This media is not supported in your browser
VIEW IN TELEGRAM
RDP Stealer with Windows Defender Bypass
Video credit: youtube.com/@digitaldefenders76
________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
Video credit: youtube.com/@digitaldefenders76
________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
❤2
🚨🇯🇵 Okinawa Tourist Service allegedly breached: 600K+ customer records and ID document images advertised for sale
A threat actor claims to be selling customer data tied to Okinawa Tourist Service, a Japan-based travel and transportation company operating rental car and tourism services.
━━━━━━━━━━━━━━━━━━━━
Target: Okinawa Tourist Service
Sector: Travel / Transportation / Car Rental
Incident: Data Leak / Sale
Exposure: 600K+ customer records and 4,371 ID card image records
Actor: sexybroker
Country: Japan
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer records allegedly linked to Okinawa Tourist Service
▪️ Names, kana fields, gender, and birth date data
▪️ Address, ZIP/postal code, telephone, and email fields
▪️ Age and social media-related profile fields
▪️ Driver license numbers and license issue/expiration dates
▪️ Driver license image references and front/back ID card scans
▪️ CSV customer member database and image archive samples
Potential impact:
The exposed data could be used for identity theft, travel fraud, account impersonation, phishing, and targeted scams against rental car and tourism customers.
Status:
Unverified underground forum sale listing. The actor posted sample customer fields, archive counts, and driver license image previews as proof.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling customer data tied to Okinawa Tourist Service, a Japan-based travel and transportation company operating rental car and tourism services.
━━━━━━━━━━━━━━━━━━━━
Target: Okinawa Tourist Service
Sector: Travel / Transportation / Car Rental
Incident: Data Leak / Sale
Exposure: 600K+ customer records and 4,371 ID card image records
Actor: sexybroker
Country: Japan
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer records allegedly linked to Okinawa Tourist Service
▪️ Names, kana fields, gender, and birth date data
▪️ Address, ZIP/postal code, telephone, and email fields
▪️ Age and social media-related profile fields
▪️ Driver license numbers and license issue/expiration dates
▪️ Driver license image references and front/back ID card scans
▪️ CSV customer member database and image archive samples
Potential impact:
The exposed data could be used for identity theft, travel fraud, account impersonation, phishing, and targeted scams against rental car and tourism customers.
Status:
Unverified underground forum sale listing. The actor posted sample customer fields, archive counts, and driver license image previews as proof.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇿🇦 Gauteng Provincial Government allegedly breached: 3.8TB government portal dump advertised for sale
A threat actor claims to be selling a large data dump tied to the Gauteng Provincial Government, the provincial government authority for Gauteng, South Africa.
━━━━━━━━━━━━━━━━━━━━
Target: Gauteng Provincial Government
Sector: Government / Public Services
Incident: Data Breach / Data Sale
Exposure: 3.8TB across 3,673,556 files
Actor: Kazu
Country: South Africa
Price: $25,000
Date: 16/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Large-scale government portal data allegedly linked to Gauteng Provincial Government systems
▪️ Public service and departmental records
▪️ Government program and administrative files
▪️ Healthcare, education, housing, and economic development-related data
▪️ Multi-terabyte archive containing millions of files
Potential impact:
The exposed data could create privacy, operational, and public-sector security risks for residents, businesses, government departments, and service users across Gauteng.
Status:
Unverified underground forum sale listing. The actor claims the dump totals approximately 3.8TB and is being offered for sale with samples available through external channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling a large data dump tied to the Gauteng Provincial Government, the provincial government authority for Gauteng, South Africa.
━━━━━━━━━━━━━━━━━━━━
Target: Gauteng Provincial Government
Sector: Government / Public Services
Incident: Data Breach / Data Sale
Exposure: 3.8TB across 3,673,556 files
Actor: Kazu
Country: South Africa
Price: $25,000
Date: 16/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Large-scale government portal data allegedly linked to Gauteng Provincial Government systems
▪️ Public service and departmental records
▪️ Government program and administrative files
▪️ Healthcare, education, housing, and economic development-related data
▪️ Multi-terabyte archive containing millions of files
Potential impact:
The exposed data could create privacy, operational, and public-sector security risks for residents, businesses, government departments, and service users across Gauteng.
Status:
Unverified underground forum sale listing. The actor claims the dump totals approximately 3.8TB and is being offered for sale with samples available through external channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇪🇸 Health Time allegedly breached: 2.25M user records advertised for sale from Spanish medical diagnostics provider
A threat actor claims to be selling a database tied to Health Time / HT Médica, a Spanish medical imaging and diagnostic services provider operating diagnostic centers across Spain.
━━━━━━━━━━━━━━━━━━━━
Target: Health Time / HT Médica
Sector: Healthcare / Medical Diagnostics / Radiology
Incident: Data Breach / Data Sale
Exposure: 2,253,981 user records
Actor: Kazu
Country: Spain
Price: $4,000
Date: 16/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ User records allegedly linked to Health Time / HT Médica
▪️ Patient or customer profile data
▪️ Healthcare service-related account records
▪️ Diagnostic center and medical service metadata
▪️ Internal platform or portal-related records
▪️ Sample previews allegedly shared through external channels
Potential impact:
The exposed data could create serious privacy, compliance, phishing, impersonation, and healthcare fraud risks for patients, customers, and medical service users.
Status:
Unverified underground forum sale listing. The actor claims the dataset contains 2,253,981 user records and is being offered for $4,000 with samples available through external channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling a database tied to Health Time / HT Médica, a Spanish medical imaging and diagnostic services provider operating diagnostic centers across Spain.
━━━━━━━━━━━━━━━━━━━━
Target: Health Time / HT Médica
Sector: Healthcare / Medical Diagnostics / Radiology
Incident: Data Breach / Data Sale
Exposure: 2,253,981 user records
Actor: Kazu
Country: Spain
Price: $4,000
Date: 16/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ User records allegedly linked to Health Time / HT Médica
▪️ Patient or customer profile data
▪️ Healthcare service-related account records
▪️ Diagnostic center and medical service metadata
▪️ Internal platform or portal-related records
▪️ Sample previews allegedly shared through external channels
Potential impact:
The exposed data could create serious privacy, compliance, phishing, impersonation, and healthcare fraud risks for patients, customers, and medical service users.
Status:
Unverified underground forum sale listing. The actor claims the dataset contains 2,253,981 user records and is being offered for $4,000 with samples available through external channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇪🇸 Matferline allegedly breached: 703K Spanish driving school student records advertised for sale
A threat actor claims to be selling a database tied to Matferline, a Spanish cloud-based driving school management platform.
━━━━━━━━━━━━━━━━━━━━
Target: Matferline
Sector: Education / Driving School Software
Incident: Database Leak / Data Sale
Exposure: 703,450 records
Actor: macaroni
Country: Spain
Price: $35,000 full DB exclusive
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Student records allegedly linked to Matferline driving school systems
▪️ DNI identity number fields
▪️ Names and email addresses
▪️ Phone number fields
▪️ Usernames and account status data
▪️ Plaintext password fields referenced by the actor
▪️ Registration dates and profile photo references
▪️ Validated and deduplicated record subsets
Potential impact:
The exposed data could be used for identity theft, phishing, credential stuffing, student impersonation, and targeted scams against Spanish driving school students and operators.
Status:
Unverified underground forum sale listing. The actor claims the dataset was obtained through SQL injection and contains 703,450 total records, including 614,517 clean, deduplicated, and validated entries.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling a database tied to Matferline, a Spanish cloud-based driving school management platform.
━━━━━━━━━━━━━━━━━━━━
Target: Matferline
Sector: Education / Driving School Software
Incident: Database Leak / Data Sale
Exposure: 703,450 records
Actor: macaroni
Country: Spain
Price: $35,000 full DB exclusive
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Student records allegedly linked to Matferline driving school systems
▪️ DNI identity number fields
▪️ Names and email addresses
▪️ Phone number fields
▪️ Usernames and account status data
▪️ Plaintext password fields referenced by the actor
▪️ Registration dates and profile photo references
▪️ Validated and deduplicated record subsets
Potential impact:
The exposed data could be used for identity theft, phishing, credential stuffing, student impersonation, and targeted scams against Spanish driving school students and operators.
Status:
Unverified underground forum sale listing. The actor claims the dataset was obtained through SQL injection and contains 703,450 total records, including 614,517 clean, deduplicated, and validated entries.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨 PanARCH malware service advertised: Java RAT, exploit builder, payload delivery, and direct link hosting promoted on underground forum
A threat actor is advertising PanARCH, a malware-focused service bundle claiming to provide remote access tooling, payload-building modules, delivery infrastructure, and private file-hosting services.
