{"generated_at": "2026-08-16T16:14:42.115924+00:00", "period_from": "2026-08-16T16:14:09.824501+00:00", "period_to": "2026-08-16T04:11:09.824501+00:00", "posts": [{"id": "2088996308031787413", "post_type": "Normal", "created_at": "2026-08-16T14:28:26+00:00", "created_at_datetime": [2026, 8, 16, 14, 28, 26], "author": "@DailyDarkWeb", "post_text": "

🇯🇴 Abwaab Educational Platform Database Allegedly Offered for Sale
\n
\nA newly registered threat actor on an underground forum claims to be selling a database belonging to Abwaab, an educational platform operating in Jordan and other Arab markets.
\n
\n* Approximately 4.78 GB of data allegedly included
\n* Seller claims the database contains millions of student IDs
\n* Millions of messages are allegedly exposed
\n* Student interactions with platform assistants are claimed to be included
\n* Communications between users may also be present
\n* The actor describes the listing as the platform's \"complete database\"
\n* Seller account was created in August 2026, has only one post and currently has zero reputation
\n
\nAnalyst Note: The potential exposure of student identifiers and private communications makes this claim particularly sensitive, especially if records involve minors. However, the seller provides no visible samples or other substantive proof in the listing. The provenance, record count, completeness and authenticity of the alleged database remain unverified, and the post alone does not establish that Abwaab was breached.
\n
\n#DDW #DarkWeb #Abwaab #Jordan #Education #DataBreach

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088996308031787413"}, {"id": "2088994681107386724", "post_type": "Normal", "created_at": "2026-08-16T14:21:58+00:00", "created_at_datetime": [2026, 8, 16, 14, 21, 58], "author": "@DailyDarkWeb", "post_text": "

🇺🇸 South Plains Rural Health Services Allegedly Hit — 1.4 TB of Data Advertised
\n
\nA threat actor on an underground forum claims to have obtained approximately 1.4 TB of data belonging to South Plains Rural Health Services (SPRHS), a U.S. healthcare provider.
\n
\n* 1.4 TB of data allegedly compromised
\n* Thousands of patient PII and PHI records claimed
\n* Financial and HR records allegedly included
\n* Provider and vendor information
\n* Mailboxes and email correspondence
\n* Database exports and other internal files
\n* Seller published screenshots presented as samples of the allegedly stolen material
\n* Forum account joined in May 2026 and currently shows 52 posts, 50 threads and a reputation score of 10
\n
\nAnalyst Note: The alleged presence of both PII and protected health information (PHI) makes this a potentially significant healthcare-sector incident. The screenshots provide some supporting material for the actor's claim, but they do not independently establish the provenance, completeness, or claimed 1.4 TB volume. No victim confirmation should be inferred from the underground listing alone.
\n
\n#DDW #DarkWeb #Healthcare #DataBreach #PHI #CyberThreatIntelligence

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088994681107386724"}, {"id": "2088969839645725175", "post_type": "Normal", "created_at": "2026-08-16T12:43:15+00:00", "created_at_datetime": [2026, 8, 16, 12, 43, 15], "author": "@DailyDarkWeb", "post_text": "

🚨 Clop Claims 8 TB Data Theft From Zebra Technologies
\n
\nThe Clop ransomware group has claimed a major cyberattack involving Zebra Technologies, with the alleged theft of approximately 8 TB of corporate data.
\n
\n* According to DeXpose, Clop reported the victim on August 13, 2026
\n
\n* The threat actor claims the stolen material includes databases, project files and CAD files
\n
\n* Clop claims the total volume of exfiltrated information is approximately 8 TB
\n
\n* Zebra Technologies is a major U.S.-based enterprise technology company providing barcode scanners, RFID systems, mobile computers, printers and other technologies used across manufacturing, logistics, retail and healthcare environments
\n
\n* The threat actor specifically referenced approximately $5.6 billion in company revenue in its leak-site statement
\n
\n* The 8 TB figure and descriptions of the allegedly stolen files originate from the threat actor and should not currently be treated as independently verified facts
\n
\n⚠️ Analyst Note: Zebra's position within enterprise supply chains makes this claim noteworthy beyond the alleged volume of stolen information. CAD files, project documentation and internal databases could potentially contain commercially sensitive or customer-related information. However, the actual scope and impact cannot be established until Zebra or another authoritative source confirms the incident.
\n
\nSource: DeXpose / Clop leak-site monitoring
\nAugust 13, 2026
\n
\ndexpose.io/clop-ransomware-t…
\n
\n#DDW #Ransomware #Clop #Zebra

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088969839645725175"}, {"id": "2088968776720978224", "post_type": "Normal", "created_at": "2026-08-16T12:39:02+00:00", "created_at_datetime": [2026, 8, 16, 12, 39, 2], "author": "@DailyDarkWeb", "post_text": "

🇲🇽 Alleged Mexican Banking Database Leak Shared on Underground Forum
\n
\nA threat actor has published what they claim is a database containing information associated with customers of multiple Mexican banks.
\n
\n* The actor explicitly states that the leaked information is not recent, describing it as “not recent, but not too old either”
\n
\n* According to the post, exposed information allegedly includes full names, bank account numbers and other data
\n
\n* The accompanying screenshot shows numerous XLSX, XLS and ODS files, including datasets labeled with Mexican locations such as Veracruz and Sonora
\n
\n* The material appears to consist of multiple separate datasets rather than a clearly identified breach of a single Mexican financial institution
\n
\n* The threat actor provided a download location for the alleged data
\n
\n⚠️ Analyst Note: At this stage, the provenance, authenticity, number of affected individuals and specific financial institutions represented in the dataset have not been independently verified. The actor's own statement also indicates that the information is not newly obtained, raising the possibility that this is a compilation or redistribution of previously exposed datasets.
\n
\n#DDW #Intelligence #DarkWeb #Mexico

