CRITICAL SECTION

[12] Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached (HelpNetSecurity)
<p>Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: AI agents are still logging in as humans Most large companies run more than one AI platform at the same time. Developers pull up coding assistants, marketing teams lean on writing tools, and analysts query enterprise search across separate vendors. Single-provider setups keep giving way to mixed stacks as companies keep their options open. PR3TACK preemptive framework maps threats before &#8230;

CISA KEV (last 14 days)

No CISA KEV items found.

RANSOMWARE VICTIMS (today)

[RANSOMWARE]: [RANSOMWARE] Deadlock leaked West African Resources ltd, [RANSOMWARE] Section9 leaked *******.com, [RANSOMWARE] dragonforce leaked Syntron Bioresearch, [RANSOMWARE] dragonforce leaked Deluxe Medical Supply, [RANSOMWARE] ExfilSquad leaked District of Columbia Public Schools, [RANSOMWARE] ExfilSquad leaked Police National Legal Database, [RANSOMWARE] Global Secret Group leaked Nexon Corp., [RANSOMWARE] CRPxO leaked ProSmile Family Dental Care, [RANSOMWARE] CRPxO leaked Qube Aviation Catering, [RANSOMWARE] CRPxO leaked Performance Data Solutions, [RANSOMWARE] CRPxO leaked Host & Protect (RedBlink), [RANSOMWARE] CRPxO leaked RnnR Cloud, [RANSOMWARE] CRPxO leaked CodeConductor.ai, [RANSOMWARE] CRPxO leaked Prei Capital, [RANSOMWARE] CRPxO leaked FLP Law Group LLP, [RANSOMWARE] CRPxO leaked Summit Hill Insurance, [RANSOMWARE] CRPxO leaked MRO Aerospace, [RANSOMWARE] incransom leaked takethehop.com, [RANSOMWARE] Global Secret Group leaked Park Manufacturing Corp., [RANSOMWARE] ExfilSquad leaked Wesco International

NEWS

[7] [RANSOMWARE] Deadlock leaked West African Resources ltd (ransomware.live/Deadlock)
Victim: West African Resources ltd | Group: Deadlock | Website: www.westafricanresources.com | Country: AU | Details: West African Resources Limited (ASX: WAF) isan Australia-based, mid-tier gold mining and exploration companywith its primary operations located in Burkina Faso, West Africa . Founded in 2006, the company is headquartered in Subiaco, Western Australia, and focuses on the acquisition, development, and

[7] [RANSOMWARE] Section9 leaked *******.com (ransomware.live/Section9)
Victim: *******.com | Group: Section9 | Country: US | Details: ECOMMERCE

[7] [RANSOMWARE] dragonforce leaked Syntron Bioresearch (ransomware.live/dragonforce)
Victim: Syntron Bioresearch | Group: dragonforce | Website: syntron.net | Country: US | Details: Syntron Bioresearch, Inc. specializes in manufacturing rapid in vitro diagnostic tests and detection readers, focusing on fertility and over-the-counter tests for ovulation and pregnancy. The company is licensed as a Medical Device Establishment by the US FDA and the State of California Department o

[7] [RANSOMWARE] dragonforce leaked Deluxe Medical Supply (ransomware.live/dragonforce)
Victim: Deluxe Medical Supply | Group: dragonforce | Website: deluxemedical.com | Country: US | Details: Deluxe Medical Supply is a distributor of healthcare supplies that focuses on delivering quality home healthcare products and services. They provide a wide range of medical equipment, including mobility aids, incontinence supplies, and compression therapy garments, aimed at restoring independence an

[7] [RANSOMWARE] ExfilSquad leaked District of Columbia Public Schools (ransomware.live/ExfilSquad)
Victim: District of Columbia Public Schools | Group: ExfilSquad | Website: dcps.dc.gov | Country: US | Details: [AI generated] District of Columbia Public Schools (DCPS) is a public school district serving Washington, D.C., USA. It operates as the primary government-run K-12 educational system for the nation's capital, overseeing dozens of schools, thousands of students, and a large workforce of educators and

[7] [RANSOMWARE] ExfilSquad leaked Police National Legal Database (ransomware.live/ExfilSquad)
Victim: Police National Legal Database | Group: ExfilSquad | Country: GB | Details: DATA SUMMARY:
135k law enforcement contact records with first/last name, email, police force area, etc.

[6] [RANSOMWARE] Global Secret Group leaked Nexon Corp. (ransomware.live/Global Secret Group)
Victim: Nexon Corp. | Group: Global Secret Group | Website: nexon.com | Country: KR | Details: Internal infrastructure audit revealed multiple critical entry points across distributed network segments.

[5] [RANSOMWARE] CRPxO leaked ProSmile Family Dental Care (ransomware.live/CRPxO)
Victim: ProSmile Family Dental Care | Group: CRPxO | Country: US | Details: Sector: Healthcare / Dental | Data leaked: 9.6 GB

[5] [RANSOMWARE] CRPxO leaked Qube Aviation Catering (ransomware.live/CRPxO)
Victim: Qube Aviation Catering | Group: CRPxO | Country: US | Details: Sector: Aviation / Catering | Data leaked: 22.5 GB

[5] [RANSOMWARE] CRPxO leaked Performance Data Solutions (ransomware.live/CRPxO)
Victim: Performance Data Solutions | Group: CRPxO | Country: US | Details: Sector: Motorsport / Data Acquisition | Data leaked: 12.8 GB

[5] [RANSOMWARE] CRPxO leaked Host & Protect (RedBlink) (ransomware.live/CRPxO)
Victim: Host & Protect (RedBlink) | Group: CRPxO | Country: US | Details: Sector: Web Hosting / Security | Data leaked: 156.2 GB

[5] [RANSOMWARE] CRPxO leaked RnnR Cloud (ransomware.live/CRPxO)
Victim: RnnR Cloud | Group: CRPxO | Country: US | Details: Sector: Technology / Cloud Services | Data leaked: 68.9 GB

[5] [RANSOMWARE] CRPxO leaked CodeConductor.ai (ransomware.live/CRPxO)
Victim: CodeConductor.ai | Group: CRPxO | Website: CodeConductor.ai | Country: US | Details: Sector: Technology / AI / SaaS | Data leaked: 52.4 GB

[5] [RANSOMWARE] CRPxO leaked Prei Capital (ransomware.live/CRPxO)
Victim: Prei Capital | Group: CRPxO | Country: US | Details: Sector: Financial / Capital | Data leaked: 18.7 GB

[5] [RANSOMWARE] CRPxO leaked FLP Law Group LLP (ransomware.live/CRPxO)
Victim: FLP Law Group LLP | Group: CRPxO | Country: US | Details: Sector: Legal / Bankruptcy | Data leaked: 42.1 GB

[5] [RANSOMWARE] CRPxO leaked Summit Hill Insurance (ransomware.live/CRPxO)
Victim: Summit Hill Insurance | Group: CRPxO | Country: US | Details: Sector: Insurance | Data leaked: 34.5 GB

[5] [RANSOMWARE] CRPxO leaked MRO Aerospace (ransomware.live/CRPxO)
Victim: MRO Aerospace | Group: CRPxO | Country: US | Details: Sector: Aerospace / Defense | Data leaked: 87.3 GB

[5] [RANSOMWARE] incransom leaked takethehop.com (ransomware.live/incransom)
Victim: takethehop.com | Group: incransom | Website: takethehop.com | Country: US | Details: The HOP, an American regional public transit system operated by the Hill Country Transit District (HCTD). Founded in the 1960s in the state of Texas (USA) as a voluntary transportation service, the organization has grown over the decades into a major public public-transport network.

