‼️🇬🇧 Arup Group allegedly breached by FulcrumSec exposing 700GB of GitHub repos and 2TB of Azure cloud data
A threat group operating under the name FulcrumSec has added a leak dubbed "The Arup Leaks" targeting Arup Group, the British engineering consultancy founded by Sir Ove Arup with around 17,000 employees across 90 offices and behind landmarks like the Sydney Opera House, Pompidou Centre, and Beijing's CCTV Headquarters. The actor claims to have spent close to half a year analyzing the data and went through email correspondence with the company before publishing, releasing GitHub repos via a .onion link and pointing to a separate archive list for Azure, S3, and database backups.
Post details:
▸ Actor(s): FulcrumSec
▸ Sector: Engineering / Architectural consultancy
▸ Type: Data Leak (dedicated leak site)
▸ Format: ~377GB compressed GitHub repos + ~2TB Azure Blob, AWS S3, DB backups
▸ Price: Free
▸ Country: United Kingdom (multinational scope)
▸ Date: 09/05/2026
Compromised data:
▪️ Over 700GB of private GitHub repositories (9,880+ private repos)
▪️ Nearly 2TB of Azure Blob Storage, AWS S3 buckets, and database backups
▪️ 39 Neuron BMS client databases
▪️ 49GB of Odoo ERP data
▪️ 129,000+ A66 landowner files
▪️ 313,650 ICC surveillance records
▪️ 37,835 Queensferry Crossing internal documents
▪️ Apple code-signing certificates with plaintext passwords
▪️ Complete ArupCompute and Oasys source code
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat group operating under the name FulcrumSec has added a leak dubbed "The Arup Leaks" targeting Arup Group, the British engineering consultancy founded by Sir Ove Arup with around 17,000 employees across 90 offices and behind landmarks like the Sydney Opera House, Pompidou Centre, and Beijing's CCTV Headquarters. The actor claims to have spent close to half a year analyzing the data and went through email correspondence with the company before publishing, releasing GitHub repos via a .onion link and pointing to a separate archive list for Azure, S3, and database backups.
Post details:
▸ Actor(s): FulcrumSec
▸ Sector: Engineering / Architectural consultancy
▸ Type: Data Leak (dedicated leak site)
▸ Format: ~377GB compressed GitHub repos + ~2TB Azure Blob, AWS S3, DB backups
▸ Price: Free
▸ Country: United Kingdom (multinational scope)
▸ Date: 09/05/2026
Compromised data:
▪️ Over 700GB of private GitHub repositories (9,880+ private repos)
▪️ Nearly 2TB of Azure Blob Storage, AWS S3 buckets, and database backups
▪️ 39 Neuron BMS client databases
▪️ 49GB of Odoo ERP data
▪️ 129,000+ A66 landowner files
▪️ 313,650 ICC surveillance records
▪️ 37,835 Queensferry Crossing internal documents
▪️ Apple code-signing certificates with plaintext passwords
▪️ Complete ArupCompute and Oasys source code
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
😈1
Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: Unoaerre
Domain:
Country: 🇮🇹 IT
Date: May 9th, 2026
Summary:
Unoaerre, a silversmithing company, fell victim to a cyberattack that paralyzed its operating system, prompting cybercriminals to demand a ransom of 3.8 million euros in bitcoin. Initial investigations suggest the attack may have links to countries in the Middle East and Eastern Europe. Despite the disruption, preliminary assessments indicate that the damage may not be irreversible and that production could resume.
Source: https://www.lanazione.it/arezzo/cronaca/attacco-hacker-unoaerre-p5f5bo2d
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: Unoaerre
Domain:
unoaerre.itCountry: 🇮🇹 IT
Date: May 9th, 2026
Summary:
Unoaerre, a silversmithing company, fell victim to a cyberattack that paralyzed its operating system, prompting cybercriminals to demand a ransom of 3.8 million euros in bitcoin. Initial investigations suggest the attack may have links to countries in the Middle East and Eastern Europe. Despite the disruption, preliminary assessments indicate that the damage may not be irreversible and that production could resume.