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088968776720978224"}, {"id": "2088967382517575842", "post_type": "Normal", "created_at": "2026-08-16T12:33:29+00:00", "created_at_datetime": [2026, 8, 16, 12, 33, 29], "author": "@DailyDarkWeb", "post_text": "

🚨 New Linux Botnet “Evooo1Bot” Turns Compromised Devices Into DDoS Bots, Proxies and Internal Network Pivot Points
\n
\nFortiGuard Labs has uncovered a previously undocumented Linux botnet dubbed Evooo1Bot, which has been actively targeting internet-facing devices since July 2026.
\n
\n* Evooo1Bot reuses the leaked Mirai DDoS engine but significantly expands its capabilities
\n
\n* Fortinet observed active exploitation involving vulnerabilities affecting D-Link, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and Alcatel devices
\n
\n* The malware supports 12 CPU architectures, allowing it to infect a broad range of Linux-based edge and IoT systems
\n
\n* It contains a 28-command remote administration interface supporting interactive shell access, file transfers, persistence and self-updates
\n
\n* A built-in SSH brute-force module contains more than 150 credentials, including enterprise-oriented accounts such as jenkins, postgres, oracle, nagios and deploy
\n
\n* Evooo1Bot actively checks for honeypots, sandboxes, debuggers, VMs and security-analysis tools before proceeding
\n
\n* Its DDoS component provides 16 different flooding methods
\n
\n* An integrated CVE exploitation engine targets vulnerabilities across routers, firewalls, IP cameras, Confluence, Kubernetes ingress-nginx, WSO2 and other technologies, although Fortinet notes that some exploit implementations do not work as shipped
\n
\n* The malware also includes credential sniffing capable of intercepting HTTP Basic Authorization and Cookie headers
\n
\n* One of its most significant capabilities is a SOCKS5 relay module that converts compromised devices into attacker-controlled proxy infrastructure
\n
\n* This means an infected router, firewall, camera or other edge device can potentially be used to hide attacker origins, relay malicious traffic and pivot toward internal networks
\n
\n⚠️ Analyst Note: Evooo1Bot demonstrates how modern Mirai descendants are evolving beyond simple DDoS botnets. Compromised edge devices increasingly provide something potentially more valuable than raw attack bandwidth: trusted network positioning. Turning thousands of routers and other internet-facing devices into distributed proxy and pivot infrastructure can provide threat actors with both anonymity and pathways into otherwise inaccessible networks.
\n
\nSource: FortiGuard Labs
\nAugust 13, 2026
\n
\nfortinet.com/blog/threat-res…
\n
\n#DDW #Botnet #Linux #ThreatIntelligence

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088967382517575842"}, {"id": "2088966744207446314", "post_type": "Normal", "created_at": "2026-08-16T12:30:57+00:00", "created_at_datetime": [2026, 8, 16, 12, 30, 57], "author": "@DailyDarkWeb", "post_text": "

🇫🇷 Cyberattack on French Tax Agency Exposes Data of 678,000 Users
\n
\nFrance’s Finance Ministry has confirmed that taxpayer data was stolen in a cyberattack targeting the country’s General Directorate of Public Finances (DGFiP).
\n
\n* A malicious actor claimed on August 12 to have compromised the French tax authority in late June.
\n
\n* An investigation subsequently confirmed unauthorized access and the consultation and extraction of taxpayer information.
\n
\n* France’s Finance Ministry later confirmed that data belonging to approximately **678,000 users** was stolen.
\n
\n* The affected population includes both individual taxpayers and professionals.
\n
\n* Authorities are still investigating exactly which categories of information were accessed or extracted.
\n
\n* Affected taxpayers will be individually notified about the information potentially compromised and any precautionary measures they should take.
\n
\n* The ministry has not publicly attributed the attack to a specific threat actor in the information released so far.
\n
\n⚠️ Analyst Note: The confirmation materially changes the assessment from an unverified threat-actor claim to a government-confirmed data breach. With 678,000 affected users, follow-on phishing, impersonation and tax-related fraud should be considered potential downstream risks, particularly if the compromised records contain sufficient identity or financial context.
\n
\nSource: Reuters / French Finance Ministry
\nAugust 14, 2026
\n
\nreuters.com/legal/litigation…
\n
\n#DDW #CyberSecurity #DataBreach #France

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088966744207446314"}, {"id": "2088965941329543196", "post_type": "Normal", "created_at": "2026-08-16T12:27:46+00:00", "created_at_datetime": [2026, 8, 16, 12, 27, 46], "author": "@DailyDarkWeb", "post_text": "

🇰🇷 South Korea’s National Health Insurance Service Data Allegedly Offered for Sale — 48M Records Claimed
\n
\nA threat actor on an underground forum is advertising what they claim to be a dataset originating from South Korea’s National Health Insurance Service (NHIS), containing approximately 48 million records.
\n
\n* Seller claims the dataset contains personal information belonging to Korean citizens
\n* 48 million records allegedly included
\n* Sample fields shown include names, resident registration numbers (RRNs), gender and dates of birth
\n* Insurance type and subscriber classification data
\n* Employer and household information
\n* Monthly income and insurance-premium information
\n* Dependents and regional information
\n* Medical checkup-related dates and long-term-care grades
\n* Dataset is advertised for $450
\n* Seller account has VIP status, joined in October 2024 and currently shows 92 posts and a reputation score of 21
\n
\nAnalyst Note: If authentic, the combination of national identifiers, financial/insurance information and health-related metadata would make this a potentially high-impact exposure affecting a substantial portion of South Korea’s population. However, the forum listing alone does not establish that NHIS was breached or that the advertised data originated directly from its systems. The 48M-record claim and dataset provenance remain unverified.
\n
\n#DDW #DarkWeb #SouthKorea #DataBreach

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088965941329543196"}, {"id": "2088963799076233647", "post_type": "Normal", "created_at": "2026-08-16T12:19:15+00:00", "created_at_datetime": [2026, 8, 16, 12, 19, 15], "author": "@DailyDarkWeb", "post_text": "

🇺🇸⚠️ McDonald’s 1.7M+ Employee Records Allegedly Offered for Sale
\n
\nA threat actor on an underground forum claims to be selling an internal McDonald’s dataset allegedly obtained directly from an Azure tenant using compromised credentials.
\n
\n* More than 1.7 million records claimed
\n* Alleged fields include full names, employee IDs, email addresses, job titles, departments, phone numbers and addresses
\n* Seller claims the dataset includes employee accounts, service accounts and other tenant account records
\n* An 8,000-record sample is advertised as proof
\n* Seller account joined the forum in March 2026 and currently shows 9 posts, 9 threads and zero reputation
\n
\nAnalyst Note: The claim is particularly notable because it appears consistent with the broader Azure credential-compromise/exfiltration activity recently reported by Hudson Rock, which specifically named McDonald’s among the allegedly affected organizations. However, this individual forum listing and its claimed 1.7M+ records have not been independently verified. The listing should therefore be treated as an allegation rather than confirmation of a new McDonald’s breach.
\n
\n#DDW #DarkWeb #McDonalds #DataBreach

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088963799076233647"}, {"id": "2088956982275240221", "post_type": "Normal", "created_at": "2026-08-16T11:52:10+00:00", "created_at_datetime": [2026, 8, 16, 11, 52, 10], "author": "@DailyDarkWeb", "post_text": "

🚨 12 KB Windows Backdoor Hid Its C2 Address in `desktop.ini` Whitespace
\n
\nGen Digital researchers have documented an unusual custom Windows backdoor discovered on a single corporate workstation, using an uncommon technique to conceal its command-and-control infrastructure.
\n
\n* The implant is only **12,288 bytes** and was disguised using the legitimate-looking Realtek filename `RtkNGUI64.exe`.
\n
\n* Researchers found the malware on exactly **one domain-joined Windows 7 SP1 workstation**, suggesting the possibility of a deliberately targeted operation rather than a mass campaign.
\n
\n* Persistence was achieved through a **WMI event subscription** configured to trigger at 19:50 rather than immediately at system startup.
\n
\n* Most notably, the malware stored its C2 domain inside a seemingly ordinary Windows `desktop.ini` file.
\n
\n* Instead of storing the domain as plaintext or encrypted data, each character was represented by the **number of trailing spaces on individual lines**.
\n
\n* Decoding those whitespace counts revealed the C2 domain `diagrtrack[.]com`, a typosquat referencing Windows' DiagTrack telemetry service.
\n
\n* The backdoor first sends an **ICMP echo request** containing an eight-character victim identifier before initiating HTTP communications.
\n
\n* Its C2 supports only three commands: `system` for executing shell commands, `put` for writing files and `time` for modifying the polling interval.
\n
\n* Researchers found no related samples in their corpus or VirusTotal and did not attribute the implant to any known threat actor or campaign.
\n
\nThe most interesting aspect is not the malware's size or capabilities but its operational subtlety. Encoding infrastructure through whitespace in a legitimate Windows configuration file illustrates how highly targeted implants can deliberately optimize for low prevalence and weak static indicators. A binary appearing on only one endpoint should not automatically receive lower investigative priority.
\n
\nSource: Gen Digital Threat Research
\n
\ngendigital.com/blog/insights…
\n
\n#DDW #Malware #ThreatIntelligence #CyberSecurity

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088956982275240221"}, {"id": "2088955954314297553", "post_type": "Normal", "created_at": "2026-08-16T11:48:05+00:00", "created_at_datetime": [2026, 8, 16, 11, 48, 5], "author": "@DailyDarkWeb", "post_text": "

⚠️ Notion User Database Allegedly Offered for Sale — 150M+ Records Claimed
\n
\nA threat actor on an underground forum is advertising what they claim is a database containing more than 150 million unique Notion user records.
\n
\n* Dataset allegedly contains user email addresses
\n* Hashed passwords are claimed to be included
\n* Registration and account activity dates
\n* Signup and last-login IP addresses
\n* Locale, timezone and country information
\n* Workspace-related metadata
\n* Seller provides what appears to be a sample of the alleged dataset
\n* The forum account dates to July 2023 and currently shows VIP status, 41 posts and a reputation score of 17
\n
\n⚠️ Important: There is currently no evidence in the forum post establishing that Notion itself was breached. The provenance, authenticity, freshness and claimed 150M+ record count have not been independently verified. The dataset could potentially originate from another source, aggregation, or previously exposed information.
\n
\nAnalyst Note: The inclusion of alleged hashed passwords and account metadata would substantially increase the potential impact if the dataset is authentic. Organizations should avoid treating the listing as a confirmed Notion breach until the source of the records is independently established.
\n
\n#DDW #DarkWeb #Notion #DataBreach #CyberThreatIntelligence

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088955954314297553"}, {"id": "2088954766650925336", "post_type": "Normal", "created_at": "2026-08-16T11:43:21+00:00", "created_at_datetime": [2026, 8, 16, 11, 43, 21], "author": "@DailyDarkWeb", "post_text": "