[5] [RANSOMWARE] Global Secret Group leaked Park Manufacturing Corp. (ransomware.live/Global Secret Group)
Victim: Park Manufacturing Corp. | Group: Global Secret Group | Website: parkmfg.com | Country: US | Details: Country: Cambridge, Minnesota 55008, US |
Website: parkmfg.com |
Revenue: $17.9 Million |
Industry: Appliances, Electrical, and Electronics Manufacturing |
Employees: 50-100 |
Properties: 195 GB (411,109 Files, 48,413 Folders)

[5] [RANSOMWARE] ExfilSquad leaked Wesco International (ransomware.live/ExfilSquad)
Victim: Wesco International | Group: ExfilSquad | Country: US | Details: Revenue: $24B

DATA SUMMARY:
2.6M~ records containing: customer and employee PII, account and contact data, CRM user profiles, credit and business identifiers, authentication metadata, and access information.

[5] [RANSOMWARE] genesis leaked Williams Accounting Professional (ransomware.live/genesis)
Victim: Williams Accounting Professional | Group: genesis | Website: bramptondirect.ca | Country: CA | Details: A full service CPA firm

[5] [RANSOMWARE] genesis leaked JJP Slip Forming Inc. (ransomware.live/genesis)
Victim: JJP Slip Forming Inc. | Group: genesis | Website: . | Country: US | Details: A company that operates in the Restaurants industry

[5] [RANSOMWARE] genesis leaked Building Envelope Systems (ransomware.live/genesis)
Victim: Building Envelope Systems | Group: genesis | Website: infinitypipeinc.com | Country: US | Details: A reputable construction company based in Plainville, MA

[5] [RANSOMWARE] genesis leaked Westlake Realty Group, Inc. (ransomware.live/genesis)
Victim: Westlake Realty Group, Inc. | Group: genesis | Website: westlake-realty.com | Country: US | Details: A full-service real estate development company

[5] [RANSOMWARE] genesis leaked Servonix Technologies (ransomware.live/genesis)
Victim: Servonix Technologies | Group: genesis | Website: servonix.com | Country: US | Details: A provider of IT services

[5] [RANSOMWARE] genesis leaked Infinity Pipeline,Inc. (ransomware.live/genesis)
Victim: Infinity Pipeline,Inc. | Group: genesis | Website: infinitypipeinc.com | Country: US | Details: A family owned, local construction company.

[5] [RANSOMWARE] Global Secret Group leaked Hinduja Tech | BMW Group & Škoda Auto (ransomware.live/Global Secret Group)
Victim: Hinduja Tech | BMW Group & Škoda Auto | Group: Global Secret Group | Website: hindujatech.com | Country: IN | Details: Country: India |
Website: hindujatech.com |
Revenue: $381 Million |
Industry: Engineering Services, Architecture, Engineering & Design, Product Engineering Solutions |
Employees: 2000-5000 |
Properties: 515 GB (212,785 Files, 83,982 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Pro-Tuff | Decals (ransomware.live/Global Secret Group)
Victim: Pro-Tuff | Decals | Group: Global Secret Group | Website: protuffdecals.com | Country: US | Details: Country: Crystal Lake, US |
Website: protuffdecals.com |
Revenue: $9.6 million |
Industry: Business Services General, Business Services |
Employees: 10-20 |
Properties: 412 GB (589,623 Files, 40,081 Folders)

[5] [RANSOMWARE] Deadlock leaked High Class Car Limo (ransomware.live/Deadlock)
Victim: High Class Car Limo | Group: Deadlock | Website: www.highclasscarlimo.com | Country: US | Details: High Class Limousine & Car Service Corp. is a licensed private passenger transportation service in New York City, founded in 1995, specializing in non-emergency medical transportation . The company provides rides to medical appointments, dialysis sessions, and rehabilitation facilities, and has loca

[5] [RANSOMWARE] anubis leaked Eagle Crest Communities (ransomware.live/anubis)
Victim: Eagle Crest Communities | Group: anubis | Website: eaglecrestlife.org | Country: US | Details: Patient and employee data breach at elderly care service.

[5] [RANSOMWARE] Global Secret Group leaked Spergel (ransomware.live/Global Secret Group)
Victim: Spergel | Group: Global Secret Group | Website: spergel.ca | Country: CA | Details: Country: Canada |
Website: spergel.ca |
Revenue: $28.2 Million |
Industry: Business Services,Project Management |
Employees: 51-200 |
Properties: 5.4 TB (7,830,792 Files, 902,844 Folders)

[5] [RANSOMWARE] Deadlock leaked Caspian One (ransomware.live/Deadlock)
Victim: Caspian One | Group: Deadlock | Website: www.caspianone.com | Country: AZ | Details: Caspian One is an international provider of IT services and specialist talent for industries such as FinTech investment banking and broadcasting. Based in England the company offers professional recruitment and managed technology solutions and operates in Europe and North America.

[5] [RANSOMWARE] Section9 leaked *****.com.pt (ransomware.live/Section9)
Victim: *****.com.pt | Group: Section9 | Country: PT | Details: UNIVERSITY

[5] [RANSOMWARE] Section9 leaked ********.com.uy (ransomware.live/Section9)
Victim: ********.com.uy | Group: Section9 | Country: UY | Details: FOOD & SERVICES

[5] [RANSOMWARE] Section9 leaked ****.fr (ransomware.live/Section9)
Victim: ****.fr | Group: Section9 | Country: FR | Details: RETAIL

[5] [RANSOMWARE] Section9 leaked ********.com (ransomware.live/Section9)
Victim: ********.com | Group: Section9 | Country: US | Details: NEWS

[5] [RANSOMWARE] Section9 leaked ******.com.se (ransomware.live/Section9)
Victim: ******.com.se | Group: Section9 | Country: SE | Details: HEALTHCARE

[5] [RANSOMWARE] Section9 leaked ******.com (ransomware.live/Section9)
Victim: ******.com | Group: Section9 | Country: US | Details: CYBERSECURITY

[5] [RANSOMWARE] Section9 leaked ****.com.mc (ransomware.live/Section9)
Victim: ****.com.mc | Group: Section9 | Country: MC | Details: TRAVEL & TOURISM

[5] [RANSOMWARE] Section9 leaked *****.ind.br (ransomware.live/Section9)
Victim: *****.ind.br | Group: Section9 | Country: BR | Details: AGRICULTURE

[5] [RANSOMWARE] Section9 leaked ********** (ransomware.live/Section9)
Victim: ********** | Group: Section9 | Details: CYBERSECURITY

[5] [RANSOMWARE] Section9 leaked *****.com.br (ransomware.live/Section9)
Victim: *****.com.br | Group: Section9 | Country: BR | Details: FINTECH

[5] [RANSOMWARE] Section9 leaked ****.com.br (ransomware.live/Section9)
Victim: ****.com.br | Group: Section9 | Country: BR | Details: TELECOM

[5] [RANSOMWARE] Section9 leaked ****.com (ransomware.live/Section9)
Victim: ****.com | Group: Section9 | Country: BE | Details: INDUSTRY

[5] [RANSOMWARE] Section9 leaked ********.com.jp (ransomware.live/Section9)
Victim: ********.com.jp | Group: Section9 | Country: JP | Details: SOFTWARE

[5] [RANSOMWARE] Section9 leaked *****.com.cn (ransomware.live/Section9)
Victim: *****.com.cn | Group: Section9 | Country: CN | Details: FINANCE

[5] [RANSOMWARE] Section9 leaked ******.net.br (ransomware.live/Section9)
Victim: ******.net.br | Group: Section9 | Country: BR | Details: TAX

[5] [RANSOMWARE] Section9 leaked ******.com.br (ransomware.live/Section9)
Victim: ******.com.br | Group: Section9 | Country: BR | Details: MEDIA

[5] [RANSOMWARE] Section9 leaked ********.com.br (ransomware.live/Section9)
Victim: ********.com.br | Group: Section9 | Country: BR | Details: MINING

[5] [RANSOMWARE] Global Secret Group leaked Prism Telecom (ransomware.live/Global Secret Group)
Victim: Prism Telecom | Group: Global Secret Group | Website: prismtelecom.com | Country: FI | Details: Backbone network traffic analysis and SS7 protocol vulnerability assessment across 3 continents.