Source: https://www.lanazione.it/arezzo/cronaca/attacco-hacker-unoaerre-p5f5bo2d
La Nazione
Blitz dei pirati informatici. Attacco alla Unoaerre: “Dateci 3,8 milioni in bitcoin”
Hacker paralizzano il sistema operativo della grande azienda orafa aretina. Poi il messaggio: “Pagate 3,8 milioni di euro in bitcoin per sbloccare tutto”. Le indagini porterebbero a triangolazioni fra Paesi arabi e dell’Europa dell’Est
Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: Scope Systems
Domain:
Country: 🇦🇺 AU
Date: May 6th, 2026
Summary:
Several Australian mining companies are experiencing difficulties following a major cyberattack targeting a software provider in the sector, with a ransom demand issued. Among the potentially affected companies are Northern Star Resources and Evolution Mining, two of the country's largest gold miners. These companies are currently working to restore access to their critical technology systems.
Source: https://www.afr.com/technology/miners-data-targeted-as-hackers-hold-software-provider-to-ransom-20260508-p5zv16
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: Scope Systems
Domain:
scopesystems.com.auCountry: 🇦🇺 AU
Date: May 6th, 2026
Summary:
Several Australian mining companies are experiencing difficulties following a major cyberattack targeting a software provider in the sector, with a ransom demand issued. Among the potentially affected companies are Northern Star Resources and Evolution Mining, two of the country's largest gold miners. These companies are currently working to restore access to their critical technology systems.
Source: https://www.afr.com/technology/miners-data-targeted-as-hackers-hold-software-provider-to-ransom-20260508-p5zv16
Australian Financial Review
Miners’ data targeted as hackers hold software provider to ransom
Northern Star and Evolution Mining, the nation’s two biggest listed gold miners, are thought to be users of the Pronto Xi program that was hit.
🔥1
‼️🇪🇬 Mansoura University allegedly breached exposing 10GB+ of student data, research, and internal documents
A threat actor, posting in collaboration with CrowStealer, quellostanco, and bigF, claims to be selling a breach of Mansoura University, described in the post as one of the oldest and largest universities in Egypt. The package totals over 10GB and includes nearly 989,000 student records spanning 2012 to 2025/2026, plus thousands of research and internal PDFs and student photos.
Post details:
▸ Actor(s): INT3X (with CrowStealer, quellostanco, bigF)
▸ Sector: Education / University
▸ Type: Data Sale
▸ Format: CSV, PDF, image files
▸ Price: Negotiable (no data exchange accepted)
▸ Records: ~989,000 students + 3,853 research docs + 1,547 internal docs + 600MB student images
▸ Country: Egypt
▸ Date: 10/05/2026
Compromised data:
▪️ Username, Arabic name, English name
▪️ National ID number
▪️ Password and email
▪️ Language preference
▪️ University, faculty, year level
▪️ Enrollment status, study year, courses
▪️ 3,853 research PDFs and images (4.96GB)
▪️ 1,547 internal PDFs and images (3.72GB)
▪️ Student photographs (600MB)
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor, posting in collaboration with CrowStealer, quellostanco, and bigF, claims to be selling a breach of Mansoura University, described in the post as one of the oldest and largest universities in Egypt. The package totals over 10GB and includes nearly 989,000 student records spanning 2012 to 2025/2026, plus thousands of research and internal PDFs and student photos.
Post details:
▸ Actor(s): INT3X (with CrowStealer, quellostanco, bigF)
▸ Sector: Education / University
▸ Type: Data Sale
▸ Format: CSV, PDF, image files
▸ Price: Negotiable (no data exchange accepted)
▸ Records: ~989,000 students + 3,853 research docs + 1,547 internal docs + 600MB student images
▸ Country: Egypt
▸ Date: 10/05/2026
Compromised data:
▪️ Username, Arabic name, English name
▪️ National ID number
▪️ Password and email
▪️ Language preference
▪️ University, faculty, year level
▪️ Enrollment status, study year, courses
▪️ 3,853 research PDFs and images (4.96GB)
▪️ 1,547 internal PDFs and images (3.72GB)
▪️ Student photographs (600MB)
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️🇮🇩 Kota Gunungsitoli local government allegedly leaked exposing employee records from the Indonesian city's database
A threat actor claims to have leaked a database belonging to the Kota Gunungsitoli local government (gunungsitolikota.go.id) in Indonesia. The sample shows civil servant records with names, NIP employee IDs, birth details, ranks, and links to internal pejabat_pegawai photo paths.
Post details:
▸ Actor(s): JAX7
▸ Sector: Government / Municipal
▸ Type: Data Leak
▸ Format: SQL records
▸ Price: Free
▸ Country: Indonesia (Kota Gunungsitoli)
▸ Date: 10/05/2026
Compromised data:
▪️ Internal record ID
▪️ Full name (nama)
▪️ NIP (employee identification number)
▪️ Place of birth (temlahir) and date of birth (tgllahir)
▪️ Rank/class (gol)
▪️ Position/title (jab)
▪️ Department or unit (dik)
▪️ Internal photo file paths (pejabat_pegawai images)
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked a database belonging to the Kota Gunungsitoli local government (gunungsitolikota.go.id) in Indonesia. The sample shows civil servant records with names, NIP employee IDs, birth details, ranks, and links to internal pejabat_pegawai photo paths.
Post details:
▸ Actor(s): JAX7
▸ Sector: Government / Municipal
▸ Type: Data Leak
▸ Format: SQL records
▸ Price: Free
▸ Country: Indonesia (Kota Gunungsitoli)
▸ Date: 10/05/2026
Compromised data:
▪️ Internal record ID
▪️ Full name (nama)
▪️ NIP (employee identification number)
▪️ Place of birth (temlahir) and date of birth (tgllahir)
▪️ Rank/class (gol)
▪️ Position/title (jab)
▪️ Department or unit (dik)
▪️ Internal photo file paths (pejabat_pegawai images)
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️ German Authorities Shut Down Revived "Crimenetwork" Platform, Arrest Operator on Mallorca
https://www.bustedagaincrime.network/
German law enforcement has dismantled the relaunched version of the criminal online marketplace "Crimenetwork" and arrested its alleged operator on the Spanish island of Mallorca, the Federal Criminal Police Office (BKA) and the Frankfurt Public Prosecutor's Office's cybercrime unit (ZIT) announced on May 8, 2026.
The suspect, a 35-year-old German citizen, was detained at his Mallorca residence by a special unit of the Spanish National Police on the basis of a European arrest warrant. According to investigators, the man rebuilt an entirely new technical infrastructure under the same "Crimenetwork" name within days of the December 2024 takedown of the original platform and the arrest of its previous administrator. Spanish authorities executed two European arrest warrants against him, covering allegations of organized commercial fraud as well as the operation of a criminal trading platform on the darknet, and he is reportedly being held in Spanish extradition custody.
The reconstituted marketplace had grown into a substantial illicit operation before being shuttered. According to police, the platform most recently counted more than 22,000 users and over 100 sellers, who traded in stolen data, drugs, and forged documents. Users settled transactions in cryptocurrencies including Bitcoin, Litecoin, and Monero, and evidence seized during the operation points to platform revenues exceeding 3.6 million euros, with the operator collecting commissions on sales while sellers paid monthly fees for advertising and sales licenses.
Authorities provisionally secured assets of roughly 194,000 euros directly tied to "Crimenetwork" and obtained extensive user and transaction data expected to fuel further investigations. The case follows the recent sentencing of the original platform's administrator: in March 2026, the Gießen Regional Court handed down a prison term of seven years and ten months and ordered the confiscation of more than ten million euros in criminal proceeds, though the verdict is not yet final.
BKA Cybercrime division head Carsten Meywirth framed the action bluntly, saying the relaunch of Crimenetwork had failed and that another administrator would now have to answer to a German court, a reminder, he said, that "cybercrime does not pay."