⚠️ GitHub Access to Fortune 100 Tech Company Allegedly Offered for Supply-Chain Attack
\n
\nA newly registered threat actor on an underground forum claims to be selling privileged GitHub access to an unidentified Fortune 100 technology company with reported revenue exceeding $20 billion.
\n
\n* Seller claims access to private GitHub repositories
\n* Claims ability to modify source code
\n* Claims access across the company's GitHub organizations
\n* CI/CD access is allegedly available
\n* Actor specifically advertises the ability to push code to a container registry
\n* Listing explicitly markets the access for a \"supply chain attack\"
\n* Escrow is reportedly accepted
\n* Seller account joined the forum in August 2026 and currently shows only 2 posts, 2 threads and zero reputation
\n
\nAnalyst Note: If authentic, the combination of source-code modification, CI/CD access and container-registry publishing privileges could create significant software supply-chain risk, potentially extending exposure beyond the unnamed company to downstream customers. However, the seller provides no visible technical proof in the listing, and the account has virtually no established reputation. The claims should therefore be treated as unverified intelligence until independently corroborated.
\n
\n#DDW #DarkWeb #SupplyChain #GitHub #CyberThreatIntelligence #DevSecOps

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088954766650925336"}, {"id": "2088953793194889287", "post_type": "Normal", "created_at": "2026-08-16T11:39:29+00:00", "created_at_datetime": [2026, 8, 16, 11, 39, 29], "author": "@DailyDarkWeb", "post_text": "

🇺🇸🌊 U.S. Navy Confirms Unique Seabed Warfare Virginia-Class Submarine
\n
\nThe U.S. Navy has confirmed plans for a one-of-a-kind Block V Virginia-class nuclear-powered submarine designed specifically for Subsea and Seabed Warfare (SSW).
\n
\n* Unlike most Block V boats, the submarine will NOT carry the standard Virginia Payload Module configuration.
\n
\n* A Navy spokesperson confirmed that the vessel will instead be built as an SSW-focused platform.
\n
\n* General Dynamics Electric Boat previously described the planned variant as a submarine designed to \"interact with the seafloor.\"
\n
\n* The specialized platform is expected to support highly sensitive undersea missions involving intelligence collection and operations around seabed infrastructure.
\n
\n* Its mission is broadly comparable to USS Jimmy Carter, the heavily modified Seawolf-class submarine associated with some of America's most sensitive underwater intelligence missions.
\n
\n* Publicly known capabilities associated with this mission area include deployment of remotely operated vehicles, unmanned underwater vehicles and specialized seabed payloads.
\n
\n* The Navy has NOT revealed which future Block V submarine will receive the SSW configuration.
\n
\n🔎 Analyst Note: Seabed warfare is becoming increasingly strategically important as subsea fiber-optic cables, sensors, energy infrastructure and military systems become critical elements of national security.
\n
\nA purpose-built Virginia-class SSW platform suggests the U.S. intends to preserve and modernize its highly specialized deep-ocean intelligence capability as USS Jimmy Carter ages.
\n
\nOriginal report:
\ntwz.com/sea/navy-is-getting-…
\n
\nOfficial U.S. Navy Virginia-class information:
\nnavy.mil/Resources/Fact-File…
\n
\n#DDW #Intelligence #USNavy #Submarine #Espionage #OSINT

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088953793194889287"}, {"id": "2088952554617033047", "post_type": "Normal", "created_at": "2026-08-16T11:34:34+00:00", "created_at_datetime": [2026, 8, 16, 11, 34, 34], "author": "@DailyDarkWeb", "post_text": "

🇺🇸 BullyPedex Database Allegedly Offered for Sale — 280K+ Records
\n
\nA threat actor on an underground forum is advertising a database allegedly associated with BullyPedex.com.
\n
\n* The seller claims the database contains more than 280,000 rows
\n* The dataset is labeled \"July 2026\"
\n* A substantial sample is included in the forum post
\n* Visible fields appear consistent with customer and billing-platform records, including names, email addresses, phone numbers, addresses, account metadata, subscriptions, tax IDs, invoice settings and shipping information
\n* The structure shown in the sample appears to contain Stripe-style customer objects and API paths
\n* The seller's forum account was created in May 2026 and currently shows a reputation score of 40
\n
\nAnalyst Note: The provided sample gives the claim more substance than a listing without evidence, but it does not independently establish how the records were obtained or whether BullyPedex itself was directly compromised. The claimed 280K+ record count, provenance and freshness remain unverified.
\n
\n#DDW #DarkWeb #BullyPedex #DataLeak #DataBreach #CyberThreatIntelligence

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088952554617033047"}, {"id": "2088951360892834150", "post_type": "Normal", "created_at": "2026-08-16T11:29:49+00:00", "created_at_datetime": [2026, 8, 16, 11, 29, 49], "author": "@DailyDarkWeb", "post_text": "

⚠️ Milk Road Newsletter Database Allegedly Offered for Sale
\n
\nA threat actor on an underground forum is advertising a database allegedly associated with Milk Road, a cryptocurrency-focused newsletter and media platform.
\n
\n* The seller claims the dataset contains approximately 535,000 lines
\n* The listing describes it as a \"crypto newsletter DB\"
\n* Full samples are reportedly available to prospective buyers upon request
\n* The seller allows escrow or a forum middleman for the transaction
\n* The forum account currently shows only 5 posts and zero reputation
\n* No data fields, breach method or evidence establishing how the information was obtained are visible in the listing
\n
\nAnalyst Note: The advertisement alone does not establish that Milk Road was compromised. No sample is visible in the provided post, and the seller provides no technical evidence demonstrating provenance. The claimed 535K-line dataset should therefore be treated as an unverified underground-market claim pending validation or acknowledgment from Milk Road.
\n
\n#DDW #DarkWeb #MilkRoad #Crypto #DataLeak #ThreatIntelligence

