in Bitcoin and has given Maersk 30 days to pay before threatening to release the stolen information.

Maersk says the breach is isolated, with no indication that other systems or customer operations were affected. The company also states that its findings so far suggest no sensitive data has been disclosed.

Claim is currently unverified.

[Dark Web Informer @DarkWebInformer]

Source: https://t.co/hfE5mlKZsh

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/hXp6zyrZaS

Need API access? https://t.co/H0l3L44QTL

Check out the Telegram channel: https://t.co/KgFecRMigq

[Dark Web Informer @DarkWebInformer]

🚨 Critical Fortinet2Shell flaw lets malicious websites execute code on FortiClient devices, CVE-2026-121529

Fortinet has patched a critical vulnerability in FortiClient that could allow attackers to execute malicious code on a victim's computer simply by getting them to visit a malicious website.

Dubbed Fortinet2Shell, the flaw carries a CVSS score of 9.1 and stems from improper security restrictions in a local API service.

Researchers demonstrated how attackers could exploit the weakness on systems with FortiPAM enabled, potentially compromising affected endpoints without authentication.

The vulnerability affects FortiClient 7.4.0 through 7.4.7 on Windows and macOS, along with Windows versions 7.2.0 through 7.2.14. Fortinet has released patched versions 7.4.8 and 7.2.15, with no confirmed exploitation in the wild.

[Dark Web Informer @DarkWebInformer]

Video:

[Dark Web Informer @DarkWebInformer]

🚨 eMudhra revokes 8 more certificate authorities after security failure, bringing total to 16

Indian certificate authority eMudhra has revoked eight additional intermediate certificate authorities (CAs) after discovering that a faulty internal Python script may have exposed sensitive RSA private key material.

The company previously declared these certificates unaffected by an October incident in which eight other CA private keys were generated with dangerously weak values, making them easily recoverable.

Although the newly revoked keys were not weakened, eMudhra could not verify that they were handled securely. The company is now exiting the publicly trusted TLS certificate business, with Microsoft, Google, Mozilla, and Apple moving to remove trust in affected certificates.

Microsoft will begin removing 10 remaining eMudhra root certificates on November 16, potentially disrupting services that still rely on them.