Mustafa Mamdouh

Malware Analyst & Threat Researcher , @cyberpen2023

[Dark Web Intelligence @DailyDarkWeb]

🇪🇬 Egypt - Mansoura University allegedly targeted in major data leak claim.

An underground forum actor claims to be selling and leaking data allegedly associated with Mansoura University, one of Egypt’s largest and oldest universities.

According to the threat actor, the alleged exposed data includes:
• Student records dating from 2012–2025/2026
• Usernames and names (Arabic and English)
• National ID numbers
• Email addresses
• Password-related fields
• Language, faculty, university, and course information
• Enrollment and academic status data
• Research documents and PDFs
• Internal university documents
• Student images/photos

The actor claims the leak contains:
• ~989,000 student records
• ~10GB+ total data volume
• Thousands of PDFs and internal images/documents

At this time:
• The claims remain unverified
• The authenticity and origin of the alleged dataset have not been independently confirmed
• No official public statement from Mansoura University regarding the claim has been observed

If authentic, the exposure could present significant risks involving:
• Identity theft and fraud
• Student-targeted phishing campaigns
• Credential stuffing attacks
• Academic document abuse
• Social engineering against students and faculty
• Potential misuse of national ID information

Educational institutions continue to face increasing cyber threats due to:
• Large centralized student databases
• Legacy infrastructure
• Broad user populations
• Extensive document storage systems
• High-value personal information repositories

Users associated with the university should remain cautious of:
• Emails requesting credential resets
• Fake academic portals
• Scholarship/payment scams
• SMS phishing and impersonation attempts

Daily Dark Web is continuing to monitor underground communities for additional samples, validation indicators, or official responses related to this claim.

#DDW #Intelligence #Egypt #CyberSecurity #DataLeak #DarkWeb #ThreatIntelligence #Education #University

[Mustafa Mamdouh @MMO23X]

@khaledeid_2000 @Ali_Albukhaiti @DrTalebJawad look at telegram bro 🫡

[Mustafa Mamdouh @MMO23X]

@Volk_407 منور يابرو

[Nicolas Krassas @Dinosn]

CVE-2024-11477: 7-Zip Vulnerability Allows Remote Code Execution https://t.co/7WTVH56NzT

[Mustafa Mamdouh @MMO23X]

@f__1977 @NewsNow4USA

[Michelle Khalil @Ap0phis133]

🔍Threat Actor Profiling: Turla Group (aka Snake/Uroburos)🔍
I'm currently diving deep into the Turla Group, a highly advanced Russian-speaking cyber-espionage organization that's been active since at least 2004.

TURLA Group profiling report in the link:
https://t.co/3xVQxzPWyy

[Mustafa Mamdouh @MMO23X]

@CyberBaronX @Cryptorebbel @DailyDarkWeb may be i thought they are indians u know what i mean

[Mustafa Mamdouh @MMO23X]

@azalsecurity كلسنه وانت طيب يبن عمي

[Maddy 🐝 @Cyb3rMaddy]

A Fed and Ed Sheeran. Who's who?

[Mustafa Mamdouh @MMO23X]

@AlvieriD please how can i get decryption id to open lockbit blog ?

[Mustafa Mamdouh @MMO23X]

@glumDumpst3rPro lol

[Mustafa Mamdouh @MMO23X]

ياصباح الطول المثالي 🫡

[Nidal @Nidal4real]

في مصر أنا أطول من ٩٥٪ من الرجالة 🇪🇬
لما وطأت أقدامي هولندا النسبة بقت ٥٦٪ 😂 🇳🇱
I got humbled so bad 😂

[Mustafa Mamdouh @MMO23X]

@vxunderground https://t.co/yddOmWRPe8

[vx-underground @vxunderground]

Regarding the recent so-called 'CrowdStrike' breach which was posted on BreachForum: this is not a data breach.

The individual responsible for the information ....disclosure, ...leak (?), operating under the moniker USDoD, openly states the data is scraped. Not sure why it's being labeled as a breach.

We briefly spoke with USDoD regarding it this afternoon. In summary, USDoD was able to programmatically abuse CrowdStrike endpoints to pull IOCs from CrowdStrike. The data pulled is proprietary, however this is the same information which is distributed to consumers.

According to USDoD scraping this data took quite a bit time (roughly a month), and the time the scrape operation completed it just so happened by chance to coincide with the recent CrowdStrike scandel – they've got bad luck it seems.

Photo courtesy of @FalconFeedsio

[Mustafa Mamdouh @MMO23X]

@AlvieriD please how can i access lockbit blog it's need a decryption id????

[Mustafa Mamdouh @MMO23X]

@buhaimedi كم تتوقع يكون سعرها عند الطرح ياطيب

[Mustafa Mamdouh @MMO23X]

@ahmed131996A @M0ATH .

[Mustafa Mamdouh @MMO23X]

@AlvieriD @vxunderground @ddd1ms @fastfire @H4ckManac @SOSIntel @DarkWebInformer @FalconFeedsio @ValeryMarchive what about decryption id ? how can i git it ?

[Mustafa Mamdouh @MMO23X]

@khaledeid_2000 هيخويخويخو

[Cyberpen @cyberpen2023]

🚨 اختراق وحدة المخابرات الإسرائيلية

#CyberAttack
#cybersecurity