━━━━━━━━━━━━━━━━━━━━
Service: PanARCH
Sector: Malware-as-a-Service / Cybercrime Infrastructure
Incident: Malware Service Advertisement
Exposure: Java RAT, exploit builder, delivery engine, and direct link service
Actor: PanARCH
Price: Pricing available via direct message
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Java RAT tooling marketed for multiple operating systems
▪️ Surveillance and remote access capabilities
▪️ Credential theft and browser data collection features
▪️ Payload builder modules for multiple delivery formats
▪️ Browser-based payload delivery infrastructure
▪️ Private direct-link file hosting with encrypted storage claims
▪️ Custom licensing and modular access options
Potential impact:
The advertised tooling could support unauthorized access, credential theft, malware delivery, persistence, and broader compromise of personal or enterprise systems.
Status:
Underground forum advertisement. The actor posted a detailed service panel and promotional material describing multiple malware and delivery components.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising PanARCH, a malware-focused service bundle claiming to provide remote access tooling, payload-building modules, delivery infrastructure, and private file-hosting services.
━━━━━━━━━━━━━━━━━━━━
Service: PanARCH
Sector: Malware-as-a-Service / Cybercrime Infrastructure
Incident: Malware Service Advertisement
Exposure: Java RAT, exploit builder, delivery engine, and direct link service
Actor: PanARCH
Price: Pricing available via direct message
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Java RAT tooling marketed for multiple operating systems
▪️ Surveillance and remote access capabilities
▪️ Credential theft and browser data collection features
▪️ Payload builder modules for multiple delivery formats
▪️ Browser-based payload delivery infrastructure
▪️ Private direct-link file hosting with encrypted storage claims
▪️ Custom licensing and modular access options
Potential impact:
The advertised tooling could support unauthorized access, credential theft, malware delivery, persistence, and broader compromise of personal or enterprise systems.
Status:
Underground forum advertisement. The actor posted a detailed service panel and promotional material describing multiple malware and delivery components.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇺🇸 Careficient allegedly breached: 164K patient and staff records exposed from home health EMR software provider
A threat actor claims to have leaked datasets tied to Careficient, a U.S.-based EMR software provider for home health, hospice, and home care management.
━━━━━━━━━━━━━━━━━━━━
Target: Careficient
Sector: Healthcare / EMR Software / Home Health
Incident: Database Leak
Exposure: 164,862 total records
Actor: attacker_company
Country: United States
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Patient dataset containing 163,644 records
▪️ Staff dataset containing 1,218 records
▪️ Patient identity and demographic fields
▪️ Medical reference identifiers and record metadata
▪️ Contact information including email and phone fields
▪️ Address records including city, state, and ZIP code fields
▪️ Staff account metadata and hashed authentication fields
▪️ Organization or agency-related records
Potential impact:
The exposed data could create serious privacy, compliance, phishing, impersonation, and healthcare fraud risks for patients, staff, agencies, and care providers.
Status:
Unverified underground forum claim. The actor posted dataset counts and field categories, with additional content hidden behind forum access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked datasets tied to Careficient, a U.S.-based EMR software provider for home health, hospice, and home care management.
━━━━━━━━━━━━━━━━━━━━
Target: Careficient
Sector: Healthcare / EMR Software / Home Health
Incident: Database Leak
Exposure: 164,862 total records
Actor: attacker_company
Country: United States
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Patient dataset containing 163,644 records
▪️ Staff dataset containing 1,218 records
▪️ Patient identity and demographic fields
▪️ Medical reference identifiers and record metadata
▪️ Contact information including email and phone fields
▪️ Address records including city, state, and ZIP code fields
▪️ Staff account metadata and hashed authentication fields
▪️ Organization or agency-related records
Potential impact:
The exposed data could create serious privacy, compliance, phishing, impersonation, and healthcare fraud risks for patients, staff, agencies, and care providers.
Status:
Unverified underground forum claim. The actor posted dataset counts and field categories, with additional content hidden behind forum access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇪🇬 Egypt Ministry of Tourism allegedly breached: 547GB employee and hotel-related government data advertised for sale
A threat actor claims to be selling databases allegedly tied to Egypt’s Ministry of Tourism, described in the post as affiliated with the Ministry of Interior.
━━━━━━━━━━━━━━━━━━━━
Target: Egypt Ministry of Tourism
Sector: Government / Tourism / Hospitality
Incident: Data Breach / Data Sale
Exposure: 547GB
Actor: Revesky
Country: Egypt
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Employee records allegedly linked to the Ministry of Tourism and hotel-related entities
▪️ Full names, parent names, job titles, and phone number fields
▪️ National ID and physical address fields
▪️ Hotel names, hotel locations, and governorate data
▪️ Employee profile picture documents
▪️ National ID, educational qualification, birth certificate, and training documents
▪️ Work contract, clearance certificate, legal check, and health certificate documents
Potential impact:
The exposed data could create identity theft, phishing, impersonation, fraud, and government-sector privacy risks for employees, hotels, and tourism-related entities.
Status:
Unverified underground forum sale listing. The actor claims the archive totals 547GB, with document samples and data samples hidden behind forum access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling databases allegedly tied to Egypt’s Ministry of Tourism, described in the post as affiliated with the Ministry of Interior.
━━━━━━━━━━━━━━━━━━━━
Target: Egypt Ministry of Tourism
Sector: Government / Tourism / Hospitality
Incident: Data Breach / Data Sale
Exposure: 547GB
Actor: Revesky
Country: Egypt
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Employee records allegedly linked to the Ministry of Tourism and hotel-related entities
▪️ Full names, parent names, job titles, and phone number fields
▪️ National ID and physical address fields
▪️ Hotel names, hotel locations, and governorate data
▪️ Employee profile picture documents
▪️ National ID, educational qualification, birth certificate, and training documents
▪️ Work contract, clearance certificate, legal check, and health certificate documents
Potential impact:
The exposed data could create identity theft, phishing, impersonation, fraud, and government-sector privacy risks for employees, hotels, and tourism-related entities.
Status:
Unverified underground forum sale listing. The actor claims the archive totals 547GB, with document samples and data samples hidden behind forum access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨KRYBIT RaaS advertised: ransomware affiliate program and data extraction tooling promoted on underground forum
A threat actor is advertising KRYBIT RaaS, a ransomware-as-a-service program seeking experienced penetration testing teams to join its partner operation.
━━━━━━━━━━━━━━━━━━━━
Service: KRYBIT RaaS
Sector: Ransomware-as-a-Service / Cybercrime Infrastructure
Incident: RaaS Advertisement
Exposure: Affiliate program, locker tooling, control panel, and data extraction utility
Actor: KRYBIT
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Ransomware affiliate program recruiting experienced operators
▪️ Configurable encryption modes and targeting options
▪️ Control panel with build generation and victim communication support
▪️ Windows, Linux, and ESXi tooling referenced by the actor
▪️ Data extraction utility for uploading or transferring stolen files
▪️ Support services marketed around negotiations and victim-facing communications
▪️ Dedicated leak and blog infrastructure shared by the actor
Potential impact:
The advertised service could support enterprise ransomware intrusions, data theft, extortion, operational disruption, and public leak campaigns against targeted organizations.
Status:
Underground forum advertisement. The actor posted Russian and English descriptions of the program, tooling, support model, leak infrastructure, and first-contact details.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising KRYBIT RaaS, a ransomware-as-a-service program seeking experienced penetration testing teams to join its partner operation.
━━━━━━━━━━━━━━━━━━━━
Service: KRYBIT RaaS
Sector: Ransomware-as-a-Service / Cybercrime Infrastructure
Incident: RaaS Advertisement
Exposure: Affiliate program, locker tooling, control panel, and data extraction utility
Actor: KRYBIT
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Ransomware affiliate program recruiting experienced operators
▪️ Configurable encryption modes and targeting options
▪️ Control panel with build generation and victim communication support
▪️ Windows, Linux, and ESXi tooling referenced by the actor
▪️ Data extraction utility for uploading or transferring stolen files
▪️ Support services marketed around negotiations and victim-facing communications
▪️ Dedicated leak and blog infrastructure shared by the actor
Potential impact:
The advertised service could support enterprise ransomware intrusions, data theft, extortion, operational disruption, and public leak campaigns against targeted organizations.
Status:
Underground forum advertisement. The actor posted Russian and English descriptions of the program, tooling, support model, leak infrastructure, and first-contact details.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations