‼️🇬🇹🇪🇨 Azzorti, a Latin American direct-sales beauty and fashion brand operating across Guatemala and Ecuador, has allegedly been breached, with the entire database from intranet.azzorti.com and intranet.azzorti.gt offered for sale.
⠀
‣ Threat Actor: NyxarGroup (in collaboration with Petro_Escobar & ArcRaidersPlayer)
‣ Category: Data Sale
‣ Victim: Azzorti
‣ Industry: Retail / Direct Sales / Cosmetics
⠀
The actor is selling access to two intranet sites belonging to Azzorti, claiming the dataset includes business operations data alongside customer/consultant PII. The leak is offered for $400.
⠀
What's in it:
⠀
▪️ Internal documents
▪️ Power BI reports
▪️ Supplier information
▪️ Product catalogs
▪️ Sales records
▪️ Business charts
▪️ Quotes
▪️ 2 databases with the following structure:
▪️Codigo (code), Identificacion (ID), Consec
▪️Zona (zone)
▪️Nombres / Apellidos (first/last names)
▪️Direccion (address)
▪️Telefonos (phone numbers)
▪️Distrito / Provincia (district/province)
▪️Camp Ingr, Digito, Cupo
▪️Pedidos (orders)
▪️Digito Anterior
▪️Direccion Referencia (reference address)
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
⠀
‣ Threat Actor: NyxarGroup (in collaboration with Petro_Escobar & ArcRaidersPlayer)
‣ Category: Data Sale
‣ Victim: Azzorti
‣ Industry: Retail / Direct Sales / Cosmetics
⠀
The actor is selling access to two intranet sites belonging to Azzorti, claiming the dataset includes business operations data alongside customer/consultant PII. The leak is offered for $400.
⠀
What's in it:
⠀
▪️ Internal documents
▪️ Power BI reports
▪️ Supplier information
▪️ Product catalogs
▪️ Sales records
▪️ Business charts
▪️ Quotes
▪️ 2 databases with the following structure:
▪️Codigo (code), Identificacion (ID), Consec
▪️Zona (zone)
▪️Nombres / Apellidos (first/last names)
▪️Direccion (address)
▪️Telefonos (phone numbers)
▪️Distrito / Provincia (district/province)
▪️Camp Ingr, Digito, Cupo
▪️Pedidos (orders)
▪️Digito Anterior
▪️Direccion Referencia (reference address)
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️ New Dark Web Informer Blog Post!
Title: Daily Dose of Dark Web Informer - May 4th, 2026
Link: https://darkwebinformer.com/daily-dose-of-dark-web-informer-may-4th-2026/
Title: Daily Dose of Dark Web Informer - May 4th, 2026
Link: https://darkwebinformer.com/daily-dose-of-dark-web-informer-may-4th-2026/
Dark Web Informer
Daily Dose of Dark Web Informer - May 4th, 2026
This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.
‼️🇧🇷 IUNGO Cloud (iungo.cloud), a Brazilian cloud-telephony operator, has allegedly been breached, with a 73 GiB portabilling database offered for sale as a one-time exclusive deal.
⠀
‣ Threat Actor: Fronx
‣ Category: Data Sale
‣ Victim: IUNGO Cloud
‣ Industry: Cloud Telephony / SaaS Communications
⠀
IUNGO provides cloud-based telephony services including hosted PBX, virtual extensions (ramais), contact centers, and omnichannel customer contact for SMBs and enterprises in Brazil. The actor is offering the database as a one-time sale.
⠀
What's in it:
⠀
▪️ 73 GiB portabilling database
▪️ Customer details
▪️ Call Detail Records (CDRs)
▪️ Customer balance information
▪️ Customer and employee email addresses
▪️ Phone numbers
▪️ Passwords
▪️ Massive PII
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
⠀
‣ Threat Actor: Fronx
‣ Category: Data Sale
‣ Victim: IUNGO Cloud
‣ Industry: Cloud Telephony / SaaS Communications
⠀
IUNGO provides cloud-based telephony services including hosted PBX, virtual extensions (ramais), contact centers, and omnichannel customer contact for SMBs and enterprises in Brazil. The actor is offering the database as a one-time sale.
⠀
What's in it:
⠀
▪️ 73 GiB portabilling database
▪️ Customer details
▪️ Call Detail Records (CDRs)
▪️ Customer balance information
▪️ Customer and employee email addresses
▪️ Phone numbers
▪️ Passwords
▪️ Massive PII
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
Chat, the last two channels died around 2800 subscribers... Join the backup https://t.me/SliceForLifeeee
Telegram
🔪 Slice For Life - Part 3 🔪
Main: t.me/SliceForLifeee
Website: darkwebinformer.com
Website Pricing (Includes Crypto): darkwebinformer.com/pricing
Socials: darkwebinformer.com/socials
API Access: https://darkwebinformer.com/api-details
Donate: darkwebinformer.com/donations
Website: darkwebinformer.com
Website Pricing (Includes Crypto): darkwebinformer.com/pricing
Socials: darkwebinformer.com/socials
API Access: https://darkwebinformer.com/api-details
Donate: darkwebinformer.com/donations
❤5
Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: San Diego Community College District
Domain:
Country: 🇺🇸 US
Date: May 4th, 2026
Summary:
The San Diego Community College District is currently facing a major cyberattack that began on Saturday, causing certain digital services such as email and enrollment platforms to go offline. Although all campuses remain open and the majority of classes continue, some ancillary operations are affected. The district states that despite the incident, no data has been compromised and is maintaining communication with students via various platforms.
Source: https://www.sandiegouniontribune.com/2026/05/04/san-diego-community-college-district-fighting-major-cyber-attack/
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: San Diego Community College District
Domain:
sdccd.eduCountry: 🇺🇸 US
Date: May 4th, 2026
Summary:
The San Diego Community College District is currently facing a major cyberattack that began on Saturday, causing certain digital services such as email and enrollment platforms to go offline. Although all campuses remain open and the majority of classes continue, some ancillary operations are affected. The district states that despite the incident, no data has been compromised and is maintaining communication with students via various platforms.
Source: https://www.sandiegouniontribune.com/2026/05/04/san-diego-community-college-district-fighting-major-cyber-attack/
San Diego Union-Tribune
San Diego Community College District fighting major cyberattack
The system’s four college are still open, but some digital services have been disrupted.
Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: ALS Limited
Domain:
Country: 🇦🇺 AU
Date: May 4th, 2026
Summary:
ALS Limited a révélé avoir détecté une activité cybernétique malveillante impliquant un accès non autorisé à certains de ses systèmes informatiques, provoquant une perturbation temporaire de certaines opérations. L'entreprise a mis en place des mesures de confinement et de remédiation, tout en informant le Centre australien pour la cybersécurité. ALS travaille actuellement à déterminer l'étendue de la violation et ses impacts potentiels sur les données des clients.
Source: https://www.tipranks.com/news/company-announcements/als-reports-cyber-incident-but-restores-most-operations
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: ALS Limited
Domain:
alsglobal.comCountry: 🇦🇺 AU
Date: May 4th, 2026
Summary:
ALS Limited a révélé avoir détecté une activité cybernétique malveillante impliquant un accès non autorisé à certains de ses systèmes informatiques, provoquant une perturbation temporaire de certaines opérations. L'entreprise a mis en place des mesures de confinement et de remédiation, tout en informant le Centre australien pour la cybersécurité. ALS travaille actuellement à déterminer l'étendue de la violation et ses impacts potentiels sur les données des clients.
Source: https://www.tipranks.com/news/company-announcements/als-reports-cyber-incident-but-restores-most-operations
TipRanks
ALS reports cyber incident but restores most operations
The latest update is out from ALS ( ($AU:ALQ) ). ALS Limited has disclosed that it recently detected malicious cyber activity involving unauthorised third-party acc...
Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: 4SELLERS
Domain:
Country: 🇩🇪 DE
Date: Apr 30th, 2026
Summary:
Le prestataire de services 4SELLERS, spécialisé dans les solutions e-commerce allemandes, a été victime d'une cyberattaque par rançongiciel (ransomware) en pleine nuit du 30 avril 2026.
