ThreatWardude

The information published is solely my personal opinion, and does not in any way reflect the opinion of my employer.

[VECERT Analyzer @VECERTRadar]

🚨 #VECERT_Alert: DATA BLACK MARKET IN MEXICO 🇲🇽💀

A massive operation involving the sale of sensitive information has been detected, led by a cybercriminal operating under the alias MagoSpeak. This individual has made available a criminal catalog that compromises the privacy of millions of citizens and the integrity of the country's most critical institutions.

🏦 BANKING AND RETAIL SECTORS UNDER ATTACK:

The cybercriminal claims to possess customer databases from:

Banks: Santander, BBVA, Banamex, Banorte, HSBC, Scotiabank, Invex, and Banco Azteca (Baz).

Retail/Consumer: Liverpool, Coppel, and Banco del Bajío.

Microfinance: Multibanco and Banco del Bienestar.

🗂️ GOVERNMENT INSTITUTIONS AND DATA:
The severity of the situation escalates with the confirmed exposure of records from:

🆔 Identity: INE (National Electoral Institute).

🏥 Health and Social Security: IMSS, Afores, and records of Retirees/Pensioners.

👴 Vulnerable Populations: Registries of older adults (65+ Program).

📞 TELECOMMUNICATIONS AND BUSINESSES:
MagoSpeak's criminal reach extends to user data from:

📱 Telcel, Movistar, AT&T.

🌐 Telmex, Totalplay.

🏢 Databases belonging to SMEs, Schools, and Large Corporations.

Monitor:

https://t.co/wk9bZJ3laQ

#CyberSecurity #DataLeak #Mexico #ThreatIntel #FinCrime #Ine #Imss #Infosec #MagoSpeak #BreakingNews

[The Hacker News @TheHackersNews]

🛑 Open VSX flaw lets attackers publish malicious VS Code extensions by bypassing scans.

Single boolean bug treated scan failures as “nothing to scan,” so extensions passed under load and went live.

🔗 How scan failures were misread and checks skipped → https://t.co/MCmczHHARQ

[VECERT Analyzer @VECERTRadar]

🚨 INTELLIGENCE ALERT: Massive Leak of 500,000 SAT Records – Mexico 🇲🇽📉

Our Analyzer platform has detected a high-impact security breach targeting Mexico's tax infrastructure. Threat actor s1ethx7z has put up for sale a database containing detailed information on half a million taxpayers registered with the Tax Administration Service (SAT).

Victim: SAT Taxpayers (Mexico) 🏛️.
Threat Actor: s1ethx7z 🎭.
Volume: 500,000 RFC records.
Date: March 26, 2026 🗓️.

📋 Compromised Data (PII and Tax Profile)

This leak is extremely dangerous because it combines official identifiers with details regarding the citizens' economic activity:

🔹 Legal Identifiers: Full names, CURP, and RFC.
🔹 Contact Information: Physical addresses and phone numbers.
🔹 Tax Profile: Tax regime, economic activity, email address, and SAT status.

Monitor:

https://t.co/wk9bZJ3laQ

#CyberSecurity #Mexico #SAT #RFC #DataBreach #s1ethx7z #IdentityTheft #FiscalSecurity #InfoSec #CyberAlert #HackingNews #CURP #SATMexico

[The Hacker News @TheHackersNews]

🚨 Coruna turns a 2023 #iOS espionage exploit into a broader attack kit.

Kaspersky confirms it reuses and evolves the Triangulation kernel exploit, now updated for newer chips and iOS versions and still actively maintained.

Now bundled into 23 exploits across 5 chains and used beyond targeted ops, it shows #iPhone exploitation is scaling.

🔗 How Coruna evolved and is being deployed → https://t.co/WVYDemCYQl

[The Hacker News @TheHackersNews]

🛑 A device code phishing campaign is hitting 340+ Microsoft 365 orgs using OAuth abuse.

Victims enter codes on real Microsoft pages, generating access and refresh tokens attackers reuse—even after password resets.

🔗 Read → https://t.co/tCiqeCee9q

[SANS DFIR @sansforensics]

How are #Ransomware actors getting initial access today?

#SocialEngineering is playing a bigger role with tactics like #ClickFix & Teams-based attacks showing up more often.

Join @rj_chap & @maridegrazia to see how it works, LIVE on Apr. 7 @ 1 PM EST: https://t.co/Y6eQ8iZQ3v

[The Hacker News @TheHackersNews]

🛑 Malicious LiteLLM versions 1.82.7–1.82.8 deploy credential theft, Kubernetes lateral movement, and a persistent backdoor.

Linked to the Trivy CI/CD compromise, the payload runs on import or via .pth at Python startup, spreads across nodes, and installs a systemd service.

🔗 Full story → https://t.co/YTx4kbP7kh

[volatility @volatility]

We have announced the winners of the 2025 @volatility
#PluginContest! And the First Place is:

Daniel Baier for XFRM Inspector

Read the full Contest Results in our blog post:
https://t.co/D5lwMbOJV0

Congrats to all winners & thank you to all participants!
#DFIR #memoryforensics

[Unit 42 @Unit42_Intel]

Since late December 2025, Unit 42 has responded to numerous incidents across various industries involving data theft and extortion likely associated with #BlingLibra (aka #ShinyHunters) and affiliated threat actors. Details on how to protect your org: https://t.co/MEB6RJH0rG

[Microsoft Threat Intelligence @MsftSecIntel]

The cybercriminal threat actor tracked by Microsoft Threat Intelligence as Storm-2561 is running an SEO-poisoning campaign that redirects people searching for enterprise VPN software to spoofed sites and malicious ZIP downloads leading to credential theft. https://t.co/KzTN7J6Rck

The ZIP file contains a malicious, digitally signed installer that masquerade as a trusted VPN client. The attack chain ultimately loads a variant of Hyrax infostealer that captures VPN sign-in credentials and VPN configuration data, and exfiltrates it to attacker infrastructure.

Read the full Microsoft Defender Experts analysis of the tactics, techniques, and procedures (TTPs) and indicators of compromise of this Storm-2561 campaign, and get protection, detection, and hunting guidance:

[The Hacker News @TheHackersNews]

INTERPOL dismantled 45,000 malicious IPs and servers tied to phishing, malware, and ransomware.

Operation Synergia III across 72 countries led to 94 arrests, 110 suspects under investigation, and seized devices and servers tied to global scam infrastructure.

🔗 Read → https://t.co/O0FCeTYypF

[Cyber Security News @The_Cyber_News]

📌Cisco Catalyst SD-WAN Vulnerabilities Allow Attackers to Gain Root Access

Source: https://t.co/3Lpm6KmwVO

An urgent security advisory from Cisco warns that multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could allow attackers to bypass authentication, gain root access, and overwrite critical files.

Two of these vulnerabilities are already being exploited in the wild by hackers, making immediate remediation critical.​

The advisory details five vulnerabilities, led by CVE-2026-20129, a critical authentication bypass flaw with a CVSS score of 9.8.

#CybersecurityNews

[The Hacker News @TheHackersNews]

🛑 Iran-linked hackers quietly embedded inside multiple U.S. organizations, Broadcom researchers report.

The campaign is tied to MuddyWater, an #Iranian state group. Attackers deployed a Deno-based backdoor and tried exfiltrating data using Rclone to cloud storage.

🔗 Read → https://t.co/jqP5zPADAu

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Defender Experts identified a widespread ClickFix social engineering campaign in February 2026 leveraging Windows Terminal as the primary execution mechanism. Rather than the traditional Win + R → paste → execute technique, this campaign instructs targets to use the Windows + X → I shortcut to launch Windows Terminal (wt.exe) directly, guiding users into a privileged command execution environment that blends into legitimate administrative workflows and appears more trustworthy to users.

This approach bypasses detections specifically tuned to Run dialog abuse while exploiting the legitimacy and familiarity of Windows Terminal. Once the terminal is opened, targets are prompted to paste malicious PowerShell commands delivered through fake CAPTCHA pages, troubleshooting prompts, or verification-style lures designed to appear routine and benign.

[Cyber Security News @The_Cyber_News]

🚨 Hackers Leveraged CyberStrikeAI Tool to Breach Fortinet FortiGate Devices

Source: https://t.co/9gSGFPiFqU

A new artificial intelligence (AI) offensive security tool called CyberStrikeAI, which is being actively leveraged by threat actors to target edge devices, particularly Fortinet FortiGate appliances.

This open-source platform, developed by a China-based individual with potential ties to state-sponsored operations, represents a significant escalation in the weaponization of AI for cyber attacks.

It features role-based testing, specialized skills systems, and comprehensive lifecycle management capabilities, all accessible via a centralized dashboard.

#cybersecuritynews #Fortinet

[The Hacker News @TheHackersNews]

⚠️ 600+ FortiGate devices breached in an AI-assisted campaign.

Team Cymru traced it to #CyberStrikeAI, an open-source Go tool bundling 100+ security utilities, run from 21 IPs across Asia and beyond.

The maintainer shows ties to #China’s vulnerability ecosystem.

🔗 Details → https://t.co/v82vlfdTlE

[The Hacker News @TheHackersNews]

⚠️ Four popular VS Code extensions expose developers to file theft and remote code execution.

Researchers say 125M+ installs are affected. Flaws in Live Server, Code Runner, and others enable localhost abuse, malicious configs, and code injection—some still unpatched.

🔗 Read → https://t.co/l7bOPlL1qK

[The Hacker News @TheHackersNews]

🐧 Researchers uncovered SSHStalker, a Linux botnet using IRC for control and mass SSH compromise.

It exploits 16 legacy kernel flaws to infect unpatched systems, wipes logs, and maintains silent persistence.

🔗 Details → https://t.co/Hzbt0HNToO

[FalconFeeds.io @FalconFeedsio]

🚨 Latin America Cyber Threat Alert | Dec 2025 – Feb 2026
LATAM is experiencing one of its worst cyber threat surges — massive government breaches, military database sales, biometric data theft, and ransomware. Thread 🧵👇

🇧🇷 Brazil — CATASTROPHIC government data exposure
→ Brazilian ARMY database for sale: 30 GB / 50M citizen records (names, CPFs, addresses, army rank, blood type) — $200 on BreachForums
→ PRODESP (São Paulo): 200 GB / 2M facial images + CPFs leaked
→ Repediu e-commerce: 21.4M customer records breached

→ Atacadão S. Furtado: 3,644 employee payroll records (salaries, CPFs, FGTS contributions)
→ Domain Admin access to a $10M Brazilian business services firm on sale (FortiGate + 115 hosts)
→ Sumek Brasil: website defaced by Z-BL4CX-H4T
Plus ransomware: The Gentlemen hit Agis (major engineering/construction group) and UNIGRANDE (university).

🇦🇷 Argentina — Biometric & identity data under siege
→ 637K driver license records for sale (350 GB) including biometric assets — priced at $700-$1,800
→ 58,680 citizen photos scraped from government TAD system (filenames = DNI numbers)

🇨🇴 Colombia — Government & aviation targeted
→ Root-level access to Colombian Government Emergency Response Agency on sale (Linux firewall, RCE, shell + admin panel)
→ Avianca airline: 6M passenger records for sale on dark web (names, emails, document numbers)

🇨🇱🇵🇪🇵🇦 Chile, Peru, Panama — Govt hits across the region
🇨🇱 Chile: Instituto Nacional de Derechos Humanos (INDH) — human rights watchdog hit by The Gentlemen ransomware
🇵🇪 Peru: Root RCE + shell access to capital’s regional government portal on sale
🇵🇦 Panama: Universidad de Panamá breached — passwords stored in PLAIN TEXT. Student/staff data exposed.

🇻🇪🇩🇴🇸🇻 Venezuela, Dominican Republic, El Salvador
🇻🇪 Venezuela: 65K Bancrecer bank records for sale (account numbers, balances, transaction history)
🇩🇴 Dominican Republic: Telemon SRL ISP — 42K customer records leaked (IDs, addresses, GPS coordinates, debt info)
🇸🇻 El Salvador: Access to two radio stations on sale via Pharaoh’s Team Market

🔑 Key LATAM takeaways
1⃣ Brazil is the #1 target — military, state govt, and private sector all compromised simultaneously
2⃣ Biometric data theft is surging (facial images, driver license photos, DNIs)
3⃣ The Gentlemen ransomware is emerging as a focused LATAM threat actor
4⃣ Government root-level access is being sold cheaply on forums
5⃣ Every major LATAM country has active threat exposure right now

[Microsoft Threat Intelligence @MsftSecIntel]

The latest Microsoft Threat Intelligence Podcast episode dives into tactics shaping financially motivated cybercrime as exemplified by Storm-0727, and threats against the financial services industry. https://t.co/zHq1TaL1lj

Storm-0727 uses classic, tried-and-tested techniques, including effective social engineering and deceptive domains, to target cryptocurrency exchanges, blockchain startups, gaming platforms, financial institutions, and even government organizations.

Across the broader financial services industry, three interrelated trends that take advantage of human and technical weaknesses continue to define the threat landscape: ransomware and extortion, social engineering and phishing-as-a-service (PhaaS) platforms, and business email compromise (BEC).

In discussing these topics, Sherrod DeGrippo, Megan Stalling, and Anna Seitz stress that cybercriminals often use the simplest method that works. They don’t need cutting-edge techniques, just effective ones. Strong credential hygiene, timely patching, and relentless disruption remain defenders’ best tools.