Threat Intelligence | Femto Security

Threat Intelligence | Femto Security

Zero-Day Exploit Compromises Diplomatic Academy Server

highdata breach

Zero-Day Exploit Compromises Diplomatic Academy Server

July 22, 2026 · chosun.com

An online learning management system belonging to a diplomatic academy was breached via a zero-day authentication bypass exploit. Threat actors maintained persistent access for ten months, compromising the personal data of 10,000 diplomatic personnel, including encrypted passwords and email addresses.

Relevant FemtoSec Service

Vulnerability Assessments

Advanced scanning and analysis techniques can help you improve your cybersecurity posture and resilience by leveraging the power of AI and ML. By using these techniques, you can protect your systems from current and emerging cyber threats and reduce your cyber risks.

data breachzero-day exploitdiplomatic security

Alleged PagBank Breach Exposes 10 Billion Transactions

highdata breach

Alleged PagBank Breach Exposes 10 Billion Transactions

July 22, 2026 · pwnforums.st

An alleged data breach targeting Brazilian payment gateway and digital banking platform PagBank has surfaced on underground forums. A threat actor claims to possess a database containing information related to 10 billion transactions, highlighting the growing cybersecurity risks facing the fintech sector.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

data breachfintechbanking security

BEC Phishing Attack Exposes Patient and Veteran Card Data

highphishing

BEC Phishing Attack Exposes Patient and Veteran Card Data

July 22, 2026 · cyberdaily.au

A localized business email compromise at an Australian healthcare provider has exposed sensitive patient communications and Department of Veterans' Affairs (DVA) ID numbers from an active shared mailbox. Learn how credential-harvesting attacks bypass legacy controls and how to secure cloud email environments.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

data breachbusiness email compromisehealthcare security

Krybit Ransomware Targets Delhi Heart and Lung Institute

highransomware

Krybit Ransomware Targets Delhi Heart and Lung Institute

July 22, 2026 · krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion

The Delhi Heart and Lung Institute has fallen victim to a major breach by the Krybit ransomware syndicate. The threat actors claim to have exfiltrated 22 GB of sensitive hospital, patient, employee, and corporate data, threatening public release within a short four-day window.

Relevant FemtoSec Service

Vulnerability Assessments

Advanced scanning and analysis techniques can help you improve your cybersecurity posture and resilience by leveraging the power of AI and ML. By using these techniques, you can protect your systems from current and emerging cyber threats and reduce your cyber risks.

ransomwarekrybithealthcare-security

BTMOB RAT v4.6 Mobile Malware Threat Analysis

highmalware

BTMOB RAT v4.6 Mobile Malware Threat Analysis

July 21, 2026 · forum.exploit.in

Defenders prioritizing mobile endpoint integrity must immediately audit Android Accessibility Service authorizations to counter BTMOB RAT v4.6. This technical analysis explores the malware's delivery vectors, capabilities like 2FA bypass, and step-by-step containment protocols.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

btmob rat v4.6malwaremobile security

DarkSword iOS Exploit Kit Source Code Leaked Online

highmalware

DarkSword iOS Exploit Kit Source Code Leaked Online

July 21, 2026 · forum.exploit.in

The full-chain DarkSword iOS exploit kit source code has been leaked on an underground forum. We analyze the technical mechanics of the multi-stage execution framework, its in-memory implants, and critical containment steps for enterprise environments.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

malwareexploit kitios security

SARA Node.js Android Ransomware Code Leaked on Forum

highransomware

SARA Node.js Android Ransomware Code Leaked on Forum

July 19, 2026 · breached.su

The source code for SARA, a Node.js-based Android ransomware tool, has been distributed on underground hacking forums. Discover how this lightweight malware exploits legacy Android permission models and learn critical containment procedures to safeguard enterprise mobile assets.

Relevant FemtoSec Service

Vulnerability Assessments

Advanced scanning and analysis techniques can help you improve your cybersecurity posture and resilience by leveraging the power of AI and ML. By using these techniques, you can protect your systems from current and emerging cyber threats and reduce your cyber risks.

sara-ransomwareandroid-malwarenode-js-malware

Aura Drainer Toolkit-Threat Analysis

highmalware

Aura Drainer Toolkit-Threat Analysis

July 18, 2026 · forum.exploit.in

Cryptocurrency assets across EVM, TRON, TON, and XRP networks face heightened exposure following the public sale of the Aura Drainer toolkit on underground crime forums. This Drainer-as-a-Service threat utilizes social engineering and smart contract abuse to bypass wallet security controls.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

aura drainercryptocurrency drainerweb3 phishing

Exploiting Trust Wallet: QR-Code Multi-Chain Drainer Threat

highmalware

Exploiting Trust Wallet: QR-Code Multi-Chain Drainer Threat

July 18, 2026 · forum.exploit.in

A sophisticated cryptocurrency drainer targeting Trust Wallet users on Tron, Ethereum, and Solana is being commercialized on Exploit.in. Utilizing deep link abuse and ERC-20 approval exploitation, this tool allows threat actors to bypass standard warnings and drain corporate virtual asset wallets.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

