‼️🇨🇴 Universidad del Cauca, a public university in Popayán, Colombia founded in 1827, has allegedly been breached, with a database containing student and personnel PII leaked.
⠀
‣ Threat Actor: Jansz (with GersonFDP)
‣ Category: Education Data Leak
‣ Victim: Universidad del Cauca
‣ Industry: Education / Public University
⠀
The actors leaked a database containing identity, contact, and residential information for university members.
⠀
What's in it:
⠀
▪️ Full names (first and last)
▪️ Document type and number (national ID, ID card, passport)
▪️ Date of birth
▪️ Gender
▪️ Location (DANE administrative codes)
▪️ Place of origin (street, municipality, department)
▪️ Current residence (street, municipality, department)
▪️ Email addresses (institutional and personal)
▪️ Verified phone numbers
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️🇬🇹 The Tribunal Supremo Electoral (TSE), Guatemala's Supreme Electoral Tribunal, has allegedly been breached, with 2,136 electronic signatures of TSE employees leaked. The signatures are used to validate official government documents and could be replicated to forge other official paperwork.
⠀
‣ Threat Actor: MrGoblinciano
‣ Category: Government Data Leak
‣ Victim: Tribunal Supremo Electoral (TSE) Guatemala
‣ Industry: Government / Electoral Authority
⠀
The actor states the dump was pulled directly from firmaelectronica.tse.org.gt and is being released for free. The TSE has since put its electronic signature service into maintenance mode, citing a "wave of cyberattacks against Guatemalan state institutions" and the activation of an Information Security Threat Response and Containment Plan.
⠀
What's in it:
⠀
▪️ 2,136 electronic signature images
▪️ Format: JPG
▪️ Signatures of TSE employees authorized to validate government documents
▪️ Sequentially numbered files (e.g. 9505 through 9532+) suggesting full enumeration of the signature database
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️🇧🇷 Guia de Motéis (guiademoteis.com.br), a Brazilian online motel guide and reservation app with over one million Google Play Store downloads, has allegedly been breached, with 1,596,471 customer records put up for sale.
⠀
‣ Threat Actor: joaoestrella
‣ Category: Data Sale
‣ Victim: Guia de Motéis (guiademoteis.com.br)
‣ Industry: Hospitality / Mobile App / Travel
⠀
The actor is selling customer data spanning from 2022 to present, including subscription records, plaintext passwords, and reservation history. The seller offered a "just login at guiademoteis.com.br" challenge as proof of access.
⠀
What's in it:
⠀
▪️ 1,596,471 customer records
▪️ Full names and dates of birth
▪️ Email addresses
▪️ Plaintext passwords
▪️ CPF (Brazilian national ID)
▪️ CEP (postal codes)
▪️ Phone numbers (landline and mobile)
▪️ Registration dates
▪️ Marketing/mailing preferences
▪️ Origin and account status
▪️ Reservation records (reservas_presenciais)
▪️ Subscription data (expiration dates, payment methods, plan release dates, status, cancellation, logs)
▪️ Coupon usage records
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️ Canonical has confirmed they and Ubuntu are under a DDoS attack. 313 Team has taken responsibility.

https://discourse.ubuntu.com/t/update-concerning-ddos-attack-on-canonical-and-ubuntu/81482
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV/EDR killer that disables mainstream consumer security software including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination with a Ring-3 rootkit, UAC bypass, and decoy payload delivery to support stealthy initial access operations.
⠀
‣ Threat Actor: ryewx1
‣ Category: Defense Evasion Tool / Killer
‣ Offering: ExEngine AV/EDR Killer
‣ Industry: Malware Tooling
⠀
The seller claims ExEngine actively terminates security software rather than only obfuscating payloads, granting attackers a longer window of undetected operation. The tool supports Windows 10 and 11 builds and is sold per-build at $150 to $250.
⠀
Advertised capabilities:
⠀
▪️ AV/EDR termination with primary and fallback techniques
▪️ UAC bypass with automatic privilege escalation
▪️ Ring-3 rootkit functionality to hide files, processes, registry keys, and network connections
▪️ Discord webhook logging for victim machine info and execution status
▪️ Secondary decoy payload (game/document/installer) to keep targets unaware
▪️ Persistence across reboots and logouts
▪️ Anti-VM and anti-debug detection with fake error message exit
▪️ Universal Windows 10/11 support, all payload types
⠀
Risk to defenders:
⠀
▪️ Active termination of consumer AV products including Windows Defender means traditional endpoint protections cannot be relied on once ExEngine executes successfully
▪️ Decoy payload pattern is designed to delay user-driven incident reporting, lengthening attacker dwell time
▪️ Ring-3 rootkit hiding of files, processes, and network connections complicates incident response triage on compromised hosts
▪️ Discord webhook telemetry indicates the operator is targeting consumer and SMB victims at scale rather than running individual targeted campaigns
▪️ Sold per-build at low cost ($150 to $250), making it accessible to low-skill operators who can pair it with commodity stealers, RATs, or loaders
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations