Rectifyq

Threat I̶n̶t̶e̶l̶l̶i̶g̶e̶n̶c̶e̶ ̶ Information focusing on Malaysia 🇲🇾

[Rectifyq @_rectifyq]

README
4 Categories
[Threat] [Data Breach] [Event] [Report]

Relevancy in 🇲🇾 context.
🔴- Highly relevant. e.g. APT target 🇲🇾.
🟡- Somewhat relevant. e.g. APT target Asian country.
🔵- Potentially relevant. e.g. Infostealers impact globally.
⚫ - Good to know only.

[yed @frdfzi]

@RempahRz NC4: https://t.co/aIrEh912xx

[MyCERT @mycert]

MA-1484.102026: MyCERT Advisory - Critical PHP2Shell Vulnerabilities in PHP Allowing Unauthenticated Remote Code Execution

#php2shell

https://t.co/iS1XZt5WNf

[Rempah @RempahRz]

1st blog post since my unemployment arc started. I have a chance to test BoxCompute by @farhanhelmycode and found a cross-tenant security vulnerability issue on it. Reported and fixed swiftly by the developer.

I'm currently open for any freelance job.

https://t.co/wxp3VjY8Wt

[Rectifyq @_rectifyq]

@DatukLoki Kenapa tidak, datuk?
Datuk boleh tekan request an invite dan isi borang selengkapnya.

https://t.co/AlQAsGQqWo

[Rectifyq @_rectifyq]

Wah. So touched 🥲 they really doing it.

[Rectifyq @_rectifyq]

You can also showcase your hard work and contributions on your public profile, but you’ll need to enable the feature first.

[Rectifyq @_rectifyq]

Btw, 2 features bit hidden but may be useful.
Hunting grounds provide quick links to search recent phish across src like threads, x ,fb, google search, urlscan or any site. U can have a custom for urself in "mine" tab.
Prjk Heimdall will be prsented at Minicon by 1 of the speaker

[Foxy @3ch0W15p]

beginner-friendly, hands-on session.

📅 Wednesday, 14 October 2026
⏰ 6:00 PM – 9:00 PM
📍 MSU, M0201
💻 Bring your laptop and your curiosity!

🔗 Join them here:
https://t.co/uxZdeaZSKN

[Rectifyq @_rectifyq]

5/5 Note: This challenge is organised and run solely by Rectifyq. PhishHunt is not affiliated with or endorsed by RawSEC, and RawSEC is not responsible or liable for anything related to this challenge, including the prize. We're simply supporting the RawSEC Minicon.

[Rectifyq @_rectifyq]

4/5 How to join:
1. Request an invite at https://t.co/pX5sQnjPiL
2. Complete all your details. It's open to Malaysians, and your LinkedIn profile helps us verify you're a real person
3. Start hunting 🔍

#PhishHunt #CyberSecurity #ThreatIntel

[Rectifyq @_rectifyq]

3/5 🏆 Prize: a free ticket to RawSEC Minicon 2026. Already bought one? Rectifyq will reimburse the ticket price (winner only).

The winner must fill in a short feedback form and attend Minicon in person. If not, the prize goes to the next hunter in line.

[Rectifyq @_rectifyq]

2/5 🛠️ Bring your own tools:
• your scripts
• your AI agents (API + MCP server)
• your own API keys (urlscan, VirusTotal and more)

PhishHunt is where your findings come together.

[Rectifyq @_rectifyq]

1/5 🎣 PhishHunt Challenge is live!

PhishHunt by Rectifyq is a gamified workbench for hunting phishing sites that target Malaysians. Not another URL analyzer: it tracks the hunt (find → validate → report → takedown) and scores you for it.

https://t.co/pX5sQnjPiL

[rehackxyz @rehackxyz]

RE:BOOT Community Partners announcement

https://t.co/iP7B7rJMat

@_rectifyq

[Laksamana Chengho @siberchengho]

We investigated a Windows malware delivery chain beginning with a ZIP archive delivered through WhatsApp targeting Malaysian.

https://t.co/gD5ppijB9W

Similar campaign to

https://t.co/sxnSPUcvH4

[Rectifyq @_rectifyq]

https://t.co/1KDu6MRer9

[VECERT Analyzer @VECERTRadar]

GLOBAL PREVENTIVE ALERT 🌐 🇨🇱 🇧🇷 🇲🇾 🇮🇩 🇰🇪 🇮🇳: MASS EXPOSURE OF ADMINISTRATIVE ACCESS

[STATUS: UNCONFIRMED / SOURCE: CYBER INTELLIGENCE CONSOLE / DATE: SEPTEMBER 11, 2026]

CENTRALIZED CYBER INTELLIGENCE MONITORING HAS DETECTED A MASS RELEASE OF ACCESS CREDENTIALS ON CLANDESTINE TELEGRAM CHANNELS BY THREAT ACTOR D1STR1CT9619. THE LEAK CONTAINS HUNDREDS OF DOMAINS COMPROMISED VIA THE CREATION OF AN UNAUTHORIZED ADMINISTRATIVE ACCOUNT (BACKDOOR).

The attack appears to stem from an automated exploitation campaign (possibly targeting vulnerabilities in content management systems like WordPress, as indicated by the filename `368x-wp_login.txt`). Across all affected domains, the actor has consistently injected or configured the username `Baby_Mushr00w`. The full scope and active exploitation of these credentials remain unconfirmed.

VECERT has not independently confirmed whether these credentials are functional; therefore, the status remains unconfirmed, and this serves as a preventive alert.

🌐 IMPACT ANALYSIS

Following an analysis of the more than 300 exposed domains, targets of high strategic criticality have been identified, spanning government entities, financial credit systems, and higher education institutions globally.

🏛️ GOVERNMENT AND DEFENSE SECTOR

🇨🇱 Chile: Directorate General of Civil Aeronautics (Aeronautical and aviation authority of the State of Chile).

🇧🇷 Brazil:— Official portal of the municipal government of Joinville, Santa Catarina.

🇮🇩 Indonesia: — Regional Development Planning Agency of the Barito Timur government.

🇻🇳 Vietnam: .vn — Binh Thuan Provincial Public Library (Public/Cultural Sector).

🏦 CRITICAL FINANCIAL AND CORPORATE SECTOR

🇲🇾 Malaysia — CTOS Digital, Malaysia's largest consumer and corporate credit reporting agency (High risk of PII and financial data compromise).

🎓 HIGHER EDUCATION SECTOR

🇰🇪 Kenya:— Kenyatta University (One of the country's largest public universities).

🇮🇩 Indonesia (Multiple): (Diponegoro University), (Ahmad Dahlan University).

🇮🇳 India: — Sri Ramakrishna Polytechnic College.

🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / HARDENING)

Rogue User Search and Eradication (Threat Hunting):

Immediately inspect CMS databases (e.g., the `wp_users` table in WordPress) for the user `Baby_Mushr00w`. Delete the account immediately and purge any active sessions or linked authentication tokens.

Access Log Audit (Access/Error Logs):

Review web server logs (Nginx/Apache) for HTTP POST requests to administrative endpoints (`/wp-login.php`, `/wp-admin/`, `/administrator/`) that coincide with the date of compromise or show evidence of login attempts using the reported username.

Initial Breach Remediation:

Simply deleting the user does not close the security gap. Source code must be audited using vulnerability scanning tools to identify the exploited plugin or theme. Temporarily restrict access to the admin panel using geo-blocking or IP filtering rules on the WAF/perimeter firewall.

🖥️ CENTRALIZED THREAT MONITORING SYSTEM

Intelligence System: https://t.co/wk9bZJ2Nli

Monitoring Console: https://t.co/5LuqwzYuS6

#Cybersecurity #DataLeak #AdminPanel #WordPress #D1STR1CT9619 #BabyMushr00w #ThreatIntel #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #TelegramLeaks #SecurityAlert #OSINT #CyberCrime #GovSecurity #FinSec

[Blue Lobster @warlocksmurf]

https://t.co/julQnAfvpb

Malaysia mentioned...

[Rectifyq @_rectifyq]

@luk3ysky5 @thisisfinx My baseless assumption: client first, potential client second, unlikely client -> blocklist, anyone else first come first serve? 🤣

[Dark Web Intelligence @DailyDarkWeb]

🇲🇾 20GB OF MALAYSIA LITTORAL COMBAT SHIP DOCUMENTS ADVERTISED FOR SALE

A threat actor is advertising what they claim is a 20GB collection of documents related to Malaysia’s Littoral Combat Ship (LCS) program.

The seller claims the material was extracted last year and contains approximately 30,000 PDF files dating from 2014 through 2025.

According to the listing, the collection includes:

* Factory Acceptance Test (FAT) records
* Calculation reports
* Technical drawings
* Additional engineering/project documentation
* Approximately 30,000 files / 20GB total

The entire collection is being offered for just $500 in cryptocurrency.

⚠️ Analyst Note:

This claim deserves attention because the advertised material is not simply personal or corporate data, it allegedly includes technical documentation associated with a national naval procurement program.

If authentic, engineering drawings, test records and calculation reports could expose sensitive information about system design, specifications, testing and the defense supply chain.

The provenance, authenticity and sensitivity of the advertised documents have not been independently verified.

#DDW #DarkWeb #Malaysia #CyberSecurity