Boost global trust with ISO 27001 Certification

Talk to an Expert
>

Threat Intelligence

Daily Cybersecurity Threat Coverage With Actionable Response Context

Fresh analysis on breaches, active exploitation, phishing campaigns, and security trends, tied back to concrete response steps and the right FemtoSec service path.

Need help validating your exposure?

If a similar threat could impact your environment, FemtoSec can help you validate exposure, prioritize response, and strengthen controls before it becomes an incident.

Book a free risk assessment

Services

Penetration Testing
Vulnerability Management
Dark Web Monitoring
Attack Surface Management
Red Team Operations
Smart Contract Auditing
Source Code Review
AI Agentic Pentesting
Security Awareness

Solutions

For Enterprise
For Government
For Finance
For Web3
For Healthcare
For SMEs

Platform

CyberSec365
Compliance Hub
ISO 27001 Certification
ISO 9001 Certification

Resources

Vulnerability Research
Threat Intelligence
Security Training
vCISO Services
Blog

Free Tools

Dark Web Scanner

Company

Careers
Contact

Filters

Narrow the feed by threat type and severity.

Category

Category

Severity

Severity

Play Ransomware Targets The Innovation Group

highransomware

Play Ransomware Targets The Innovation Group

October 16, 2026 · j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion

Play ransomware operators have targeted United States management consulting firm The Innovation Group, publishing claims on their dark web leak site with a four to five day deadline to release stolen corporate data.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

ransomwareplay ransomwareplaycrypt

Returnero Leaks 200,000 Government Records

highdata breach

Returnero Leaks 200,000 Government Records

October 16, 2026 · darkforums.as

A dark web forum breach exposing 200,000 citizen records has highlighted severe identity theft and social engineering risks across public administration databases. FemtoSec provides deep technical analysis of the exfiltration vectors, MITRE ATT&CK mapping, and actionable containment measures for security teams.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

data breachgovernment securitydark web leak

Zero-day attackActive exploitation of a vulnerability before a fix is broadly available.

Suspected AI Agent Exploits German Municipal Zero-Day

highzero-day attack

Suspected AI Agent Exploits German Municipal Zero-Day

October 16, 2026 · mdr.de

A zero-day exploit targeting German municipal web infrastructure revealed autonomous execution speeds and live payload adaptation, forcing municipal portals offline.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

zero-dayai attackgermany

Fintech Payment Gateway Leaks 100,000 Billing Records

highdata breach

Fintech Payment Gateway Leaks 100,000 Billing Records

October 14, 2026 · leakbase.su

A threat actor claims to have published approximately 100,000 billing, payment, and customer records from a prominent Cambodian payment gateway on an underground forum, highlighting significant operational and fraud risks for integrated merchants and consumers.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

data breachpayment gatewayfintech

AbkoRAT License Sale Fuels Remote Surveillance Threat

highmalware

AbkoRAT License Sale Fuels Remote Surveillance Threat

October 7, 2026 · 185.206.215.219

Underground forums have observed threat actors commercializing AbkoRAT, a commercial Remote Access Trojan engineered for stealthy surveillance, multimedia interception, credential harvesting, and arbitrary command execution across compromised enterprise hosts.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

malwareremote access trojanabkorat

Zero-day attackActive exploitation of a vulnerability before a fix is broadly available.

DIVD Breach: AI Agent Exploits Zammad Zero-Days

highzero-day attack

DIVD Breach: AI Agent Exploits Zammad Zero-Days

October 7, 2026 · helpnetsecurity.com

The Dutch Institute for Vulnerability Disclosure disclosed a security intrusion after an autonomous AI threat actor chained two zero-day vulnerabilities in its exposed Zammad helpdesk platform, achieving remote code execution and local root privilege escalation before exfiltrating data.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

zero-dayagentic-aidata-breach

Panzer Ransomware Targets Healthcare with 33GB Exfiltration

highransomware

Panzer Ransomware Targets Healthcare with 33GB Exfiltration

October 5, 2026 · pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion

Panzer ransomware has targeted UK healthcare provider SMCare, exfiltrating 33GB of sensitive organizational data. The double-extortion campaign leverages cross-platform payloads capable of targeting Windows and VMware ESXi environments, enforcing strict countdown timers on dedicated Tor leak sites.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