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
https://www.bustedagaincrime.network/
German law enforcement has dismantled the relaunched version of the criminal online marketplace "Crimenetwork" and arrested its alleged operator on the Spanish island of Mallorca, the Federal Criminal Police Office (BKA) and the Frankfurt Public Prosecutor's Office's cybercrime unit (ZIT) announced on May 8, 2026.
The suspect, a 35-year-old German citizen, was detained at his Mallorca residence by a special unit of the Spanish National Police on the basis of a European arrest warrant. According to investigators, the man rebuilt an entirely new technical infrastructure under the same "Crimenetwork" name within days of the December 2024 takedown of the original platform and the arrest of its previous administrator. Spanish authorities executed two European arrest warrants against him, covering allegations of organized commercial fraud as well as the operation of a criminal trading platform on the darknet, and he is reportedly being held in Spanish extradition custody.
The reconstituted marketplace had grown into a substantial illicit operation before being shuttered. According to police, the platform most recently counted more than 22,000 users and over 100 sellers, who traded in stolen data, drugs, and forged documents. Users settled transactions in cryptocurrencies including Bitcoin, Litecoin, and Monero, and evidence seized during the operation points to platform revenues exceeding 3.6 million euros, with the operator collecting commissions on sales while sellers paid monthly fees for advertising and sales licenses.
Authorities provisionally secured assets of roughly 194,000 euros directly tied to "Crimenetwork" and obtained extensive user and transaction data expected to fuel further investigations. The case follows the recent sentencing of the original platform's administrator: in March 2026, the Gießen Regional Court handed down a prison term of seven years and ten months and ordered the confiscation of more than ten million euros in criminal proceeds, though the verdict is not yet final.
BKA Cybercrime division head Carsten Meywirth framed the action bluntly, saying the relaunch of Crimenetwork had failed and that another administrator would now have to answer to a German court, a reminder, he said, that "cybercrime does not pay."
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
😭1
‼️ New Dark Web Informer Blog Post!
Title: German Authorities Shut Down Revived "Crimenetwork" Platform, Arrest Operator on Mallorca
Link: https://darkwebinformer.com/german-authorities-shut-down-revived-crimenetwork-platform-arrest-operator-on-mallorca/
Title: German Authorities Shut Down Revived "Crimenetwork" Platform, Arrest Operator on Mallorca
Link: https://darkwebinformer.com/german-authorities-shut-down-revived-crimenetwork-platform-arrest-operator-on-mallorca/
Dark Web Informer
German Authorities Shut Down Revived "Crimenetwork" Platform, Arrest Operator on Mallorca
German law enforcement has dismantled the relaunched version of the criminal online marketplace "Crimenetwork" and arrested its alleged operator on the Spanish island of Mallorca, the Federal Criminal Police Office (BKA) and the Frankfurt Public Prosecutor's…
‼️9,500 passport and national ID card scans allegedly being sold mainly from France and Turkey
A threat actor is selling a 4.01GB compressed archive of 9,542 passport and national identity card scans, advertised as primarily sourced from France and Turkey but spanning multiple countries. The listing is priced at $1,000.
Post details:
▸ Actor(s): NormalLeVrai
▸ Sector: Identity documents (multi-country)
▸ Type: Data Sale
▸ Format: PDF and image scans, 4.01GB compressed
▸ Price: $1,000
▸ Records: 9,542 documents
▸ Countries: Primarily France and Turkey (mixed others)
▸ Date: 10/05/2026
Compromised data:
▪️ Passport scans
▪️ National identity card scans
▪️ Holder full names and dates of birth
▪️ Document numbers
▪️ Issue and expiry dates
▪️ Issuing country and authority
▪️ Photographs and signatures
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is selling a 4.01GB compressed archive of 9,542 passport and national identity card scans, advertised as primarily sourced from France and Turkey but spanning multiple countries. The listing is priced at $1,000.
Post details:
▸ Actor(s): NormalLeVrai
▸ Sector: Identity documents (multi-country)
▸ Type: Data Sale
▸ Format: PDF and image scans, 4.01GB compressed
▸ Price: $1,000
▸ Records: 9,542 documents
▸ Countries: Primarily France and Turkey (mixed others)
▸ Date: 10/05/2026
Compromised data:
▪️ Passport scans
▪️ National identity card scans
▪️ Holder full names and dates of birth
▪️ Document numbers
▪️ Issue and expiry dates
▪️ Issuing country and authority
▪️ Photographs and signatures
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️🏴☠️ Gollum Email Tools allegedly being sold as a four-part spam infrastructure suite on a hacking forum
A user is selling "Gollum Email Tools," a four-part offensive emailing toolkit pitched at "serious senders," covering bulk SMTP delivery, contact harvesting from compromised mailboxes, list hygiene, and country-based segmentation. The seller advertises lifetime licensing with prices ranging from $75 per individual tool to $300 for the full suite, with dedicated Telegram support and a separate "Gollum SMTP Service" for sending infrastructure.
Post details:
▸ Actor(s): GOLLUM
▸ Sector: Spam / Phishing infrastructure tooling
▸ Type: Tool Sale (suite)
▸ Format: Multi-threaded GUI mailer + CLI fetcher + GUI cleaner + GUI sorter
▸ Price: $150 mailer, $75 fetcher, $75 cleaner, $75 sorter, $300 full bundle
▸ Date: 10/05/2026
Capabilities described in the post:
▪️ Gollum Mailer Pro V3: bulk SMTP campaign sender with rotation, placeholders, Direct MX mode
▪️ HTML editor with inline images, random HTML/text letter rotation, subject and sender name rotation
▪️ Tracking, throttling, scheduling, bounce handler with suppression list
▪️ Obfuscation and spin syntax support, custom headers and placeholders
▪️ Gollum Email Fetcher V1: CLI mailbox harvester with 96 pre-loaded mail providers
▪️ Accepts email:password lists, extracts contacts at scale "in less than 2 minutes"
▪️ Gollum Email Cleaner: spam trap remover and verifier with syntax, MX, and blocked domain checks
▪️ Honeypot/spam trap detection, up to 300 threads, drag-and-drop input
▪️ Gollum Email Country Sorter: MX lookup and domain-based country resolution
▪️ Splits lists into per-country output files with up to 500 threads and duplicate removal
▪️ Workflow advertised as Fetch → Clean → Sort → Send
Defender notes:
▪️ Treat any list of victim email:password pairs as actively being mined; rotate compromised mailbox creds and enforce MFA on email
▪️ Hunt for IMAP/POP logins from new geographies on accounts shortly after credential leaks, especially with high outbound contact-list reads
▪️ Tune inbound mail policy on SPF/DKIM/DMARC and reject messages from senders abusing Direct MX delivery without authentication
▪️ Add new infrastructure indicators tied to GOLLUM SMTP service to phishing detection feeds
▪️ Watch for high-volume sender-name and subject-line rotation patterns in inbound campaigns; these are signatures of mailer-driven spam, not legitimate marketing
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A user is selling "Gollum Email Tools," a four-part offensive emailing toolkit pitched at "serious senders," covering bulk SMTP delivery, contact harvesting from compromised mailboxes, list hygiene, and country-based segmentation. The seller advertises lifetime licensing with prices ranging from $75 per individual tool to $300 for the full suite, with dedicated Telegram support and a separate "Gollum SMTP Service" for sending infrastructure.