[5] [RANSOMWARE] Global Secret Group leaked Cipher Dynamics (ransomware.live/Global Secret Group)
Victim: Cipher Dynamics | Group: Global Secret Group | Website: cipherdyn.com | Country: IN | Details: Zero-trust architecture review and cryptographic key management assessment.

[5] [RANSOMWARE] Global Secret Group leaked Stratos Network (ransomware.live/Global Secret Group)
Victim: Stratos Network | Group: Global Secret Group | Website: stratosns.com | Country: AE | Details: Satellite communication relay analysis with deep-packet inspection across 14 ground stations.

[5] [RANSOMWARE] Global Secret Group leaked OmniLink AG (ransomware.live/Global Secret Group)
Victim: OmniLink AG | Group: Global Secret Group | Website: omnilink.software | Country: DE | Details: Full-scope penetration testing of financial transaction processing pipeline and API gateway.

[5] [RANSOMWARE] Global Secret Group leaked Vertex Systems (ransomware.live/Global Secret Group)
Victim: Vertex Systems | Group: Global Secret Group | Website: vertexsystems.com | Country: US | Details: Ongoing analysis of cloud-native architecture and microservice communication protocols.

[5] [RANSOMWARE] Global Secret Group leaked Farmers Mutual Fire Insurance (ransomware.live/Global Secret Group)
Victim: Farmers Mutual Fire Insurance | Group: Global Secret Group | Website: farmersofmarble.com | Country: US | Details: Country: Pennsylvania, United States |
Website: farmersofmarble.com |
Revenue: $5.2 Million |
Industry: Insurance |
Employees: 11-50 |
Properties: 5.72 GB (18,699 Files, 2,631 Folders)

[5] [RANSOMWARE] Global Secret Group leaked West Sixth Law (ransomware.live/Global Secret Group)
Victim: West Sixth Law | Group: Global Secret Group | Website: agslawyers.com | Country: US | Details: Country: Columbus, Indiana, United States |
Website: agslawyers.com |
Revenue: $5 Million |
Industry: Law Firms & Legal Services |
Employees: 11-50 Employees |
Properties: 328 GB (708,816 Files, 47,925 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Baker Business & Tax Solutions (ransomware.live/Global Secret Group)
Victim: Baker Business & Tax Solutions | Group: Global Secret Group | Website: bakerbusinessandtax.com | Country: US | Details: Country: Kentucky, United States |
Website: bakerbusinessandtax.com |
Revenue: $1 Million |
Industry: Accounting for Legal Practices |
Employees: 1-10 Employees |
Properties: 213Gb (817,209 Files, 48,866 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Carpets Direct (ransomware.live/Global Secret Group)
Victim: Carpets Direct | Group: Global Secret Group | Website: carpetsdirectfindlay.com | Country: US | Details: Country: Ohio, United States |
Website: carpetsdirectfindlay.com |
Revenue: $5 Million |
Industry: Retail,Furniture |
Employees: 11-50 |
Properties: 31.1 GB (1,442 Files, 788 Folders)

[5] [RANSOMWARE] Global Secret Group leaked AnyWeather (ransomware.live/Global Secret Group)
Victim: AnyWeather | Group: Global Secret Group | Website: ohrestorationservices.com | Country: US | Details: Country: Kentucky, United States |
Website: ohrestorationservices.com |
Revenue: $6 Million |
Industry: Construction |
Employees: 30 Employees |
Properties: 301 GB (33,041 Files, 4,133 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Middendorf Animal Hospital & Laser Centre (ransomware.live/Global Secret Group)
Victim: Middendorf Animal Hospital & Laser Centre | Group: Global Secret Group | Website: middendorfanimalhospital.com | Country: US | Details: Country: Kentucky, United States |
Website: middendorfanimalhospital.com |
Revenue: <$5 Million |
Industry: Healthcare Services,Veterinary Services |
Employees: 11-50 |
Properties: 28.1 GB (34,237 Files, 8,806 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Chappell Supply & Equipment (ransomware.live/Global Secret Group)
Victim: Chappell Supply & Equipment | Group: Global Secret Group | Website: chappellsupply.com | Country: US | Details: Country: Oklahoma, United States |
Website: chappellsupply.com |
Revenue: $9.2 Million |
Industry: Consumer Services,Retail,Manufacturing,Repair Services |
Employees: 11-50 |
Properties: 160 GB (268,758 Files, 30,522 Folders)

[5] [RANSOMWARE] Global Secret Group leaked La Sevillanita (ransomware.live/Global Secret Group)
Victim: La Sevillanita | Group: Global Secret Group | Website: lasevillanita.com | Country: AR | Details: Country: Argentina |
Website: lasevillanita.com |
Revenue: $15 million |
Industry: Freight & Logistics Services,Transportation |
Employees: 11-50 |
Properties: 200 GB (385,318 Files, 13,074 Folders)

[5] [RANSOMWARE] Global Secret Group leaked One Plus Capital (ransomware.live/Global Secret Group)
Victim: One Plus Capital | Group: Global Secret Group | Website: onepluscapital.net | Country: CY | Details: Country: Cyprus |
Website: onepluscapital.net |
Revenue: $7 Million |
Industry: Finance |
Employees: 11-50 |
Properties: 117 GB (285,919 Files, 32,404 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Acens | Cloud & Backup (ransomware.live/Global Secret Group)
Victim: Acens | Cloud & Backup | Group: Global Secret Group | Website: acens.com | Country: ES | Details: Country: Spain |
Website: acens.com |
Revenue: $46.3 Million |
Industry: Hosting |
Employees: 201-500

[5] [RANSOMWARE] Global Secret Group leaked West Nova Fuels & Superline Fuels (ransomware.live/Global Secret Group)
Victim: West Nova Fuels & Superline Fuels | Group: Global Secret Group | Website: westnovasuperline.ca | Country: CA | Details: Country: Canada |
Website: westnovasuperline.ca |
Revenue: $18.9 Million |
Industry: Convenience Stores, Gas Stations & Liquor Stores |
Employees: 51-200 |
Properties: 45.8 GB (114,200 Files, 2,672 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Sinop Energia (ransomware.live/Global Secret Group)
Victim: Sinop Energia | Group: Global Secret Group | Website: sinopenergia.com.br | Country: BR | Details: Country: Brazil |
Website: sinopenergia.com.br |
Revenue: $12.2 Million |
Industry: Electricity, Oil & Gas |
Employees: 51-200 |
Properties:300 GB (43,113 Files, 5,372 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Al Hayat | Pepsi (ransomware.live/Global Secret Group)
Victim: Al Hayat | Pepsi | Group: Global Secret Group | Website: alhayatco.com | Country: IQ | Details: Country: Iraq |
Website: alhayatco.com |
Revenue: $100 Million |
Industry: Food & Beverage |
Employees: 501-1,000 |
Properties: 138 GB (205,992 Files, 17,178 Folders)

[5] [RANSOMWARE] Global Secret Group leaked SPDM (ransomware.live/Global Secret Group)
Victim: SPDM | Group: Global Secret Group | Website: spdm.org.br | Country: BR | Details: Country: Brazil |Website: spdm.org.br |Revenue: $197 Million |Industry: Hospitals & Clinics |Employees: 10.000 – 20.000 |Properties: 847 GB (871,912 Files, 76,047 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Nourison | Home (ransomware.live/Global Secret Group)
Victim: Nourison | Home | Group: Global Secret Group | Website: nourison.com | Country: US | Details: Country: New Jersey 07663, US |
Website: nourison.com |
Revenue: $59.4 Million |
Industry: Wholesale, Furniture, Home Decor, Retail, Real Estate |
Employees: 100-300 |
Properties: 799 GB (93,941 Files, 13,733 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Cold Front Distribution (ransomware.live/Global Secret Group)
Victim: Cold Front Distribution | Group: Global Secret Group | Website: coldfrontdist.com | Country: US | Details: Country: Colorado, United States |
Website: coldfrontdist.com |
Revenue: $120.1 Million |
Industry: Transportation |
Employees: 201-500 Employees |
Properties: 473 GB (890,775 Files, 51,621 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Portman Finance Group (ransomware.live/Global Secret Group)
Victim: Portman Finance Group | Group: Global Secret Group | Website: portmanfinancegroup.co.uk | Country: GB | Details: Country: United Kingdom |
Website: portmanfinancegroup.co.uk |
Revenue: £300 Million |
Industry: Finance |
Employees: 1000-5000 Employees |
Properties: 209 GB (255,244 Files, 34,852 Folders)

[5] [RANSOMWARE] Global Secret Group leaked OFS (ransomware.live/Global Secret Group)
Victim: OFS | Group: Global Secret Group | Website: ofs.com | Country: US | Details: Country: Indiana, United States |
Website: ofs.com |
Revenue: $517.1 Million |
Industry: Furniture,Manufacturing,Transportation |
Employees: 1K – 5K |
Properties: 321 GB (322,742 Files, 18,081 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Uniview Technologies (ransomware.live/Global Secret Group)
Victim: Uniview Technologies | Group: Global Secret Group | Website: uniview.com | Country: CN | Details: Country: China |
Website: uniview.com |
Revenue: $610 Million |
Industry: Manufacturing, Electronics |
Employees: 1000-5000 Employees |
Properties: 1.5 TB (2,172,194 Files, 114,352 Folders)

[5] [RANSOMWARE] Global Secret Group leaked Novum Energy (ransomware.live/Global Secret Group)
Victim: Novum Energy | Group: Global Secret Group | Website: novumenergy.com | Country: US | Details: Country: Texas, United States |
Website: novumenergy.com |
Revenue: $966 Million |
Industry: Convenience Stores, Gas Stations & Liquor Stores |
Employees: 51-200 |
Properties: 842 GB (971,325 Files, 117,085 Folders)

[5] [RANSOMWARE] chaos leaked remco.ca (ransomware.live/chaos)
Victim: remco.ca | Group: chaos | Website: remco.ca | Country: CA | Details: Founded in 1977 and headquartered in Quebec, Canada, Remco is an industry leader in warehousing, transportation and country-wide distribution for the retail industry

[5] [RANSOMWARE] qilin leaked Contacto Garantido (ransomware.live/qilin)
Victim: Contacto Garantido | Group: qilin | Website: www.contactogarantido.com | Country: MX | Details: N/A

[5] [RANSOMWARE] qilin leaked Universitatea de Vest „Vasile Goldiș” din Arad (ransomware.live/qilin)
Victim: Universitatea de Vest „Vasile Goldiș” din Arad | Group: qilin | Website: www.uvvg.ro | Country: RO | Details: N/A

[5] [RANSOMWARE] m3rx leaked hydraulic-components.net (ransomware.live/m3rx)
Victim: hydraulic-components.net | Group: m3rx | Website: hydraulic-components.net | Country: DE | Details: +44 1142764430 , VHS Hydraulics is a prominent supplier of hydraulic components and power packs, featuring products from renowned brands like Rexroth, Walvoil, and Casappa. With over 25 years of experience, they specialize in engineering bespoke power packs for demanding applications. Based in Sheff

[5] [RANSOMWARE] m3rx leaked createinfor.pt (ransomware.live/m3rx)
Victim: createinfor.pt | Group: m3rx | Website: createinfor.pt | Country: PT | Details: +351 262187684 , CreateInfor is a company that operates in the Repair Services industry. It employs 10to19 people and has 500Kto1M of revenue. The company is headquartered in Caldas da Rainha, Leiria, Portugal. Stolen: —

[5] [RANSOMWARE] m3rx leaked servicebypremier.com (ransomware.live/m3rx)
Victim: servicebypremier.com | Group: m3rx | Website: servicebypremier.com | Country: US | Details: +1(954) 646-0016 , This local HVAC and Refrigeration company, established in 2007, provides services across South Florida, from Florida City to Port St. Lucie. They specialize in commercial HVAC and refrigeration repairs, including maintenance for A/C and refrigeration equipment. The company prides

[5] [RANSOMWARE] ExfilSquad leaked Analog Devices (ransomware.live/ExfilSquad)
Victim: Analog Devices | Group: ExfilSquad | Website: analog.com | Country: US | Details: Revenue: $12.7B

DATA SUMMARY:
570K~ records containing: customer PII and addresses.

[5] [RANSOMWARE] ExfilSquad leaked Bonava (ransomware.live/ExfilSquad)
Victim: Bonava | Group: ExfilSquad | Website: bonava.se | Country: SE | Details: Revenue: SEK 8B

DATA SUMMARY:
842K~ records containing: significant PII, property ownership/interests, warranty and repair cases, contractor information, marketing preferences, and customer service history.

[5] [RANSOMWARE] ExfilSquad leaked City of Atlanta (ransomware.live/ExfilSquad)
Victim: City of Atlanta | Group: ExfilSquad | Website: atlantaga.gov | Country: US | Details: DATA SUMMARY:
3M~ records containing: significant PII, citizen service requests, addresses, municipal case history, and internal case management data.

[5] [RANSOMWARE] ExfilSquad leaked City of Houston (ransomware.live/ExfilSquad)
Victim: City of Houston | Group: ExfilSquad | Website: houstontx.gov | Country: US | Details: DATA SUMMARY:
6M~ records containing: significant PII, resident contact details, service requests, complaint descriptions, addresses, location data, case/ticket metadata, department routing, service status, resolution information, and extensive CRM metadata.

[5] [RANSOMWARE] ExfilSquad leaked Viavi Solutions (ransomware.live/ExfilSquad)
Victim: Viavi Solutions | Group: ExfilSquad | Website: viavisolutions.com | Country: US | Details: Revenue: $1B

DATA SUMMARY:
430K~ records containing: customer and partner contact information, significant PII, and enterprise account identifiers.

[5] [RANSOMWARE] ExfilSquad leaked Newcastle University (ransomware.live/ExfilSquad)
Victim: Newcastle University | Group: ExfilSquad | Website: ncl.ac.uk | Country: GB | Details: DATA SUMMARY:
440K~ records containing: applicant and student contact information, significant PII, and admissions data.

[5] [RANSOMWARE] ExfilSquad leaked Zenith Bank Plc (ransomware.live/ExfilSquad)
Victim: Zenith Bank Plc | Group: ExfilSquad | Website: zenithbank.com | Country: NG | Details: Revenue: ₦2.3T

DATA SUMMARY:
90M~ records containing: extensive PII, banking relationships, account information, financial data, government identifiers, customer contact information, and banking support cases.

[5] [RANSOMWARE] ExfilSquad leaked Frontier Airlines (ransomware.live/ExfilSquad)
Victim: Frontier Airlines | Group: ExfilSquad | Website: flyfrontier.com | Country: US | Details: Revenue: $1.5B

DATA SUMMARY:
2.4M~ records containing: significant PII, customer support cases, flight and travel information, complaint records, baggage details, and customer support email communications.

[5] [RANSOMWARE] ExfilSquad leaked TaylorMade & Sun Day Red golf (ransomware.live/ExfilSquad)
Victim: TaylorMade & Sun Day Red golf | Group: ExfilSquad | Website: taylormadegolf.com | Country: US | Details: Revenue: $1.5B

DATA SUMMARY:
2M~ records containing: significant PII, customer support history, orders, shipping information, business account data, financial/account information, internal notes, attachments, and AI support chat transcripts.

[5] [RANSOMWARE] ExfilSquad leaked Allstate (ransomware.live/ExfilSquad)
Victim: Allstate | Group: ExfilSquad | Website: allstate.com | Country: US | Details: Revenue: $67B

DATA SUMMARY:
657K~ records containing: significant PII, recruitment and licensing information, onboarding data, and internal employee account information.

[5] [RANSOMWARE] ExfilSquad leaked Microsoft (ransomware.live/ExfilSquad)
Victim: Microsoft | Group: ExfilSquad | Website: microsoft.com | Country: US | Details: Revenue: $318B

DATA SUMMARY:
8M~ records containing: significant PII, employee and customer contact information, authentication data, password hashes, portal identities, corporate account information, business leads, facilities management records, internal service tickets, and access permissions.

[5] [RANSOMWARE] ExfilSquad leaked UK Department for Education (ransomware.live/ExfilSquad)
Victim: UK Department for Education | Group: ExfilSquad | Website: education.gov.uk | Country: GB | Details: DATA SUMMARY:
Help Portal (~600K records) – Parent and staff contact records containing full names, email addresses, phone numbers, and job titles.

Turing Portal (~7K records) – Contact records containing full names, email addresses, phone numbers, and job titles.

[5] [RANSOMWARE] arcusmedia leaked Brazer Ingenierie (ransomware.live/arcusmedia)
Victim: Brazer Ingenierie | Group: arcusmedia | Website: brazeringenierie.com | Country: MA | Details: Brazer Ingénierie is a professional integrator specializing in IT and telecommunications s Deadline: 2026-08-01 21:06:00.000000

[5] [RANSOMWARE] arcusmedia leaked Power Moendas (ransomware.live/arcusmedia)
Victim: Power Moendas | Group: arcusmedia | Website: powermoendas.com.br | Country: BR | Details: Based in the sugar-energy industrial hub, in the city of Sertãozinho/SP, Power Empral has Deadline: 2026-08-01 21:06:00.000000

[5] [RANSOMWARE] Doommageddon leaked iw steelTEC Makine San. ve Tic. A.Ş. (ransomware.live/Doommageddon)
Victim: iw steelTEC Makine San. ve Tic. A.Ş. | Group: Doommageddon | Country: TR | Details: Status: leaked | Data size: 100 GB | Files: 0 files | Deadline: 2026-03-08T00:00:00Z

SUMMARY

Total new items: 98
Critical count: 1
Ransomware victims today: 95
CISA KEV items: 0

Companion HTML report: download report

Companion HTML report: Download HTML report

Today: 98 new items; 2 critical.

Companion HTML report: Download HTML report

CRITICAL SECTION

[12] CISA orders urgent action on actively exploited Langflow RCE flaw (BleepingComputer)
The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday ordered U.S. government agencies to prioritize patching an actively exploited vulnerability in the Langflow visual framework for building AI agents. […]

CISA KEV (Known Exploited Vulnerabilities)

CVE	Vendor/Product	Score	Required Action
CVE-2026-16232	CISA KEV	6	Assess and patch immediately
CVE-2026-50522	CISA KEV	6	Assess and patch immediately

RANSOMWARE VICTIMS (DLS Monitoring)

[RANSOMWARE] dragonforce leaked Koshkaryan Law Group: [RANSOMWARE] dragonforce leaked Koshkaryan Law Group

[RANSOMWARE] kairos leaked LR Reed: [RANSOMWARE] kairos leaked LR Reed

[RANSOMWARE] nova leaked VNSO: [RANSOMWARE] nova leaked VNSO

[RANSOMWARE] blacknevas leaked Zuni Shopping Center, Inc.: [RANSOMWARE] blacknevas leaked Zuni Shopping Center, Inc.

[RANSOMWARE] qilin leaked P & A Construction: [RANSOMWARE] qilin leaked P & A Construction

[RANSOMWARE] BrainCipher leaked windiam.com: [RANSOMWARE] BrainCipher leaked windiam.com

[RANSOMWARE] qilin leaked Primeline Logistics: [RANSOMWARE] qilin leaked Primeline Logistics

[RANSOMWARE] qilin leaked Recsa: [RANSOMWARE] qilin leaked Recsa

[RANSOMWARE] qilin leaked Salida Union School District: [RANSOMWARE] qilin leaked Salida Union School District

[RANSOMWARE] chaos leaked neopharmlabs.com: [RANSOMWARE] chaos leaked neopharmlabs.com

[RANSOMWARE] qilin leaked Cpcg: [RANSOMWARE] qilin leaked Cpcg

[RANSOMWARE] qilin leaked EFU Life Assurance: [RANSOMWARE] qilin leaked EFU Life Assurance

[RANSOMWARE] qilin leaked Infina Health: [RANSOMWARE] qilin leaked Infina Health

[RANSOMWARE] m3rx leaked ubfreight.com: [RANSOMWARE] m3rx leaked ubfreight.com

[RANSOMWARE] krybit leaked dhli.in: [RANSOMWARE] krybit leaked dhli.in

[RANSOMWARE] krybit leaked Vibonum Technologies Private Limited: [RANSOMWARE] krybit leaked Vibonum Technologies Private Limited

[RANSOMWARE] akira leaked Kruse Construction: [RANSOMWARE] akira leaked Kruse Construction

[RANSOMWARE] akira leaked University Sprinkler Systems: [RANSOMWARE] akira leaked University Sprinkler Systems

[RANSOMWARE] Booba Project leaked Pelli Clarke Pelli Architects: [RANSOMWARE] Booba Project leaked Pelli Clarke Pelli Architects

[RANSOMWARE] chaos leaked issvc.com: [RANSOMWARE] chaos leaked issvc.com

NEWS

[8] Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs (TheHackerNews)
Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment.

The high-severity flaw, tracked as CVE-2026-8933 (CVSS score: 7.8), impacts default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The disclosure comes as

[8] Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522) (HelpNetSecurity)
<p>Attackers are exploiting a critical SharePoint remote code execution (RCE) vulnerability (CVE-2026-50522) to extract the servers&#8217; IIS machine keys. &#8220;WatchTowr is observing active exploitation of CVE-2026-50522 against on-premise Microsoft SharePoint deployments following the release of public exploit code, with attackers stealing machine keys to retain long-term access,&#8221; the offensive security company warned on Tuesday. WatchTowr&#8217;s global honeypot network registered su

[7] [RANSOMWARE] dragonforce leaked Koshkaryan Law Group (ransomware.live/dragonforce)
Victim: Koshkaryan Law Group | Group: dragonforce | Website: koshlaw.com | Country: US | Details: Koshkaryan Law Group is a legal firm specializing in personal injury and criminal defense cases. They prioritize client service and provide personalized attention to ensure favorable outcomes for their clients. The firm offers free initial consultations and is dedicated to keeping clients informed a

[5] Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack (BleepingComputer)
Swiss rail vehicle manufacturer Stadler Rail says the Everest ransomware gang demanded about $12.3 million after breaching a data exchange platform shared with one of its suppliers. […]

[5] How enterprise GenAI can amplify ransomware risk — and how to contain it (BleepingComputer)
Enterprise AI can accelerate ransomware attacks when AI assistants and agents inherit excessive permissions or compromised identities. Acronis explains how identity controls, governance, and least-privilege access help reduce AI-enabled ransomware risk while supporting secure AI adoption. […]

[5] Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication (TheHackerNews)
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.

The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill’s “get_log_file” endpoint (“/api/w/{workspace}/jobs_u/get_log_file/{filename}”).

“The filename parameter is concatenated into

[5] Lookout identifies exploitable vulnerabilities in mobile apps (HelpNetSecurity)
<p>Lookout has announced the launch of the Lookout Mobile Software Exposure Center (MSEC). Integrated natively into the Lookout Mobile Endpoint Security platform, MSEC enables organizations to continuously detect, validate, prioritize, and remediate exploitable vulnerabilities across their mobile software ecosystem. The advancement of frontier AI models, such as Anthropic&#8217;s Claude Mythos, marks a fundamental shift in the cybersecurity landscape. By reducing the cost and time required to di

[5] [RANSOMWARE] kairos leaked LR Reed (ransomware.live/kairos)
Victim: LR Reed | Group: kairos | Country: AU | Details: LR Reed is a family-owned business with over 30 years of experience, specializing in Owners Corporation management and developer services. They provide a comprehensive range of management services, including asset management, legislative compliance, and financial accounting, ensuring a transparent a

[5] [RANSOMWARE] nova leaked VNSO (ransomware.live/nova)
Victim: VNSO | Group: nova | Details: Công nghệ VNSO is a leading provider of cloud and server solutions in Vietnam, offering a wide range of services including hosting, VPS, cloud storage, private cloud, anti-DDoS, and CDN. Their products cater to various needs, from high-performance cloud servers to dedicated servers for gaming and AI

[5] [RANSOMWARE] blacknevas leaked Zuni Shopping Center, Inc. (ransomware.live/blacknevas)
Victim: Zuni Shopping Center, Inc. | Group: blacknevas | Country: US | Details: A family-owned commercial corporation incorporated in New Mexico, USA, that owns and operates Halona Plaza, a multi-purpose retail and tourism hub in the heart of the Zuni Pueblo reservation.The business dates back to 1910 and was formally incorporated as Zuni Shopping Center, Inc. in 1961. Over the

[5] [RANSOMWARE] qilin leaked P & A Construction (ransomware.live/qilin)
Victim: P & A Construction | Group: qilin | Website: www.paconst.com | Country: US | Details: N/A

[5] [RANSOMWARE] BrainCipher leaked windiam.com (ransomware.live/BrainCipher)
Victim: windiam.com | Group: BrainCipher | Website: windiam.com | Details: [AI generated] N/A

[5] [RANSOMWARE] qilin leaked Primeline Logistics (ransomware.live/qilin)
Victim: Primeline Logistics | Group: qilin | Website: www.primeline.ie | Country: IE | Details: N/A

[5] [RANSOMWARE] qilin leaked Recsa (ransomware.live/qilin)
Victim: Recsa | Group: qilin | Website: www.recsa.com | Country: CR | Details: N/A

[5] [RANSOMWARE] qilin leaked Salida Union School District (ransomware.live/qilin)
Victim: Salida Union School District | Group: qilin | Website: www.salida.k12.ca.us | Country: US | Details: N/A

[5] [RANSOMWARE] chaos leaked neopharmlabs.com (ransomware.live/chaos)
Victim: neopharmlabs.com | Group: chaos | Website: neopharmlabs.com | Country: US | Details: Notice of Data Escalation: 3% Proof Publication

Management is ignoring the seriousness of the situation and refusing to engage in dialogue. We are publishing a 3% sample of our 627 GB archive right now.

We are giving management 48 hours to reach out to us. If they fail to contact us within this ti

[5] [RANSOMWARE] qilin leaked Cpcg (ransomware.live/qilin)
Victim: Cpcg | Group: qilin | Website: www.cpcgr.com | Country: BR | Details: N/A

[5] [RANSOMWARE] qilin leaked EFU Life Assurance (ransomware.live/qilin)
Victim: EFU Life Assurance | Group: qilin | Website: www.efulife.com | Country: PK | Details: N/A

[5] [RANSOMWARE] qilin leaked Infina Health (ransomware.live/qilin)
Victim: Infina Health | Group: qilin | Website: www.infinahealth.com | Details: N/A

[5] [RANSOMWARE] m3rx leaked ubfreight.com (ransomware.live/m3rx)
Victim: ubfreight.com | Group: m3rx | Website: ubfreight.com | Details: UB Freight is a leading provider of worldwide freight services, specializing in air and sea freight, customs clearance, and warehousing solutions. They cater to a diverse clientele, including large companies with complex shipping needs and individuals looking to send personal items overseas. With IA

[5] [RANSOMWARE] krybit leaked dhli.in (ransomware.live/krybit)
Victim: dhli.in | Group: krybit | Website: dhli.in | Country: IN | Details: Delhi Heart & Lung Institute (DHLI) is a tertiary care 100-bedded super specialty hospital established in 2003 in New De…

[5] [RANSOMWARE] krybit leaked Vibonum Technologies Private Limited (ransomware.live/krybit)
Victim: Vibonum Technologies Private Limited | Group: krybit | Website: Vibonum Technologies Private Limited | Country: IN | Details: *** is a recently incorporated Indian private limited company established on March 27, …

[5] [RANSOMWARE] akira leaked Kruse Construction (ransomware.live/akira)
Victim: Kruse Construction | Group: akira | Details: Kruse Construction is a mechanical contractor with over 50 years of experience in the petroleum
and petrochemical industry, specializing in the construction and maintenance of liquid petrole
um truck, rail, and pipeline terminals. The company also provides services for bulk plants, pip
eline pump st

[5] [RANSOMWARE] akira leaked University Sprinkler Systems (ransomware.live/akira)
Victim: University Sprinkler Systems | Group: akira | Details: University Sprinklers is BC’s largest irrigation company, specializing in the installation of i
rrigation sprinkler systems and landscape lighting for both residential and commercial clients.
With over 40 years of experience, they provide tailored irrigation solutions that ensure healt
hy lawns and

[5] [RANSOMWARE] Booba Project leaked Pelli Clarke Pelli Architects (ransomware.live/Booba Project)
Victim: Pelli Clarke Pelli Architects | Group: Booba Project | Website: www.pcparch.com | Country: US | Details: Architecture and Planning Stolen data: 45 GB.

[5] [RANSOMWARE] chaos leaked issvc.com (ransomware.live/chaos)
Victim: issvc.com | Group: chaos | Website: issvc.com | Country: SG | Details: issvc.com

Official Notice to Management and Stakeholders

The time window has expired. Exactly 24 hours remain until the final deadline. If an agreement is not reached by the end of this period, the complete confidential dataset totaling 262 GB will be published into the public domain.