ransomwarepanzerhealthcare

XWorm V3.0 RAT License Listed for Sale on Darknet

highmalware

XWorm V3.0 RAT License Listed for Sale on Darknet

October 5, 2026 · 185.206.215.219

Underground advertisements offering commercial licenses for XWorm V3.0 highlight the persistent threat of modular Remote Access Trojans capable of surveillance, keylogging, and complete Windows endpoint compromise across enterprise environments.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

xwormratmalware-as-a-service

Spirals Ransomware Hits Seven Seas Group in GCC

highransomware

Spirals Ransomware Hits Seven Seas Group in GCC

October 5, 2026 · spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion

Spirals ransomware has claimed the compromise of GCC-based maritime services provider Seven Seas Group, demanding ransom under a strict data leak countdown. This incident underscores critical risks across regional logistics and transportation infrastructure.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

ransomwarespiralsmaritime

FATETRAFFIC Threat Actor Sells Stealer Logs

highmalware

FATETRAFFIC Threat Actor Sells Stealer Logs

October 1, 2026 · darkfoxaqhfpxkrbt7vxns2z2u2k72sgmqbzeorupaiottw3ecm2wgyd.onion

A threat actor has advertised a batch of 3,100 FATETRAFFIC stealer logs on underground cybercrime forums. The archive contains harvested browser credentials, active session tokens, and endpoint metadata collected through widespread information-stealer malware operations.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

malwarefatetrafficinfostealer

Dark Project Ransomware Hits US Machinery Sector

highransomware

Dark Project Ransomware Hits US Machinery Sector

September 23, 2026 · darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion

Dark Project ransomware operators have listed a US industrial machinery distributor on their dark web portal, threatening to leak 115 GB of proprietary project drawings, customer databases, and financial files following an aggressive extortion countdown.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

ransomwaredark projectdata extortion

Water Infrastructure Authority Database Leaked Online

highdata breach

Water Infrastructure Authority Database Leaked Online

September 20, 2026 · darkforums.as

A threat actor claims to have leaked more than 100,000 records from a public water management entity, exposing Peruvian national identity document numbers, citizen names, emails, and internal complaint registries.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

data breachgovernmentpii leak

Hermes Stealer Emerges with HVNC and Token Theft

highmalware

Hermes Stealer Emerges with HVNC and Token Theft

September 18, 2026 · forum.exploit.in

A new malware-as-a-service offering named Hermes has surfaced on underground forums, bundling hidden virtual desktop control, browser credential harvesting, crypto wallet theft, and remote command execution.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

hermes stealerinfostealerhvnc

Cloud Module Breach Sparks Automated Resource Theft

mediummalware

Cloud Module Breach Sparks Automated Resource Theft

September 13, 2026 · ruhrkanal.news

A cloud authentication misconfiguration enabled automated external actors to gain unauthorized access to backend modules in an educational software ecosystem. While personal databases remained secure, the incident highlights critical supply chain and cloud access risks.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

cloud securityresource hijackingauthentication bypass

RedLine VIP Infostealer Log Sale Exposes 295k Records

highmalware

RedLine VIP Infostealer Log Sale Exposes 295k Records

September 13, 2026 · forum.exploit.in

Underground threat actors are actively marketing a massive 543 GB archive of RedLine VIP infostealer logs containing 295,631 harvested victim records. The exfiltrated data encompasses plaintext credentials, active browser session tokens, cryptocurrency wallet keys, and sensitive enterprise system metadata.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

redlineinfostealermalware

Vexy Ransomware Targets Retailer in 24GB Data Leak

highransomware

Vexy Ransomware Targets Retailer in 24GB Data Leak

September 9, 2026 · vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion

The Vexy ransomware group has published an extortion listing targeting Argentinian retailer Librería Santa Fe, claiming 24.2 GB of exfiltrated data with a 20-day publication ultimatum. Explore technical analysis, attack chains, and defensive containment strategies.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

ransomwarevexyargentina

AI Commerce Platform Zero-Day Breach Analysis

highvulnerability

AI Commerce Platform Zero-Day Breach Analysis

August 28, 2026 · pwnforums.st

A threat actor has claimed the exfiltration of 25 million records and 14 GB of internal data from conversational commerce platform bitbybit Studio, allegedly exploiting an unpatched zero-day vulnerability in public-facing infrastructure.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

data breachzero-day vulnerabilityconversational ai

Black Nevas Ransomware Targets Omani Enterprise

highransomware

Black Nevas Ransomware Targets Omani Enterprise

August 19, 2026 · ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion

A confirmed ransomware attack by the Black Nevas group has targeted Oman-based conglomerate OTE Group. The threat actors claim to have exfiltrated sensitive organizational data, signaling a rising risk to critical enterprise supply chains and automotive distributors across the GCC region.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

ransomwareblack nevasoman

ZXCHECKER Malware Exploits Cryptographic Seed Phrases

highmalware

ZXCHECKER Malware Exploits Cryptographic Seed Phrases

August 19, 2026 · forum.exploit.in

A threat actor on the Exploit forum is selling ZXCHECKER, a multi-chain cryptocurrency wallet validator designed to check balances across BTC, LTC, DOGE, DASH, and ETH. Discover the threat profile, technical attack chain, and steps to protect enterprise keys.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

cyber attackzxcheckermalware

SafePal Customer Data Leak Highlights E-Commerce Security

highdata breach

SafePal Customer Data Leak Highlights E-Commerce Security

August 17, 2026 · SafePal

A critical web-facing vulnerability in a third-party order-tracking plugin has exposed the personal information and physical shipping addresses of 39,798 hardware wallet users, raising severe secondary threat vectors including high-precision spear-phishing and regional social engineering campaigns.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

Data BreachWeb SecurityBOLA

Securing APIs Against BOLA: The Click to Pray Leak

highvulnerability

Securing APIs Against BOLA: The Click to Pray Leak

August 11, 2026 · allaboutcookies.org

A critical security flaw in the Vatican's Click to Pray application exposed the personal data of over 700,000 global users. This analysis highlights the technical details of the BOLA vulnerability, the registration hash leak, and practical steps to detect and prevent automated database harvesting.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

data breachapi securityidor

Qilin Supply Chain Attack Exposes Loyalty Program Data

highsupply chain

Qilin Supply Chain Attack Exposes Loyalty Program Data

August 11, 2026 · dutchnews.nl

A critical third-party supply chain cyberattack by the Qilin ransomware group against CEVA Logistics has exposed customer shipping data from downstream enterprises, including ING Bank. Discover the key attack vectors, technical implications, and robust mitigation strategies to defend your logistics perimeter.

Relevant FemtoSec Service

Attack Surface Management

Continuously discovers exposed assets, misconfigurations, and internet-facing risks.

supply-chain-attackqilin-ransomwaredata-breach

MyBB Plugin SQL Injection Zero-Days Sold on Dark Web

highvulnerability

MyBB Plugin SQL Injection Zero-Days Sold on Dark Web

August 9, 2026 · breached.su

An underground threat actor is actively selling two unauthenticated SQL injection zero-day vulnerabilities affecting widely used MyBB plugins with over 20,000 downloads. Learn the technical mechanics of the threat, the attack chain, and actionable detection strategies to secure your forum infrastructure.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

mybbsqlizero-day

Storm Ransomware Targets Exposed RMM Infrastructure

highransomware

Storm Ransomware Targets Exposed RMM Infrastructure

August 9, 2026 · yqhecvqtdvq6p7duqcgw2qca77spbgakxcoibtx6zpvfshltsbbbhfqd.onion

The Storm ransomware group (Storm-1175) has targeted exposed remote monitoring and management (RMM) consoles to gain administrative network control within 24 hours. By exploiting vulnerability CVE-2026-18577 in N-able N-central, the threat actors establish persistence, exfiltrate data, and deploy ransomware.

Relevant FemtoSec Service

Attack Surface Management

Continuously discovers exposed assets, misconfigurations, and internet-facing risks.

ransomwarestorm-1175cve-2026-18577

Threat Intelligence | Femto Security