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088951360892834150"}, {"id": "2088950084218036532", "post_type": "Normal", "created_at": "2026-08-16T11:24:45+00:00", "created_at_datetime": [2026, 8, 16, 11, 24, 45], "author": "@DailyDarkWeb", "post_text": "

🚨 TensorFlow Lite Micro Integer-Overflow Exploit Offered for $1,500 — But It Is Not a True Zero-Day
\n
\nA threat actor is advertising an exploit targeting TensorFlow Lite Micro (tflite-micro), claiming an integer overflow can lead to heap corruption and ultimately remote code execution.
\n
\n* The seller targets the ElementCount() function in TensorFlow Lite Micro
\n* The claimed issue involves a 32-bit integer overflow while calculating tensor dimensions
\n* The seller claims exploitation can result in undersized memory allocation, heap corruption and potentially RCE
\n* A malicious .tflite model is advertised as the attack vector
\n* IoT, embedded devices and mobile applications are listed as potential targets
\n* Asking price: $1,500
\n* The seller describes the vulnerability as unpatched and without a CVE
\n
\nHowever, DDW identified a public TensorFlow Lite Micro pull request filed on August 12, 2026 describing the same ElementCount() integer-overflow condition and proposed overflow checks
\n
\nThe underground advertisement is dated August 14, meaning the technical issue was already publicly disclosed before it was offered as a supposed \"0-day\"
\n
\nThe TensorFlow Lite Micro maintainers closed the proposed fix, noting that the type change would first need to be adopted by upstream LiteRT
\n
\nAnalyst Note: The underlying integer-overflow condition appears technically plausible and is publicly documented, but the seller's claim of reliable remote code execution has NOT been independently demonstrated. More importantly, describing this as a zero-day is misleading because the vulnerability details were publicly available before the underground listing appeared.
\n
\n#DDW #TensorFlow #TensorFlowLite #ZeroDay #Exploit #AI #CyberSecurity #ThreatIntelligence

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088950084218036532"}, {"id": "2088947117532291259", "post_type": "R to @DailyDarkWeb", "created_at": "2026-08-16T11:12:58+00:00", "created_at_datetime": [2026, 8, 16, 11, 12, 58], "author": "@DailyDarkWeb", "post_text": "", "post_url": "https://x.com/DailyDarkWeb/status/2088947117532291259"}, {"id": "2088946126783185365", "post_type": "Normal", "created_at": "2026-08-16T11:09:02+00:00", "created_at_datetime": [2026, 8, 16, 11, 9, 2], "author": "@DailyDarkWeb", "post_text": "

Long before biometric databases went digital, state surveillance relied on physical, physical-world identifiers.
\n
\nDuring the Cold War, East Germany’s secret police, the Stasi (Ministerium für Staatssicherheit), pioneered \"Geruchsspuren\" (Scent Samples) to track dissidents and political opponents.
\n
\nHow the Stasi Built Their Scent Archive:
\n
\n*Collection Methods: During interrogations, agents forced suspects to sit on sterile yellow cloths (Geruchstuch) to absorb sweat. They also conducted covert break-ins to steal worn socks and underwear.
\n
\n*Storage Protocols: Samples were sealed in airtight glass jars, cataloged with metadata (donor ID, collection date, responsible unit), and stored in climate-controlled archives.
\n
\n*Deployment: Specially trained sniffer dogs were used to match scents from crime scenes or illegal leaflet distributions against the archive to track targets anywhere in the city.
\n
\nPhysical data collection has always been about total domain awareness, the techniques have just evolved from glass jars to digital intelligence.
\n
\n#OSINT #DarkWeb #SurveillanceHistory #Stasi #CyberIntelligence

\n\n
Video
\n \n", "post_url": "https://x.com/DailyDarkWeb/status/2088946126783185365"}, {"id": "2088945005435977916", "post_type": "Normal", "created_at": "2026-08-16T11:04:34+00:00", "created_at_datetime": [2026, 8, 16, 11, 4, 34], "author": "@DailyDarkWeb", "post_text": "

🇺🇦 Ukraine Says Nvidia Jetson Orin Module Found Inside New Russian S-71 Monochrome Cruise Missile
\n
\nUkraine’s military intelligence agency, HUR, says its specialists identified an **Nvidia Jetson Orin computing module** among the components recovered from Russia’s new **S-71 Monochrome cruise missile**.
\n
\n* According to HUR, the Jetson Orin module was found inside the missile’s onboard electronics.
\n
\n* The Jetson Orin family is designed for high-performance edge AI workloads, including computer vision, autonomous systems and real-time sensor processing.
\n
\n* HUR also reported identifying **35 foreign-made electronic components** across Russian weapons examined by Ukrainian specialists.
\n
\n* The finding raises further questions about how advanced Western-origin commercial technology continues to reach Russian military supply chains despite export controls and sanctions.
\n
\n⚠️ Analyst Note: The presence of an AI-capable commercial computing module inside a modern cruise missile is significant, but the exact role of the Jetson Orin in the S-71 system has not been publicly established from the material shown. It could potentially support navigation, sensor processing, target recognition or other onboard computation, but those functions should not be treated as confirmed without additional technical evidence.
\n
\nSource: Kyiv Post / Ukraine’s HUR
\n
\n#DDW #Intelligence #Ukraine #Russia

\n", "post_url": "https://x.com/DailyDarkWeb/status/2088945005435977916"}, {"id": "2088944684823347346", "post_type": "Normal", "created_at": "2026-08-16T11:03:18+00:00", "created_at_datetime": [2026, 8, 16, 11, 3, 18], "author": "@DailyDarkWeb", "post_text": "

🚨 Massive Azure Data Exfiltration Campaign Allegedly Hits McDonald’s, Vodafone, Kyndryl and Other Enterprises
\n
\nHudson Rock says it has uncovered a large-scale campaign in which threat actors are using compromised credentials to access Microsoft Azure environments and exfiltrate substantial volumes of enterprise data.
\n
\n* According to Hudson Rock, the campaign relies heavily on credentials harvested by information-stealing malware rather than exploitation of a new Azure vulnerability.
\n
\n* The researchers report that attackers are using compromised identities to authenticate to enterprise Microsoft cloud environments and access organizational data.
\n
\n* Hudson Rock says millions of records have been exfiltrated across affected environments.
\n
\n* Organizations referenced in the investigation include McDonald’s, Vodafone, Kyndryl and others.
\n
\n* The campaign highlights the continued value of infostealer logs to threat actors: credentials stolen from an endpoint can potentially provide access to cloud services long after the original device compromise.
\n
\n* The incident also demonstrates why password resets alone may be insufficient when session tokens, authentication artifacts or other credentials have been exposed.
\n
\n⚠️ Analyst Note: This should currently be treated as a researcher-reported campaign rather than confirmation that every named organization suffered a separately verified corporate breach. The important intelligence finding is the attack path: infostealer compromise → stolen enterprise credentials → legitimate cloud authentication → Azure data access and exfiltration. Organizations should correlate infostealer exposure with Entra ID sign-in telemetry, revoke active sessions and tokens, rotate affected credentials, and investigate abnormal cloud access rather than treating an infected endpoint as an isolated incident.
\n
\nSource: Hudson Rock
\n
\nhudsonrock.com/blog/massive-…
\n
\n#DDW #Intelligence #Azure #Infostealer

\n\n\n", "post_url": "https://x.com/DailyDarkWeb/status/2088944684823347346"}, {"id": "2089021157076865181", "post_type": "Normal", "created_at": "2026-08-16T16:07:10+00:00", "created_at_datetime": [2026, 8, 16, 16, 7, 10], "author": "@DarkWebInformer", "post_text": "

🚨🇫🇷 Cravero Motoculture dataset allegedly leaked on a cybercrime forum
\n⠀
\nA forum user claims to have leaked a database allegedly belonging to Cravero Motoculture, a French agricultural and outdoor equipment business. The post is labeled as part of the actor's \"BlgCloud Leak\" series.
\n⠀
\nThe advertised leak reportedly contains approximately 3.7 GB of data across 49,168 files.
\n⠀
\nThe exposed data shown in the samples includes:
\n⠀
\n• Customer and CRM records
\n• Contact names
\n• Email addresses
\n• Phone numbers
\n• Physical addresses
\n• Company and account information
\n• Customer and supplier references
\n• Billing and invoicing fields
\n• Commercial document metadata
\n• PDF sales proposals and other documents
\n• File names, hashes and storage paths
\n• Internal record and attachment identifiers
\n⠀
\nThe poster's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
\n⠀
\n💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

\n", "post_url": "https://x.com/DarkWebInformer/status/2089021157076865181"}, {"id": "2089019076932682065", "post_type": "Normal", "created_at": "2026-08-16T15:58:54+00:00", "created_at_datetime": [2026, 8, 16, 15, 58, 54], "author": "@DarkWebInformer", "post_text": "

🚨🇫🇷 FranceCasse customer and order dataset allegedly scraped and leaked on a cybercrime forum
\n⠀
\nA forum user claims to have released a newly obtained dataset from FranceCasse, a French automotive parts platform. The poster says the data was scraped during August 2026 and published samples from multiple files containing customer, address, order and product information.
\n⠀
\nThe advertised data includes:
\n⠀
\n• Customer names and usernames
\n• Email addresses
\n• Physical addresses and postal codes
\n• Customer account information
\n• Hashed passwords
\n• Order and cart identifiers
\n• Invoice and delivery information
\n• Payment method fields
\n• Order totals and shipping costs
\n• Product IDs and descriptions
\n• Product pricing and inventory information
\n• Vehicle and automotive part information
\n• Manufacturer and supplier fields
\n• Customer and delivery address records
\n⠀
\nThe forum post includes samples from files identified as addresses.csv, customers.csv, orders.jsonl and products.jsonl, with the full FranceCasse dataset placed behind hidden forum content.
\n⠀
\nThe poster's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
\n⠀
\n💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

\n\n\n", "post_url": "https://x.com/DarkWebInformer/status/2089019076932682065"}, {"id": "2089012403942170927", "post_type": "Normal", "created_at": "2026-08-16T15:32:23+00:00", "created_at_datetime": [2026, 8, 16, 15, 32, 23], "author": "@FalconFeedsio", "post_text": "

🚨 Ransomware Alert 🚨
\n
\nQilin ransomware group has added 2 new victims to their dark web portal.
\n
\n* Mulino Padano S.p.A. 🇮🇹
\n* WEBA 🇧🇪

\n", "post_url": "https://x.com/FalconFeedsio/status/2089012403942170927"}, {"id": "2088998981007532353", "post_type": "Normal", "created_at": "2026-08-16T14:39:03+00:00", "created_at_datetime": [2026, 8, 16, 14, 39, 3], "author": "@FalconFeedsio", "post_text": "

🚨Alert: New Hacktivist Alliance🚨
\n
\nBABAYO EROR SYSTEM and BNCT_1360 have officially announced a new alliance.

\n", "post_url": "https://x.com/FalconFeedsio/status/2088998981007532353"}, {"id": "2088998352180728198", "post_type": "Normal", "created_at": "2026-08-16T14:36:33+00:00", "created_at_datetime": [2026, 8, 16, 14, 36, 33], "author": "@FalconFeedsio", "post_text": "

🚨DDoS Alert 🇮🇱
\n
\nYEMEN CYBER GROUP claims to have targeted the website of Prima Hotels Israel (prima-hotels-israel.com)

\n", "post_url": "https://x.com/FalconFeedsio/status/2088998352180728198"}, {"id": "2088997856921391218", "post_type": "Normal", "created_at": "2026-08-16T14:34:35+00:00", "created_at_datetime": [2026, 8, 16, 14, 34, 35], "author": "@FalconFeedsio", "post_text": "

🚨 Ransomware Alert: 🇲🇦
\n
\nINFOSAT (infosat.ma), a Morocco-based IT services and technology solutions company, has reportedly fallen victim to PANZER ransomware.
\n
\nNB: They intend to publish the data within 20–21 days.
\n
\n🔍 Key Details:
\n
\n🛡️ Threat Actor: PANZER
\n📅 Reported on: 16/08/26
\n⚠️ Data Compromised: 35 GB

\n", "post_url": "https://x.com/FalconFeedsio/status/2088997856921391218"}, {"id": "2088997499688333331", "post_type": "Normal", "created_at": "2026-08-16T14:33:10+00:00", "created_at_datetime": [2026, 8, 16, 14, 33, 10], "author": "@FalconFeedsio", "post_text": "

🚨 Ransomware Alert: 🇨🇦
\n
\nMOSAID Technologies (mosaid.com), a Canada-based Semiconductor Manufacturing company, has reportedly fallen victim to Qilin ransomware.
\n
\n🔍 Key Details:
\n
\n🛡️ Threat Actor: Qilin
\n📅 Reported on: 14/08/26

\n", "post_url": "https://x.com/FalconFeedsio/status/2088997499688333331"}, {"id": "2088997324790063577", "post_type": "Normal", "created_at": "2026-08-16T14:32:28+00:00", "created_at_datetime": [2026, 8, 16, 14, 32, 28], "author": "@FalconFeedsio", "post_text": "

🚨 Ransomware Alert: 🇨🇦
\n
\nMOSAID Technologies (mosaid.com), a Canada-based Semiconductor Manufacturing company, has reportedly fallen victim to Qilin ransomware.
\n
\n🔍 Key Details:
\n
\n🛡️ Threat Actor: Qilin
\n📅 Reported on: 14/08/26

\n", "post_url": "https://x.com/FalconFeedsio/status/2088997324790063577"}, {"id": "2088978253537231205", "post_type": "Normal", "created_at": "2026-08-16T13:16:41+00:00", "created_at_datetime": [2026, 8, 16, 13, 16, 41], "author": "@FalconFeedsio", "post_text": "

🚨DDoS Alert 🇮🇱
\n
\nBD Anonymous claims to have targeted the website of Israel Defense and Security Forum (idsf.org.il)

\n", "post_url": "https://x.com/FalconFeedsio/status/2088978253537231205"}, {"id": "2088974163180732648", "post_type": "Normal", "created_at": "2026-08-16T13:00:26+00:00", "created_at_datetime": [2026, 8, 16, 13, 0, 26], "author": "@FalconFeedsio", "post_text": "

🚨 Ransomware Alert 🚨
\n
\nThe Qilin ransomware group has added 6 new victims to its dark web portal:
\n
\n• Desatera Sdn Bhd 🇲🇾
\n• Loescher Editore 🇮🇹
\n• BOTEK Präzisionsbohrtechnik GmbH 🇩🇪
\n• Zanichelli Editore S.p.A. 🇮🇹
\n• INVENSITY 🇩🇪
\n• Megawide Construction Corporation 🇵🇭

\n", "post_url": "https://x.com/FalconFeedsio/status/2088974163180732648"}, {"id": "2088974003318952072", "post_type": "Normal", "created_at": "2026-08-16T12:59:48+00:00", "created_at_datetime": [2026, 8, 16, 12, 59, 48], "author": "@FalconFeedsio", "post_text": "

🚨DDoS Alert 🇮🇱
\n
\nYEMEN CYBER GROUP claims to have targeted the website of Brown Hotels (brownhotels.co.il).

\n", "post_url": "https://x.com/FalconFeedsio/status/2088974003318952072"}, {"id": "2088973635214254355", "post_type": "Normal", "created_at": "2026-08-16T12:58:20+00:00", "created_at_datetime": [2026, 8, 16, 12, 58, 20], "author": "@FalconFeedsio", "post_text": "

🚨 Ransomware Alert 🚨
\n
\nThe LockBit 5.0 ransomware group has added 5 new victims to its dark web portal:
\n
\n• Verbandsgemeinde Rhein-Nahe 🇩🇪
\n• Agricola Galbusera 🇮🇹
\n• Crowe Dupouy 🇫🇷
\n• ACTUA Agences d'emploi 🇫🇷
\n• TECOSIM Group 🇩🇪

\n", "post_url": "https://x.com/FalconFeedsio/status/2088973635214254355"}, {"id": "2088942612329968004", "post_type": "Normal", "created_at": "2026-08-16T10:55:04+00:00", "created_at_datetime": [2026, 8, 16, 10, 55, 4], "author": "@FalconFeedsio", "post_text": "

🚨DDoS Alert 🇮🇱
\n
\nYEMEN CYBER GROUP claims to have targeted the website of Asden Israel (asden.co.il).

\n", "post_url": "https://x.com/FalconFeedsio/status/2088942612329968004"}, {"id": "2088931809354793141", "post_type": "Normal", "created_at": "2026-08-16T10:12:08+00:00", "created_at_datetime": [2026, 8, 16, 10, 12, 8], "author": "@FalconFeedsio", "post_text": "

🚨 Ransomware Alert 🚨
\n
\nQilin ransomware group has added 6 new victims to its dark web portal.
\n
\n* Double H Equipment 🇺🇸
\n* Motorenmaier GmbH 🇩🇪
\n* DELTA WAYS 🇩🇪
\n* Ascii Group, LLC 🇺🇸
\n* Arnall Golden Gregory LLP 🇺🇸
\n* Jone Precision 🇫🇷

\n", "post_url": "https://x.com/FalconFeedsio/status/2088931809354793141"}, {"id": "2088911481274519602", "post_type": "Normal", "created_at": "2026-08-16T08:51:21+00:00", "created_at_datetime": [2026, 8, 16, 8, 51, 21], "author": "@FalconFeedsio", "post_text": "

🚨DDoS Alert: 🇩🇪
\nNoName claims to have targeted Multiple websites in Germany.
\n
\n- Maritimes Cluster Norddeutschland e. V.
\n- Menzell Döhle Group
\n- ESWE Versorgungs AG

\n\n\n", "post_url": "https://x.com/FalconFeedsio/status/2088911481274519602"}, {"id": "2088908968915853331", "post_type": "Normal", "created_at": "2026-08-16T08:41:22+00:00", "created_at_datetime": [2026, 8, 16, 8, 41, 22], "author": "@FalconFeedsio", "post_text": "

🚨 Ransomware Alert: 🇹🇼
\n
\nSmartSoft Technology Co., Ltd. (smartsoft.com.tw), a Taiwan-based software development company, has reportedly fallen victim to Orova ransomware.
\n
\n🔍 Key Details:
\n
\n🛡️ Threat Actor: Orova
\n📅 Reported on: 16/08/26
\n⚠️ Data Compromised: 14.90 GB

\n", "post_url": "https://x.com/FalconFeedsio/status/2088908968915853331"}, {"id": "2088900616139760053", "post_type": "Normal", "created_at": "2026-08-16T08:08:11+00:00", "created_at_datetime": [2026, 8, 16, 8, 8, 11], "author": "@FalconFeedsio", "post_text": "

🚨DDoS Alert: 🇩🇪
\n
\nNoName claims to have targeted Two websites in Germany.
\n
\n- Rhein-Main-Verkehrsverbund GmbH
\n- ⁠Landeshauptstadt Wiesbaden

\n", "post_url": "https://x.com/FalconFeedsio/status/2088900616139760053"}, {"id": "2088881455648919916", "post_type": "Normal", "created_at": "2026-08-16T06:52:03+00:00", "created_at_datetime": [2026, 8, 16, 6, 52, 3], "author": "@FalconFeedsio", "post_text": "

🚨DDoS Alert 🇩🇪
\n
\nBD Anonymous claims to have targeted the website of Bundeskriminalamt(bewerbung.bka.de)

\n", "post_url": "https://x.com/FalconFeedsio/status/2088881455648919916"}, {"id": "2088866105196675235", "post_type": "Normal", "created_at": "2026-08-16T05:51:03+00:00", "created_at_datetime": [2026, 8, 16, 5, 51, 3], "author": "@FalconFeedsio", "post_text": "

🚨Alert: New Hacktivist Alliance🚨
\n
\nCYBER TEAM INDONESIA and Dark Storm Team have officially announced a new alliance.

\n", "post_url": "https://x.com/FalconFeedsio/status/2088866105196675235"}, {"id": "2088997599529324641", "post_type": "Normal", "created_at": "2026-08-16T14:33:34+00:00", "created_at_datetime": [2026, 8, 16, 14, 33, 34], "author": "@IntCyberDigest", "post_text": "

Epic Games has confirmed a native Linux client for the Epic Games Store. Staffer onepercentnachos told an August 13 Discord AMA it's coming \"soon,\" but not in the next preview build. Epic says the job is bigger than a launcher binary that runs on Linux.
\n
\nCurrent Linux and Steam Deck players still need non-native Heroic and Proton for now.

\n", "post_url": "https://x.com/IntCyberDigest/status/2088997599529324641"}, {"id": "2088921737735868599", "post_type": "Normal", "created_at": "2026-08-16T09:32:07+00:00", "created_at_datetime": [2026, 8, 16, 9, 32, 7], "author": "@IntCyberDigest", "post_text": "

North Korean threat actor says he got COVID-19 in 2018 during a job interview, then quickly corrects it to 2019, and says it took him two years to recover after being asked about the gap in his resume.

\n\n
Video
\n \n\n\n
\n
\ntanuki42 (@tanuki42_)\n

\n

1/ I think I found patient zero for COVID-19.
\n
\nMeet my latest North Korean applicant @hodlwarden (\"Ming Cheng\"). Ming had a mysterious 3 year employment gap on his resume from 2018-2021 which initially raised some concerns, but then he explained he was receiving COVID treatment.

\n\n\n\n
Video
\n \n\n\n\n

\n\n
", "post_url": "https://x.com/IntCyberDigest/status/2088921737735868599"}, {"id": "2088848597299404955", "post_type": "Normal", "created_at": "2026-08-16T04:41:29+00:00", "created_at_datetime": [2026, 8, 16, 4, 41, 29], "author": "@RaidForumsHub", "post_text": "

RaidBin is now LIVE!
\n
\nRaidBin — a fast, modern paste-sharing platform built for speed, simplicity, and reliability.
\n
\nVisit: raidbin.st
\nOnion: raidbinahr33urj6dcnuphimsnnx…
\n
\nFor Update Join : t.me/RaidBin
\n
\n#RaidBin #RaidForums

\n", "post_url": "https://x.com/RaidForumsHub/status/2088848597299404955"}]}