F

Fortalezco la seguridad de tu sitio WordPress 🚀 Doy respuesta a incidentes de seguridad y malware 𝙒𝙤𝙧𝙙𝙥𝙧𝙚𝙨𝙨 𝙎𝙚𝙘𝙪𝙧𝙞𝙩𝙮 𝙀𝙣𝙩𝙝𝙪𝙨𝙞𝙖𝙨𝙩 🚨

[F @shinee_]

𝗔𝗹𝗲𝗿𝘁𝗮 🚨 | Campaña de #Phishing para @BancoEstado 🇨🇱, solicitando credenciales, coordenadas, datos de tarjeta y clave de cajero 🤯. Llamativo lo "𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗹𝗶𝘇𝗮𝗱𝗼" al usar nombre del usuario asociado al RUT y lo interactiva de la interfaz. #PhishingChile

[F @shinee_]

@chum1ng0 Están bien activos con 🇨🇱

[F @shinee_]

👀👀

[VECERT Analyzer @VECERTRadar]

🚨 STRATEGIC CYBER INTELLIGENCE ALERT: POSSIBLE PERMISSIVE INTRUSION INTO PUBLIC HEALTH SYSTEM — MINSAL CHILE 🇨🇱

⚠️ POSSIBLE HEALTH PLATFORM WITH POTENTIAL EXPOSURE OF NATIONAL HEALTH RECORDS

[STATUS: UNVERIFIED / UNDER INVESTIGATION / ATTRIBUTED TO THREAT ACTOR / CRITICAL RISK OF EXFILTRATION AND UNAUTHORIZED PRIVILEGED ACCESS]

Through proactive monitoring of cyber threat distribution channels and hacktivist activities, the publication of a manifesto by the RSA CRACKERS group was detected on May 28, 2026.

The threat actor claims to have exploited vulnerabilities and credential flaws in the systems of the Chilean Ministry of Health.

The group alleges that the breach potentially exposed more than 36 million health records of Chilean citizens. Under a "good faith" narrative, the attacker maintains that they did not exfiltrate the database or infect the service. However, the collected graphical evidence suggests that the actor maintained operational access to an active government platform.

🎯 Affected Entity: Chilean Ministry of Health

👤 Threat Actor: RSA CRACKERS

📂 Potential Volume and Impact: Theoretical exposure of up to 36 million patient records, medical histories, and national epidemiological information.

📊 Technical Breakdown and Visual Evidence Analysis

Through detailed analysis of the file, the following logical and operational compromise vectors can be deduced:

1. Credential Abuse Compromising Roles and Privileges
Generalized Access: The visual evidence in the sample image indicates that the attacker accessed the system using a legitimate but compromised corporate credential. This access likely granted them privileges to perform general queries on citizens, patients, and medical records.

Role and Institution Flexibility: The exposed web system has upper management modules that explicitly allow "Change institution" and "Select role." This means that the attacker had the operational capabilities to switch between different healthcare entities and modify their internal permissions as needed during the session.

2. Exposed Clinical and Demographic Data (PII and PHI)

The forms displayed in Screenshot_113.png reveal direct access to critical epidemiological control interfaces and patient data:

General and Epidemiological Background: Display of case notification forms, epidemiological weeks, final patient status classification (e.g., "Confirmed"), case number, corresponding SEREMI (e.g., SEREMI of Atacama), and contact information for healthcare professionals.

Patient Identification Form: Fields displaying the RUN (National Unique Identification Number), full names, surnames, sex, date of birth, patient status ("Alive" or "Deceased"), nationality, health insurance provider (e.g., FONASA), exact residential address (street, municipality, region of residence), and emergency cell phone numbers.

Geographic Segmentation: Full nationwide filtering capacity, encompassing drop-down menus for the Santiago Metropolitan Region (municipalities such as Alhué, Buin, Calera de Tango, Cerrillos, Cerro Navia, and Colina) and northern regions such as Tarapacá, Antofagasta, Atacama, Coquimbo, and Valparaíso.

🛡️ Emergency Mitigation and Recommendations

🛑 Revocation and Cross-Cutting Audit of Identities (Critical Priority): The Ministry of Health (MINSAL) is urged to immediately invalidate all active sessions on the epidemiological and patient registration portals. It is mandatory to identify the specific account used to capture the screenshots by cross-referencing access logs with the selected options (such as the Atacama Regional Health Authority (SEREMI) or the regional consultations of May 28).

🔒 Implementation of Geographic and Network Restrictions: Strengthen web application firewall (WAF) policies and restrict access to administration and role change modules exclusively through corporate VPN connections authenticated with two-factor authentication (MFA) based on hardware tokens.

⚡ Monitoring and Evaluation

🌐 Intelligence System: https://t.co/wk9bZJ3laQ

🛡️ Quickly assess your website's security with: https://t.co/YnDw1QkkYK

#CyberSecurity #DataLeak #Chile #Minsal #RSACrackers #Anci #Hacktivism #ThreatIntelligence #CiberAlert #VECERT #DataBreach #UnderInvestigation #PublicHealth

[F @shinee_]

@Zerial @ksha Ya ni se te ve por estos lados @zerial y tus tuit de infosec :c

[F @shinee_]

Que será del buen @ksha y @Zerial ? 🙄

[F @shinee_]

😟

[T13 @T13]

#AlertaT13 | Confirman que patente y parachoque hallado en río es del auto de concejala desaparecida de Villa Alegre
https://t.co/ydEXHOV8wj

[F @shinee_]

@ksha @Zerial Jajajaja 🤣 siempre me acuerdo de cuando aprendí de ti el ssh tunneling que buenos tiempos aquellos.

[F @shinee_]

Extraño esos días donde iba a la @8dot8

[F @shinee_]

Que habrá sido del joven Lit0v? Un día desapareció y nunca más super de él y con el, los servidores jsjs :/

[F @shinee_]

Solucionado, y de pasada gané dinero por mi servicios jsjs

[F @shinee_]

"Hackearon" un sitio que yo cree, pero que no quisieron el servicio de mantenimiento. Y ahora me amenazan con demandar 🙃, en una revisión rápida tiene plugins "premium" que yo no instale en la creación. Apostaría que están descargados de algún sitio de plugins piratas 🙃

[F @shinee_]

En fin, la hipocresía.

[F @shinee_]

"Hackearon" un sitio que yo cree, pero que no quisieron el servicio de mantenimiento. Y ahora me amenazan con demandar 🙃, en una revisión rápida tiene plugins "premium" que yo no instale en la creación. Apostaría que están descargados de algún sitio de plugins piratas 🙃

[TIAL @tial_cl]

🚨 Atención #Chile | web suplanta a Webpay para robo de información bancaria.

Dominio:
pagowebpayplus[.]cl

@1ZRR4H
#Ciberseguridad #Phishing #CTI #Fraude

[F @shinee_]

@1ZRR4H Jsjsjs si. y a que clientes contactar para ofrecer servicios ✅️

[F @shinee_]

n8n allá vamos 😴

[F @shinee_]

Porque Twitter se lleno de cuentas que cuentan una historia larga y fantástica que nunca les sucedió?

[F @shinee_]

Yo soy de la idea que el gob debería tener bug bounty 👀

[BioBioChile @biobio]

Trama hacker: el oficio secreto de la ANCI que alerta de ciberataque en curso a instituciones de salud https://t.co/mmbwNiGFqs

[F @shinee_]

Alguna novedad de rutify y cual es el origen de los datos de salud? Ya fue detectado el acceso y origen de los datos?

[F @shinee_]

Si, porque el formato de entrega de información es similar a sistema de institución de salud al consultar por previsión o datos de paciente, tipo sistema informático interno.

[Cassian Andor @C4ssian_Andor]

⚠️Desentrañando "Rutify": la plataforma hacker que expuso datos médicos y hoy es investigada por la PDI https://t.co/SQ4bLmBPfW vía @biobio

[F @shinee_]

@V3LM3NN1 Buena, gracias 🙏

[F @shinee_]

Cuantas universidades o centros educacionales en Chile 🇨🇱 afectados por esta brecha de seguridad? CANVAS LMS pwned por ShinyHunters .

[OpenHack @OpenHackAI]

🚨 BREAKING: Instructure, the company behind Canvas - the LMS tool used by almost every university in the United States, has been breached by popular threat actor ShinyHunters.

List of breached schools:
http://91.215.85.103/pay_or_leak/instructure_affected_schools_list.txt