Post details:
▸ Actor(s): GOLLUM
▸ Sector: Spam / Phishing infrastructure tooling
▸ Type: Tool Sale (suite)
▸ Format: Multi-threaded GUI mailer + CLI fetcher + GUI cleaner + GUI sorter
▸ Price: $150 mailer, $75 fetcher, $75 cleaner, $75 sorter, $300 full bundle
▸ Date: 10/05/2026
Capabilities described in the post:
▪️ Gollum Mailer Pro V3: bulk SMTP campaign sender with rotation, placeholders, Direct MX mode
▪️ HTML editor with inline images, random HTML/text letter rotation, subject and sender name rotation
▪️ Tracking, throttling, scheduling, bounce handler with suppression list
▪️ Obfuscation and spin syntax support, custom headers and placeholders
▪️ Gollum Email Fetcher V1: CLI mailbox harvester with 96 pre-loaded mail providers
▪️ Accepts email:password lists, extracts contacts at scale "in less than 2 minutes"
▪️ Gollum Email Cleaner: spam trap remover and verifier with syntax, MX, and blocked domain checks
▪️ Honeypot/spam trap detection, up to 300 threads, drag-and-drop input
▪️ Gollum Email Country Sorter: MX lookup and domain-based country resolution
▪️ Splits lists into per-country output files with up to 500 threads and duplicate removal
▪️ Workflow advertised as Fetch → Clean → Sort → Send
Defender notes:
▪️ Treat any list of victim email:password pairs as actively being mined; rotate compromised mailbox creds and enforce MFA on email
▪️ Hunt for IMAP/POP logins from new geographies on accounts shortly after credential leaks, especially with high outbound contact-list reads
▪️ Tune inbound mail policy on SPF/DKIM/DMARC and reject messages from senders abusing Direct MX delivery without authentication
▪️ Add new infrastructure indicators tied to GOLLUM SMTP service to phishing detection feeds
▪️ Watch for high-volume sender-name and subject-line rotation patterns in inbound campaigns; these are signatures of mailer-driven spam, not legitimate marketing
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️🇮🇩 Indonesian Ministry of Transportation (Dishub) allegedly breached exposing 93GB+ of vehicle and owner records
A threat actor claims to have a 93GB+ database from Dishub (dishub.go.id), tied to Indonesia's Kementerian Perhubungan, covering 38 provinces and 514 cities/regencies. The seller is asking $8,500 and explicitly opens the door to extortion by saying they are "open to negotiations to delete the database," with samples showing hundreds of thousands of vehicle and owner records concentrated in the Jakarta capital region.
Post details:
▸ Actor(s): Kyyzo
▸ Sector: Government / Transportation regulator
▸ Type: Data Sale (with deletion-fee extortion offered)
▸ Format: SQL records
▸ Price: $8,500 (open to "pay or sell" negotiation)
▸ Volume: 93GB+
▸ Coverage: 38 provinces, 514 cities/regencies
▸ Country: Indonesia
▸ Date: 10/05/2026
Compromised data:
▪️ Vehicle ID (id_kendaraan)
▪️ Owner full name (nama_pemilik)
▪️ License plate (nopol)
▪️ Account password
▪️ Route ID and route number (id_trayek, no_trayek)
▪️ Vehicle type (tipe_mobil) and brand/model (Suzuki, Daihatsu, Mitsubishi, etc.)
▪️ Year of manufacture (tahun_perakitan)
▪️ Body/category code (bbm, no_uji)
▪️ Chassis and engine numbers
▪️ Registration / inspection dates
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have a 93GB+ database from Dishub (dishub.go.id), tied to Indonesia's Kementerian Perhubungan, covering 38 provinces and 514 cities/regencies. The seller is asking $8,500 and explicitly opens the door to extortion by saying they are "open to negotiations to delete the database," with samples showing hundreds of thousands of vehicle and owner records concentrated in the Jakarta capital region.
Post details:
▸ Actor(s): Kyyzo
▸ Sector: Government / Transportation regulator
▸ Type: Data Sale (with deletion-fee extortion offered)
▸ Format: SQL records
▸ Price: $8,500 (open to "pay or sell" negotiation)
▸ Volume: 93GB+
▸ Coverage: 38 provinces, 514 cities/regencies
▸ Country: Indonesia
▸ Date: 10/05/2026
Compromised data:
▪️ Vehicle ID (id_kendaraan)
▪️ Owner full name (nama_pemilik)
▪️ License plate (nopol)
▪️ Account password
▪️ Route ID and route number (id_trayek, no_trayek)
▪️ Vehicle type (tipe_mobil) and brand/model (Suzuki, Daihatsu, Mitsubishi, etc.)
▪️ Year of manufacture (tahun_perakitan)
▪️ Body/category code (bbm, no_uji)
▪️ Chassis and engine numbers
▪️ Registration / inspection dates
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations