Cansado

@Must4nggg Exato, ser muito genérico não funciona. Tenta pegar uma pequena parte, estudar sobre ela e tentar aprender alguma tecnologia que o mercado utilize. Por exemplo. Gestão de vulnerabilidade, estude sobre, CVE, CVSS etc. Depois procure testar um OpenVaz, Qualys, Tenable, Rapid7.

Cansado @cansado4ever

about 2 months ago

@0xPira @FacanhaVicente Eu sempre faço doação para o padre Júlio Lancelote ou a CUFA.

240

cansado4ever retweeted

VECERT Analyzer

@VECERTRadar

about 2 months ago

CYBER INTELLIGENCE ALERT: ALLEGED SALE OF ACCESS TO BRAZILIAN FINTECH (US$70M+ REVENUE) 🇧🇷 💸 [STATUS: UNCONFIRMED / THREAT ACTIVITY / SALE OF ILLICIT ACCESS] An offer has been detected on specialized forums by the threat actor "romanticist," who claims to be selling privileged access to a Brazilian-based financial technology (Fintech) company with reported revenues exceeding US$70 million. Threat Actor: romanticist Sector: Fintech/Infratech/BaaS (Brazil) Assets and Access 📂 The attacker claims to have gained access to the following critical systems through looting techniques (not infostealers): Infrastructure: Top-level administrator account in the organization's GitHub repository, MSSQL access (SA account), S3 MinIO server, and Grafana dashboard. Web Environment: Primary WordPress domain and access to the Regcheq API. Sensitive Data: Production environment database dumps, including banking information for 590 clients, as well as the company's own bank account information. Other: Access to S3 buckets and a Twilio account. Security Considerations ⚠️ Severity of Compromise: Access to an MSSQL SA (System Administrator) account and the administrative-level GitHub repository allows for complete control over the development lifecycle and production data, which poses a critical threat to the organization's financial integrity. Strategic Monitoring Tools Intelligence Platform: https://t.co/wk9bZJ2Nli Security Verification: https://t.co/5LuqwzYuS6 #CyberSecurity #Brazil #Fintech #DataBreach #Looting #ThreatIntelligence #VECERT #UnderInvestigation

VECERTRadar's tweet photo. CYBER INTELLIGENCE ALERT: ALLEGED SALE OF ACCESS TO BRAZILIAN FINTECH (US$70M+ REVENUE) 🇧🇷 💸

[STATUS: UNCONFIRMED / THREAT ACTIVITY / SALE OF ILLICIT ACCESS]

An offer has been detected on specialized forums by the threat actor "romanticist," who claims to be selling privileged access to a Brazilian-based financial technology (Fintech) company with reported revenues exceeding US$70 million.

Threat Actor: romanticist

Sector: Fintech/Infratech/BaaS (Brazil)

Assets and Access 📂

The attacker claims to have gained access to the following critical systems through looting techniques (not infostealers):

Infrastructure: Top-level administrator account in the organization's GitHub repository, MSSQL access (SA account), S3 MinIO server, and Grafana dashboard.

Web Environment: Primary WordPress domain and access to the Regcheq API.

Sensitive Data: Production environment database dumps, including banking information for 590 clients, as well as the company's own bank account information.

Other: Access to S3 buckets and a Twilio account.

Security Considerations ⚠️

Severity of Compromise: Access to an MSSQL SA (System Administrator) account and the administrative-level GitHub repository allows for complete control over the development lifecycle and production data, which poses a critical threat to the organization's financial integrity.

Strategic Monitoring Tools Intelligence Platform:

https://t.co/wk9bZJ2Nli

Security Verification:

https://t.co/5LuqwzYuS6

#CyberSecurity #Brazil #Fintech #DataBreach #Looting #ThreatIntelligence #VECERT #UnderInvestigation

184

138K

Cansado @cansado4ever

2 months ago

@0xPira Ouvi do gerente executivo de uma das maiores empresas de tecnologia no Brasil que nós estávamos encontrando problemas e sendo proativos demais, precisávamos reduzir.

151

Cansado @cansado4ever

2 months ago

@fabricio_favaro @brunoguzzo Bom é você. Fala mais aí que vc sabe

Cansado @cansado4ever

2 months ago

@Conserv54962859 @brunoguzzo PT já governou o Rio de janeiro ?

Cansado @cansado4ever

2 months ago

@RheasSMITH1975 @brunoguzzo Você assistiu o vídeo com o ouvido desligado ? SE os Estados Unidos disseram que o pix é um instrumento do PCC e CV o pix sofre ameaça.

cansado4ever retweeted

Dark Web Intelligence

@DailyDarkWeb

2 months ago

THIS IS HUGE‼️ 🌐 “OnlyFans Mega Leak” allegedly containing approximately 340 million user records involving both fans and creators. According to the visible listing, the claimed dataset may include: • usernames and display names • email addresses • linked phone numbers • account creation dates • follower/subscriber metrics • likes and content statistics • creator/fan classifications • linked social profiles • partial payment card metadata (claimed last 4 digits) If authentic, this would represent one of the most operationally sensitive adult-platform-related exposures observed due to the combination of: • identity data • behavioral metadata • financial indicators • social linkage information • creator activity metrics The biggest risk here is not necessarily direct financial theft. The primary danger is: • extortion • doxxing • blackmail • targeted harassment • reputational attacks • account takeover campaigns • relationship/social exposure Adult-platform ecosystems are uniquely sensitive because attackers can combine: • usernames • linked social media • email reuse • payment references • creator/fan relationships • behavioral activity patterns to deanonymize users who believed their identities were separated from their online activity. For creators specifically, risks may include: • impersonation • stalking • swatting • revenue theft • subscriber fraud • credential compromise • targeted phishing pretending to be platform support or agencies For fans/users: • sextortion campaigns • phishing emails • credential stuffing • blackmail attempts • fake legal notices • cryptocurrency scams • exposure of private consumption habits One particularly concerning element is the reference to: • linked profiles • activity metrics • internal identifiers because these fields may allow correlation attacks across multiple platforms and previously leaked datasets. However, several important caveats exist: • extremely large breach claims are often exaggerated • underground actors frequently recycle older datasets • “scraped” data may originate from multiple unrelated leaks • partial data collections are sometimes rebranded as “internal databases” At this stage, the authenticity, source, freshness, and completeness of the alleged dataset remain unverified. Recommended immediate actions for users potentially affected: • change passwords immediately • enable MFA • avoid password reuse • monitor phishing attempts • review connected social accounts • monitor for impersonation attempts • remain alert for extortion emails or social engineering campaigns Platforms operating creator ecosystems should additionally: • monitor credential stuffing spikes • review API abuse • audit scraping protections • monitor underground marketplaces • strengthen anti-bot controls • alert high-risk creators proactively Because of the reputational and emotional sensitivity associated with adult-platform ecosystems, even limited verified exposure could have disproportionate real-world impact. 🌐 #DDW #Intelligence #CyberSecurity #DarkWeb #ThreatIntelligence #DataBreach #Infosec #OSINT #Privacy #OnlyFans