Source: https://borncity.com/blog/2026/05/05/dienstleister-fuer-webshops-4sellers-opfer-eines-cyberangriffs/
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: 4SELLERS
Domain:
4sellers.deCountry: 🇩🇪 DE
Date: Apr 30th, 2026
Summary:
Le prestataire de services 4SELLERS, spécialisé dans les solutions e-commerce allemandes, a été victime d'une cyberattaque par rançongiciel (ransomware) en pleine nuit du 30 avril 2026.
Source: https://borncity.com/blog/2026/05/05/dienstleister-fuer-webshops-4sellers-opfer-eines-cyberangriffs/
Borns IT- und Windows-Blog
Dienstleister für Webshops, 4SELLERS, Opfer eines Cyberangriffs
Der Dienstleister 4SELLERS, der sich als „einer der größten deutschen Anbieter für E-Commerce-Lösungen“ bezeichnet, ist Opfer eines Cyberangriffs geworden. Ein Leser hat mich informiert…
1/2‼️🇪🇨 DIGERCIC (Dirección General de Registro Civil, Identificación y Cedulación), the Ecuadorian government civil registry agency, has allegedly been breached, with 14.8 million records and 10.6 million high-definition ID card images leaked.
⠀
‣ Threat Actor: GordonFreeman (joint operation with Izanagi & YoSoyGroot, under L4TAMFUCKERS team)
‣ Category: Data Leak
‣ Victim: DIGERCIC Ecuador
‣ Industry: Government / National ID Registry
⠀
The threat actors claim to have completely breached the DIGERCIC system, exfiltrating the entire national civil registry along with HD biometric images linked to citizen ID cards. The leak is presented as a "national alert" against Ecuador. Total dataset size: 165 GB of images plus 10.8 GB of SQL data.
⠀
What's in it:
⠀
▪️ 14.8 million records
▪️ 10.6 million high-definition ID card photographs linked to national ID numbers
▪️ Personal data fields:
- National ID (cédula)
- Full name
- Sex / gender
- Civil status (single, married, divorced, widowed)
- Nationality
- Place and date of birth
- Residence (address)
- Telephone and cell phone numbers
- Approximate age
- Family/relative information (parents, spouse, other family contacts)
- Province / canton / parish data (e.g., Pichincha, Quito, González Suárez)
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
⠀
‣ Threat Actor: GordonFreeman (joint operation with Izanagi & YoSoyGroot, under L4TAMFUCKERS team)
‣ Category: Data Leak
‣ Victim: DIGERCIC Ecuador
‣ Industry: Government / National ID Registry
⠀
The threat actors claim to have completely breached the DIGERCIC system, exfiltrating the entire national civil registry along with HD biometric images linked to citizen ID cards. The leak is presented as a "national alert" against Ecuador. Total dataset size: 165 GB of images plus 10.8 GB of SQL data.
⠀
What's in it:
⠀
▪️ 14.8 million records
▪️ 10.6 million high-definition ID card photographs linked to national ID numbers
▪️ Personal data fields:
- National ID (cédula)
- Full name
- Sex / gender
- Civil status (single, married, divorced, widowed)
- Nationality
- Place and date of birth
- Residence (address)
- Telephone and cell phone numbers
- Approximate age
- Family/relative information (parents, spouse, other family contacts)
- Province / canton / parish data (e.g., Pichincha, Quito, González Suárez)
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️ New Dark Web Informer Blog Post!
Title: CVE-2026-0073: Zero-Click RCE Flaw in Android's Wireless ADB Bypasses Authentication
Link: https://darkwebinformer.com/cve-2026-0073-zero-click-rce-flaw-in-androids-wireless-adb-bypasses-authentication/
Title: CVE-2026-0073: Zero-Click RCE Flaw in Android's Wireless ADB Bypasses Authentication
Link: https://darkwebinformer.com/cve-2026-0073-zero-click-rce-flaw-in-androids-wireless-adb-bypasses-authentication/
Dark Web Informer
CVE-2026-0073: Zero-Click RCE Flaw in Android's Wireless ADB Bypasses Authentication
❤1
1/2‼️ BLACKNET-00, a new ransomware-builder platform, is allegedly being sold on a hacking forum, marketed as a turnkey solution for creating customized ransomware operations.
⠀
‣ Threat Actor: blacknet00
‣ Category: Ransomware Sale / Malware-as-a-Service
‣ Product: BLACKNET-00 Platform
‣ Industry: Cybercrime / Ransomware Tooling
⠀
The actor is advertising a full ransomware-builder platform with a graphical interface, providing project management, multiple encryption algorithms, evasion mechanisms, persistence, and integrated extortion infrastructure (data leak + DDoS). The full source code is included with lifetime support and updates. Pricing is set at $2,000, payable only in cryptocurrency.
⠀
What's advertised:
⠀
▪️ GUI-based ransomware builder with tabbed interface and project templates
▪️ Save/load project settings, custom name, version, author, description
▪️ Output formats: EXE, PY, BAT, PS1, VBS, HTA, MSI, DLL, JS
▪️ Custom program icon, digital signature, full stealth mode
▪️ Encryption algorithms: AES-256, RSA, ChaCha20, XOR, Blowfish, Twofish, Serpent (128/192/256-bit keys)
▪️ Parallel multi-threaded encryption, filename encryption, secure deletion, multi-pass encryption
▪️ Target file selection (documents, images, videos, databases, backups), custom extensions, exclusions
▪️ Disables Windows Defender, Task Manager, Registry Editor, CMD, PowerShell, Control Panel, Safe Mode, System Restore
▪️ Process termination, hidden execution as admin, self-deletion, USB and local network spreading
▪️ Persistence: Startup folder, Registry Run, scheduled tasks, process injection, watchdog monitor
▪️ Custom desktop wallpaper, countdown timer, audio alerts, HTML ransom notes
▪️ C2 server configuration, encrypted file list reporting, Tor proxy, DGA system to avoid blocking
▪️ Statistics dashboard: builds, keys, victims, expected earnings
▪️ Extortion options: encryption only, data leak (double extortion), or DDoS (triple extortion)
▪️ Ransom discounts, deadlines, live chat negotiation, press release victim-pressure features
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
⠀
‣ Threat Actor: blacknet00
‣ Category: Ransomware Sale / Malware-as-a-Service
‣ Product: BLACKNET-00 Platform
‣ Industry: Cybercrime / Ransomware Tooling
⠀
The actor is advertising a full ransomware-builder platform with a graphical interface, providing project management, multiple encryption algorithms, evasion mechanisms, persistence, and integrated extortion infrastructure (data leak + DDoS). The full source code is included with lifetime support and updates. Pricing is set at $2,000, payable only in cryptocurrency.
⠀
What's advertised:
⠀
▪️ GUI-based ransomware builder with tabbed interface and project templates
▪️ Save/load project settings, custom name, version, author, description
▪️ Output formats: EXE, PY, BAT, PS1, VBS, HTA, MSI, DLL, JS
▪️ Custom program icon, digital signature, full stealth mode
▪️ Encryption algorithms: AES-256, RSA, ChaCha20, XOR, Blowfish, Twofish, Serpent (128/192/256-bit keys)
▪️ Parallel multi-threaded encryption, filename encryption, secure deletion, multi-pass encryption
▪️ Target file selection (documents, images, videos, databases, backups), custom extensions, exclusions
▪️ Disables Windows Defender, Task Manager, Registry Editor, CMD, PowerShell, Control Panel, Safe Mode, System Restore
▪️ Process termination, hidden execution as admin, self-deletion, USB and local network spreading
▪️ Persistence: Startup folder, Registry Run, scheduled tasks, process injection, watchdog monitor
▪️ Custom desktop wallpaper, countdown timer, audio alerts, HTML ransom notes
▪️ C2 server configuration, encrypted file list reporting, Tor proxy, DGA system to avoid blocking
▪️ Statistics dashboard: builds, keys, victims, expected earnings
▪️ Extortion options: encryption only, data leak (double extortion), or DDoS (triple extortion)
▪️ Ransom discounts, deadlines, live chat negotiation, press release victim-pressure features
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations