Cybersecurity Intelligence Report — 23 August 2026

> CRITICAL SECTION

No new score-10 intelligence items were collected.

> CISA KEV (last 14 days)

> RANSOMWARE VICTIMS (today)

• shinyhunters: ReliaQuest, LLC

> NEWS

[8] Hackers infect Android car head units with proxy botnet malware (BleepingComputer)
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. […]

[8] Microsoft patches max severity code execution, privilege escalation flaws (BleepingComputer)
Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks. […]

[5] [RANSOMWARE] incransom leaked el-group (ransomware.live/incransom)
Victim: el-group | Group: incransom | Country: CH | Details: Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation.

[5] [RANSOMWARE] Helix leaked AmSpec (ransomware.live/Helix)
Victim: AmSpec | Group: Helix | Country: US | Details: AmSpec is live. T1 unlocks on the current 24-hour cadence, then 24 hours per remaining tier.

[5] [RANSOMWARE] emperador leaked Vietnam Electricity(EVNHANOI) (ransomware.live/emperador)
Victim: Vietnam Electricity(EVNHANOI) | Group: emperador | Country: VN | Details: Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company and the sole national electric utility in Vietnam. Fully owned and controlled by the Vietnamese government since its inception in 1994, EVN operates as a vertically integrated monopoly responsible fo

[5] [RANSOMWARE] shinyhunters leaked NovoCure Limited (ransomware.live/shinyhunters)
Victim: NovoCure Limited | Group: shinyhunters | Website: novocure.com | Country: IL | Details: This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 22 Aug 2026 | Warning: FINAL WARNING PAY OR LEAK

[5] [RANSOMWARE] shinyhunters leaked BOK Financial (ransomware.live/shinyhunters)
Victim: BOK Financial | Group: shinyhunters | Website: bokfinancial.com | Country: US | Details: This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 22 Aug 2026 | Warning: FINAL WARNING PAY OR LEAK

[5] [RANSOMWARE] coinbasecartel leaked Integrated Health Systems (ransomware.live/coinbasecartel)
Victim: Integrated Health Systems | Group: coinbasecartel | Website: ihs911.com | Country: US | Details: [AI generated] N/A

[5] [RANSOMWARE] coinbasecartel leaked RXPE Group (ransomware.live/coinbasecartel)
Victim: RXPE Group | Group: coinbasecartel | Website: rxpe.com | Country: CN | Details: [AI generated] N/A

[5] [RANSOMWARE] coinbasecartel leaked Tower Insurance (ransomware.live/coinbasecartel)
Victim: Tower Insurance | Group: coinbasecartel | Website: tower.co.nz | Country: NZ | Details: [AI generated] Tower Insurance is a New Zealand-based insurance company offering a range of personal and business insurance products, including home, contents, car, travel, and commercial coverage. Founded in 1869, it operates primarily in New Zealand and the Pacific Islands. Tower is listed on the

[5] [RANSOMWARE] coinbasecartel leaked Flecha Bus (ransomware.live/coinbasecartel)
Victim: Flecha Bus | Group: coinbasecartel | Website: flechabus.com.ar | Country: AR | Details: [AI generated] Flecha Bus is an Argentine intercity bus company operating in the passenger transportation industry. Founded in the mid-20th century, it provides long-distance coach services connecting Buenos Aires with various provinces across Argentina. Known for offering multiple service categorie

[5] [RANSOMWARE] coinbasecartel leaked OTEIS Conseil & Ingénierie (ransomware.live/coinbasecartel)
Victim: OTEIS Conseil & Ingénierie | Group: coinbasecartel | Website: oteis.fr | Country: FR | Details: [AI generated] OTEIS Conseil & Ingénierie is a French engineering and consulting firm specializing in building and infrastructure design. Operating in France, the company provides technical expertise across disciplines including structural engineering, fluids, electricity, and project management. It

[5] [RANSOMWARE] coinbasecartel leaked Longhorn Investments (ransomware.live/coinbasecartel)
Victim: Longhorn Investments | Group: coinbasecartel | Website: longhorninvestments.com | Details: [AI generated] N/A

[5] [RANSOMWARE] coinbasecartel leaked Kessler Creative (ransomware.live/coinbasecartel)
Victim: Kessler Creative | Group: coinbasecartel | Website: kesslercreative.com | Country: US | Details: [AI generated] N/A

[5] [RANSOMWARE] coinbasecartel leaked Klasko Immigration Law Partners (ransomware.live/coinbasecartel)
Victim: Klasko Immigration Law Partners | Group: coinbasecartel | Website: klaskolaw.com | Country: US | Details: [AI generated] Klasko Immigration Law Partners is a US-based immigration law firm headquartered in Philadelphia, Pennsylvania. The firm specializes in business immigration law, assisting corporations and individuals with employment-based visas, green cards, and compliance matters. It serves multinat

[5] [RANSOMWARE] coinbasecartel leaked Patel (ransomware.live/coinbasecartel)
Victim: Patel | Group: coinbasecartel | Website: patelcpaoffice.com | Country: US | Details: [AI generated] N/A The name "Patel" is too generic to identify a specific company with reliable information. It is a common surname and business name used by numerous unrelated entities across many industries and countries. Please provide additional context such as the full company name, industry,

[5] [RANSOMWARE] coinbasecartel leaked Abacus Advisors (ransomware.live/coinbasecartel)
Victim: Abacus Advisors | Group: coinbasecartel | Website: abacusadv.com | Details: [AI generated] N/A

[5] [RANSOMWARE] coinbasecartel leaked LifeBank Microfinance Foundation (ransomware.live/coinbasecartel)
Victim: LifeBank Microfinance Foundation | Group: coinbasecartel | Website: lbf.ph | Country: PH | Details: [AI generated] LifeBank Microfinance Foundation is a nonprofit microfinance institution operating in the Philippines. It provides financial services, including small loans, savings programs, and livelihood assistance, primarily to low-income individuals and underserved communities. The organization

[5] [RANSOMWARE] coinbasecartel leaked PT Perusahaan Jamu Air Mancur (ransomware.live/coinbasecartel)
Victim: PT Perusahaan Jamu Air Mancur | Group: coinbasecartel | Country: ID | Details: [AI generated] PT Perusahaan Jamu Air Mancur is an Indonesian company operating in the traditional herbal medicine industry. Based in Solo, Central Java, it manufactures and distributes jamu, a traditional Indonesian herbal remedy, along with related health and wellness products. Founded in 1963, th

[5] [RANSOMWARE] coinbasecartel leaked PT. Bank Perekonomian Rakyat Bintan (ransomware.live/coinbasecartel)
Victim: PT. Bank Perekonomian Rakyat Bintan | Group: coinbasecartel | Country: ID | Details: [AI generated] PT. Bank Perekonomian Rakyat Bintan is an Indonesian rural bank, known as a Bank Perkreditan Rakyat or BPR, operating in the Bintan regency of Riau Islands province, Indonesia. It provides basic financial services including savings, deposits, and credit facilities primarily to local c

> SUMMARY

New items collected: 33. Critical items: 0. Active ransomware groups represented today: 1. CVEs to prioritise for review: none identified in the selected items.

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

Open the companion interactive HTML intelligence report