malwarecryptocurrency-drainertrust-wallet-exploit

New Phishing Kits Evade MFA to Hijack Microsoft 365 Accounts

highphishing

New Phishing Kits Evade MFA to Hijack Microsoft 365 Accounts

July 17, 2026 · ascarding.net

Technical analysis of Jalisco and OmegaLord, two advanced phishing kits designed to exploit the OAuth 2.0 Device Authorization Grant and bypass multi-factor authentication, leading to rapid SaaS data exfiltration within minutes of initial access.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

phishingoauth-abusemfa-bypass

Evaluating Xeno RAT Defense and Core Surveillance Tactics

highmalware

Evaluating Xeno RAT Defense and Core Surveillance Tactics

July 17, 2026 · spear.cx

The open-source Xeno RAT has emerged as a primary tool for advanced persistent threats in 2026. This technical intelligence analysis details its surveillance architecture, the multi-stage execution tactics seen in modern campaigns, and concrete detection rules for security operation centers.

Relevant FemtoSec Service

Our Red Teaming attack simulations mimic real-world cyber threats, pushing your systems, people, and processes to the limit. It’s not just a test, it’s a full-scale challenge to your cybersecurity strategy, revealing hidden vulnerabilities and showing you exactly where to strengthen your defenses.

Xeno RATMalware AnalysisEndpoint Security

DarkMatter RaaS: In-Depth Threat and Technical Analysis

criticalransomware

DarkMatter RaaS: In-Depth Threat and Technical Analysis

July 17, 2026 · breached.su

The emerging DarkMatter Ransomware-as-a-Service (RaaS) platform targets enterprise cloud and on-premises environments with polymorphic lockers. This technical advisory details its multi-platform execution, evasion tactics, and enterprise containment strategies.

Relevant FemtoSec Service

Penetration Testing

Proactively testing your systems, networks, applications, and infrastructure for vulnerabilities before attackers can find them. Our expert-led assessments simulate real-world threats to uncover weaknesses, ensure compliance, and strengthen your overall cybersecurity posture. Stay protected, stay ahead.

darkmatterransomwareraas

Inside the 300M Database Leak: Infostealer Log Exposure

highdata breach

Inside the 300M Database Leak: Infostealer Log Exposure

July 17, 2026 · darkforums.ru

An alleged 300-million-user database leak highlights the growing threat of repackaged infostealer logs on the dark web. While promoted as a direct corporate breach, research shows the data stems from distributed endpoint infections, exposing enterprises to intense credential stuffing and session hijacking risks.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

Data BreachInfostealersCredential Stuffing

WP2SHELL: Critical Pre-Auth RCE in WordPress Core

criticalvulnerability

WP2SHELL: Critical Pre-Auth RCE in WordPress Core

July 18, 2026

A critical pre-authentication remote code execution vulnerability chain known as WP2SHELL has been discovered in WordPress Core, affecting millions of websites. Learn the mechanics of the REST API route confusion and SQL injection, and access concrete detection logic and remediation guidance.

Relevant FemtoSec Service

Vulnerability Assessments

Advanced scanning and analysis techniques can help you improve your cybersecurity posture and resilience by leveraging the power of AI and ML. By using these techniques, you can protect your systems from current and emerging cyber threats and reduce your cyber risks.

wordpresswp2shellremote-code-execution

Adobe PDF Reader DLL Sideloader Offered on Exploit Forum

highmalware

Adobe PDF Reader DLL Sideloader Offered on Exploit Forum

July 16, 2026 · forum.exploit.in

A commercial Adobe PDF Reader DLL sideloader is currently being advertised on the Exploit.in underground forum. The tool is engineered to bypass Microsoft SmartScreen and Google Chrome protections, leveraging legitimate Adobe binaries to achieve defense evasion and execute malicious payloads within enterprise networks.

Relevant FemtoSec Service

Our Red Teaming attack simulations mimic real-world cyber threats, pushing your systems, people, and processes to the limit. It’s not just a test, it’s a full-scale challenge to your cybersecurity strategy, revealing hidden vulnerabilities and showing you exactly where to strengthen your defenses.

cyber attackadobe pdf reader dll sideloadermalware

Git Directory Exposure Leaks 9,000 Observer Profiles

highdata breach

Git Directory Exposure Leaks 9,000 Observer Profiles

July 15, 2026 · darkforums.ru

A severe data exposure involving administrative portals highlights the risks of exposed version control directories. Attackers harvested sensitive identity and banking details of exam observers, demonstrating how minor configuration oversights on web assets can dismantle complex digital-physical workflows.

Relevant FemtoSec Service

Attack Surface Management

Continuously monitoring and assessing all potential entry points that attackers could exploit, including subdomains, applications, cloud resources, and third-party services for ensuring a robust and resilient security posture against evolving cyber threats

Data LeakExposed Git DirectoryIdentity Exposure

RoguePlanet: Inside the CVE-2026-50656 Exploit

highvulnerability

RoguePlanet: Inside the CVE-2026-50656 Exploit

July 13, 2026 · darkforums.ru

An active exploit code for CVE-2026-50656, a high-severity local privilege escalation flaw in the Microsoft Malware Protection Engine, is being sold on dark web forums. Learn how the RoguePlanet exploit works and how to protect your enterprise Windows systems.

Relevant FemtoSec Service

Vulnerability Assessments

Advanced scanning and analysis techniques can help you improve your cybersecurity posture and resilience by leveraging the power of AI and ML. By using these techniques, you can protect your systems from current and emerging cyber threats and reduce your cyber risks.

CVE-2026-50656Windows DefenderPrivilege Escalation

RansomEXX Breach Analysis: Slovenian Media Network Hit

highransomware

RansomEXX Breach Analysis: Slovenian Media Network Hit

July 11, 2026 · rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion

A severe ransomware attack by RansomEXX disrupted broadcasting and leaked 2.4 GB of highly sensitive data containing casting applicant profiles, CVs, and audition files. This analysis covers the technical execution, the shift to Rust-based malware, and defense strategies to protect enterprise networks.

Relevant FemtoSec Service

Penetration Testing

Proactively testing your systems, networks, applications, and infrastructure for vulnerabilities before attackers can find them. Our expert-led assessments simulate real-world threats to uncover weaknesses, ensure compliance, and strengthen your overall cybersecurity posture. Stay protected, stay ahead.

RansomEXXRansomwareData Breach

MessiahGPT: Uncensored Malicious AI Ecosystem

highmalware

MessiahGPT: Uncensored Malicious AI Ecosystem

July 10, 2026 · breached.su

A deep technical analysis of MessiahGPT, an uncensored Mixture of Experts Large Language Model developed by Dabial Leaks. Discover how this adversarial AI automates malware creation, exploit writing, and social engineering pretexting, and implement the necessary egress controls to protect your enterprise.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

MessiahGPTDabial LeaksAdversarial AI

DevOps Credential Leak Exposes Private Repositories

highdata breach

DevOps Credential Leak Exposes Private Repositories

July 9, 2026 · ascarding.net

A confirmed breach of a major IT consultancy highlights the critical threat of exposed DevOps credentials. Learn how compromised Azure PATs, RSA keys, and private repositories put enterprise supply chains at risk and how to detect and contain these threats.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

DevOps SecurityCredential LeakSource Code Theft

SilentXMRMiner and Darknet Cryptojacking Risks

highmalware

SilentXMRMiner and Darknet Cryptojacking Risks

July 9, 2026 · abacusq6ixeuo7k322m7b26sny5zq4d3ot6lqe64q5agxajetncf6nid.onion

An analysis of the SilentXMRMiner payload and darknet marketplace threat actors reveals the technical execution steps of commodity cryptojackers, highlighting how defense evasion, process hollowing, and administrative exit scams shape the underground economy.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

SilentXMRMinerCryptojackingDarknet Market

SindriKit: Decoupling Syscalls to Evade EDR Telemetry

highmalware

SindriKit: Decoupling Syscalls to Evade EDR Telemetry

July 7, 2026 · darkforums.ru

Security researchers have highlighted a new evasion framework called SindriKit, which decoupling system call resolution from execution to evade EDR call-stack telemetry. By leveraging PEB traversal and dynamic stack spoofing, it poses a direct challenge to modern security monitoring tools.

Relevant FemtoSec Service

Our Red Teaming attack simulations mimic real-world cyber threats, pushing your systems, people, and processes to the limit. It’s not just a test, it’s a full-scale challenge to your cybersecurity strategy, revealing hidden vulnerabilities and showing you exactly where to strengthen your defenses.

Evasion FrameworkSindriKitCall-Stack Telemetry

Operation Navy Ghost: Backdoored PyPI Packages Exploit Bots

criticalsupply chain

Operation Navy Ghost: Backdoored PyPI Packages Exploit Bots

July 7, 2026 · ascarding.net

A sophisticated supply chain campaign dubbed Operation Navy Ghost targets Python developers building Telegram bots. Trojanized PyPI packages containing a hidden backdoor allow remote threat actors to run shell commands, exfiltrate files, and compromise enterprise production environments.

Relevant FemtoSec Service

Vulnerability Assessments

Advanced scanning and analysis techniques can help you improve your cybersecurity posture and resilience by leveraging the power of AI and ML. By using these techniques, you can protect your systems from current and emerging cyber threats and reduce your cyber risks.

operation-navy-ghostpypisupply-chain-attack

Understanding Keylogger Threats and DarkHotel Campaigns

highmalware

Understanding Keylogger Threats and DarkHotel Campaigns

July 7, 2026 · spear.cx

Underground distribution of tools like Digital Keylogger v3.3 highlights the ongoing risk of credential harvesting. When coupled with advanced tactics like the DarkHotel APT group's hotel Wi-Fi hijackings, enterprises face severe exposure risks. Learn the mechanics of kernel keylogging and how to protect your assets.

Relevant FemtoSec Service

Dark Web Monitoring

Scanning the dark web for your business's sensitive information and alerts you if it finds any matches. This way, you can take action to secure your accounts, change your passwords, or notify your customers and partners before any damage is done. Dark Web Monitoring also provides you with tips and resources to help you prevent identity theft and fraud.

KeyloggersDarkHotelSpyware