Compromised

SUMMARY

Total new items: 63, critical: 1, ransomware victims today: 20.

Top CVEs to patch urgently: CVE-2026-50522, CVE-2026-8933, CVE-2026-16232, CVE-2026-29059, CVE-2026-48294.

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

Cybersecurity Intelligence Report — 2026-07-21

CRITICAL SECTION

• [14] ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875) (HelpNetSecurity) — CVEs: CVE-2026-6875
  <p>Attackers have begun exploiting CVE-2026-6875, a critical pre-authentication vulnerability in the ServiceNow AI Platform, according to threat intelligence firm Defused. About the vulnerability ServiceNow AI is a Platform-as-a-Service that lets organizations build and automate digital workflows. CVE-2026-6875 is a code injection vulnerability that lets unauthenticated attackers escape ServiceNow’s script sandbox and execute code remotely on a targeted instance. The vulnerability was unea
• [12] ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More (TheHackerNews)
  A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools.

  The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch.

  Here is the full

CISA KEV

No CISA KEV items in the last 14 days.

RANSOMWARE VICTIMS (DLS MONITORING)

Unknown: [RANSOMWARE] nova leaked Jrd logistics, [RANSOMWARE] akira leaked McKeever , Varga & Senko, [RANSOMWARE] safepay leaked wdk.de, [RANSOMWARE] safepay leaked jaecklin-industrial.de, [RANSOMWARE] safepay leaked lbb-treuhand.de, [RANSOMWARE] safepay leaked timetex.de, [RANSOMWARE] safepay leaked stroebel-gruppe.de, [RANSOMWARE] safepay leaked industriesjaro.com, [RANSOMWARE] safepay leaked cenesco.de, [RANSOMWARE] safepay leaked acsmallmaxwell.com.au, [RANSOMWARE] safepay leaked mende-grundbesitz.de, [RANSOMWARE] kairos leaked College O’Sullivan de Québec, [RANSOMWARE] kairos leaked Collge O’Sullivan de Québec, [RANSOMWARE] incransom leaked Ali-Monde, [RANSOMWARE] coinbasecartel leaked Caterpillar, [RANSOMWARE] anubis leaked Bath Fitter, [RANSOMWARE] anubis leaked Fairlife / Coca-Cola, [RANSOMWARE] nova leaked Rumah Sakit Universitas Indonesia (RSUI), [RANSOMWARE] nova leaked Universidad Nacional de Mar del Plata, [RANSOMWARE] coinbasecartel leaked Colliers Real Estate, [RANSOMWARE] akira leaked L&A Transport, [RANSOMWARE] nova leaked Koplarla, [RANSOMWARE] qilin leaked Bolt & Nut Manufacturing, [RANSOMWARE] chaos leaked wikoff.com

NEWS

[9] Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs (TheHackerNews) — A solo Russian-speaking threat actor known as “bandcampro” outsourced a chunk of their operations to Google’s open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet.

The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential

[9] [RANSOMWARE] nova leaked Jrd logistics (ransomware.live/nova) — Victim: Jrd logistics | Group: nova | Details: Jrd logistics LTD is an India-based freight forwarding and supply chain company headquartered in Kolkata that provides international logistics, customs clearance, warehousing, and multimodal transport services – Nova Provide tree and samples from stolen data to the company when its get in touch with

[8] Critical ServiceNow code execution flaw now exploited in attacks (BleepingComputer) — Attackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to threat intelligence company Defused. […]

[8] SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch (SecurityWeek) — <p>The zero-days CVE-2026-15409 and CVE-2026-15410 were exploited by a threat actor tracked by Volexity as UTA0533.</p>
<p>The post <a href=”https://www.securityweek.com/sonicwall-zero-days-exploited-to-deliver-custom-malware-for-weeks-before-patch/”>SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch</a> appeared first on <a href=”https://www.securityweek.com”>SecurityWeek</a>.</p>

[8] WP2Shell WordPress Vulnerabilities Exploited in the Wild (SecurityWeek) — <p>Exploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.</p>
<p>The post <a href=”https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/”>WP2Shell WordPress Vulnerabilities Exploited in the Wild</a> appeared first on <a href=”https://www.securityweek.com”>SecurityWeek</a>.</p>

[7] [RANSOMWARE] akira leaked McKeever , Varga & Senko (ransomware.live/akira) — Victim: McKeever , Varga & Senko | Group: akira | Details: McKeever Varga & Senko is a firm of Certified Public Accountants dedicated to providing superio
r client service and professional guidance. They offer a range of services including informativ
e articles, interactive financial calculators, and links to external resources to assist their
clients.

We

[6] Estée Lauder discloses data breach via Oracle E-Business flaw (BleepingComputer) — Cosmetics giant Estée Lauder is notifying customers of a data breach after hackers exploited a flaw in Oracle E-Business Suite that the company used for human resources (HR) operations. […]

[6] SonicWall SMA1000 flaws exploited as zero-days to push custom malware (BleepingComputer) — Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances. […]

[6] World’s Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent (TheHackerNews) — In an ironic twist, open-source artificial intelligence (AI) platform Hugging Face revealed that it was the victim of a hack perpetrated by an autonomous AI agent system.

The company said it detected and responded to the incident targeting its production infrastructure earlier last week.

“We identified unauthorized access to a limited set of internal datasets and to several credentials used by

[6] New Index Tracks Material Breaches — And Refuses to Add Up the Losses (SecurityWeek) — <p>Longtime cybersecurity executive Richard Bird built the resource for security experts, journalists, policymakers, and everyday citizens.</p>
<p>The post <a href=”https://www.securityweek.com/new-index-tracks-material-breaches-and-refuses-to-add-up-the-losses/”>New Index Tracks Material Breaches — And Refuses to Add Up the Losses</a> appeared first on <a href=”https://www.securityweek.com”>SecurityWeek</a>.</p>

[6] Hugging Face breached by autonomous AI agent (HelpNetSecurity) — <p>Hugging Face, the widely used platform for sharing open-source machine learning models and datasets, has disclosed a security breach it says was carried out by an autonomous AI agent system. How the attack unfolded In a blog post published Thursday (July 16), the company said that earlier that week, it identified unauthorized access to some internal datasets and to several credentials used by its services. The intrusion was executed via a malicious dataset that abused … <a href=”https:/

[5] More alerts are making your team slower, and an outcome-based SOC fixes that (HelpNetSecurity) — <p>In this Help Net Security video, Thom Langford, EMEA CTO, Rapid7, explains why piling on more security alerts makes a SOC slower to respond. Attackers log in with stolen credentials and use trusted tools like PowerShell instead of custom malware. He shares a case where attackers called a help desk, reset a privileged cloud account, and exposed thousands of passwords in three minutes. Ransomware groups can go from access to payload in under three hours. … <a href=”https://www.helpnetsecu

[5] [RANSOMWARE] safepay leaked wdk.de (ransomware.live/safepay) — Victim: wdk.de | Group: safepay | Website: wdk.de | Country: DE | Details: Founded in 1950 and headquartered in Frankfurt am Main, the organization serves as the central voice of German manufacturers of …

[5] [RANSOMWARE] safepay leaked jaecklin-industrial.de (ransomware.live/safepay) — Victim: jaecklin-industrial.de | Group: safepay | Website: jaecklin-industrial.de | Country: DE | Details: Founded in 1935 by Julius Jäcklin, the company has developed from a regional machine repair workshop into a globally recognized …

[5] [RANSOMWARE] safepay leaked lbb-treuhand.de (ransomware.live/safepay) — Victim: lbb-treuhand.de | Group: safepay | Website: lbb-treuhand.de | Country: DE | Details: The company specializes in tax consulting, auditing, accounting, payroll administration, financial reporting, and business advisory services for private individuals, self-employed …

[5] [RANSOMWARE] safepay leaked timetex.de (ransomware.live/safepay) — Victim: timetex.de | Group: safepay | Website: timetex.de | Country: DE | Details: The company traces its origins to 1991, when the TimeTEX brand was acquired and expanded into a comprehensive supplier of …

[5] [RANSOMWARE] safepay leaked stroebel-gruppe.de (ransomware.live/safepay) — Victim: stroebel-gruppe.de | Group: safepay | Website: stroebel-gruppe.de | Country: DE | Details: Headquartered in Langenzenn, Bavaria, the company was founded in 1978 by Gerlinde and Gerhard Ströbel and has grown from a …

[5] [RANSOMWARE] safepay leaked industriesjaro.com (ransomware.live/safepay) — Victim: industriesjaro.com | Group: safepay | Website: industriesjaro.com | Country: CA | Details: Over several decades, Jaro has evolved from manufacturing telephone booths into a supplier of advanced outdoor enclosures, interactive kiosks, bus …

[5] [RANSOMWARE] safepay leaked cenesco.de (ransomware.live/safepay) — Victim: cenesco.de | Group: safepay | Website: cenesco.de | Country: DE | Details: Founded in 1998, the company provides comprehensive information technology solutions for small and medium-sized enterprises (SMEs), helping organizations modernize their …

[5] [RANSOMWARE] safepay leaked acsmallmaxwell.com.au (ransomware.live/safepay) — Victim: acsmallmaxwell.com.au | Group: safepay | Website: acsmallmaxwell.com.au | Country: AU | Details: Founded in 1916 by Ambrose Cecil Small, the firm has provided professional accounting and financial services to businesses and individuals …

[5] [RANSOMWARE] safepay leaked mende-grundbesitz.de (ransomware.live/safepay) — Victim: mende-grundbesitz.de | Group: safepay | Website: mende-grundbesitz.de | Country: DE | Details: Founded in 1994, the company specializes in the professional administration of residential, commercial, and mixed-use real estate throughout the Berlin …

[5] [RANSOMWARE] kairos leaked College O’Sullivan de Québec (ransomware.live/kairos) — Victim: College O’Sullivan de Québec | Group: kairos | Country: CA | Details: Collège O’Sullivan de Québec offers a variety of training programs both in-class and online, focusing on fields such as administration, insurance, office management, IT, web development, and marketing. The institution aims to equip students with the skills needed for the job market and higher educat

[5] [RANSOMWARE] kairos leaked Collge O’Sullivan de Québec (ransomware.live/kairos) — Victim: Collge O’Sullivan de Québec | Group: kairos | Country: CA | Details: Collège O’Sullivan de Québec offers a variety of training programs both in-class and online, focusing on fields such as administration, insurance, office management, IT, web development, and marketing. The institution aims to equip students with the skills needed for the job market and higher educat

[5] [RANSOMWARE] incransom leaked Ali-Monde (ransomware.live/incransom) — Victim: Ali-Monde | Group: incransom | Country: US | Details: Ali-Monde is a food production and distribution company that’s been around for over 50 years. They’ve got 5 of their own brands and an impressive lineup of 800+ dry, organic, and gluten-free products. Based just south of Montreal, they distribute food across Quebec, Ontario, New Brunswick, and parts

[5] [RANSOMWARE] coinbasecartel leaked Caterpillar (ransomware.live/coinbasecartel) — Victim: Caterpillar | Group: coinbasecartel | Country: US | Details: [AI generated] Caterpillar Inc. is an American multinational corporation headquartered in Irving, Texas. It is the world’s leading manufacturer of construction and mining equipment, diesel and natural gas engines, industrial gas turbines, and diesel-electric locomotives. Operating in over 190 countr

[5] [RANSOMWARE] anubis leaked Bath Fitter (ransomware.live/anubis) — Victim: Bath Fitter | Group: anubis | Country: US | Details: Employee data breach at a major manufacturing company.

[5] [RANSOMWARE] anubis leaked Fairlife / Coca-Cola (ransomware.live/anubis) — Victim: Fairlife / Coca-Cola | Group: anubis | Country: US | Details: www.fairlife.com

[5] [RANSOMWARE] nova leaked Rumah Sakit Universitas Indonesia (RSUI) (ransomware.live/nova) — Victim: Rumah Sakit Universitas Indonesia (RSUI) | Group: nova | Country: ID | Details: Rumah Sakit Universitas Indonesia (RSUI) is the teaching hospital of the University of Indonesia, providing advanced medical care, education, and clinical research in Indonesia – medical data from drive at risk, Nova Provide tree and samples from stolen data to the company when its get in touch with

[5] [RANSOMWARE] nova leaked Universidad Nacional de Mar del Plata (ransomware.live/nova) — Victim: Universidad Nacional de Mar del Plata | Group: nova | Country: AR | Details: The Universidad Nacional de Mar del Plata offers a wide range of academic programs, including undergraduate and postgraduate degrees, vocational training, and distance education. It serves students, faculty, and the broader community by promoting research, innovation, and cultural activities. The un

[5] [RANSOMWARE] coinbasecartel leaked Colliers Real Estate (ransomware.live/coinbasecartel) — Victim: Colliers Real Estate | Group: coinbasecartel | Country: US | Details: [AI generated] Colliers International is a global commercial real estate services company headquartered in Toronto, Canada. It operates across more than 60 countries, offering services including property management, investment sales, leasing, valuation, and advisory. The firm serves corporate, insti

[5] [RANSOMWARE] akira leaked L&A Transport (ransomware.live/akira) — Victim: L&A Transport | Group: akira | Details: L & A Transport is a reputable trucking company with over 50 years of experience in providing a
wide range of shipping services, including international shipping, white glove handling, and l
ogistics solutions for businesses of all sizes. They specialize in truckloads, container loads,
less than con

[5] [RANSOMWARE] nova leaked Koplarla (ransomware.live/nova) — Victim: Koplarla | Group: nova | Website: kopkarla.com | Country: ID | Details: Koperasi Konsumen Karyawan PT Aplikanusa Lintasarta (KOPKARLA) was established in 1992 and at that time was focusing on saving and loan business. Since 1998, KOPKARLA has evolved and expanded its business to provide an installation services and solution of telecommunication network (datacomm)

[5] [RANSOMWARE] qilin leaked Bolt & Nut Manufacturing (ransomware.live/qilin) — Victim: Bolt & Nut Manufacturing | Group: qilin | Website: www.bnml.co.uk | Country: GB | Details: N/A

[5] [RANSOMWARE] chaos leaked wikoff.com (ransomware.live/chaos) — Victim: wikoff.com | Group: chaos | Website: wikoff.com | Country: US | Details: [PUBLIC DISCLOSURE]

Target: Wikoff Color Corporation (wikoff.com)
Data Volume: 650 GB
Status: Full Compromise Confirmed

We are officially confirming that the entire internal infrastructure of Wikoff Color Corporation—ranging from Board of Directors financial reports and proprietary R&D formulas…

SUMMARY

Total new items: 65. Critical: 2. Ransomware groups active today: 1.

Top CVEs to patch urgently: CVE-2026-6875 (2), CVE-2026-15409 (1), CVE-2026-15410 (1), CVE-2026-63030 (1), CVE-2026-60137 (1).

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

Companion HTML report: Full HTML report

Companion HTML report: Download HTML report (zip)