StealthMole: RT by @stealthmole_int: We traced the threat actor behind the defacement of Malaysia's Ministry of Health (MOH) website. Our investigation found that the actor has been active on Telegram since 2024, participating in multiple channels related to hacking forums, web shells, spam, hacking tools, and data leaks.2026-06-29
stealthmole_intbreachMalaysia
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.
StealthMole: We traced the threat actor behind the defacement of Malaysia's Ministry of Health (MOH) website. Our investigation found that the actor has been active on Telegram since 2024, participating in multiple channels related to hacking forums, web shells, spam, hacking tools, and data leaks.2026-06-29
stealthmole_intbreachMalaysia
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.
Daily Dark Web: Major International Anti-Piracy Operation Seizes Pirate Streaming Infrastructure Law enforcement agencies from multiple countries have seized domains and infrastructure associated with large-scale piracy services as part of **Operation Offside**. * The seizure banner identifies participation from agencies including: * U.S.2026-06-28
DailyDarkWebcampaignUnknown
Daily coverage of dark web activities, cybercrime forums and underground market intelligence.
Daily Dark Web: Pinned: New Linux "pedit COW" Privilege Escalation Exploit Published Security researcher Massimiliano Oldani has released a public proof-of-concept (PoC) exploit, **packet_edit_meme**, for the Linux kernel vulnerability **CVE-2026-46331**, nicknamed **pedit COW**. * The flaw resides in Linux's **net/sched act_pedit** traffic control subsystem and allows an unprivileged local user to escalate privileges to **root** by corrupting shared page-cache memory.2026-06-28
DailyDarkWebvulnerabilityUnited States
Daily coverage of dark web activities, cybercrime forums and underground market intelligence.
Daily Dark Web: Clearcover Customer Data Allegedly Offered for Sale A threat actor claims to be selling a database allegedly belonging to U.S. auto insurer Clearcover. * According to the forum post, the dataset is dated **25 June 2026** and allegedly contains **448,603** records.2026-06-28
DailyDarkWebbreachUnknownT1566
Daily coverage of dark web activities, cybercrime forums and underground market intelligence.
Daily Dark Web: Alleged Compromise of Colima State Government Electronic Signature System A threat actor claims to have compromised the Advanced Electronic Signature (Firma Electrónica Avanzada) platform used by the Government of the State of Colima, Mexico. * According to the forum post, the actor alleges they: * Gained administrative access to the portal. * Deleted all user accounts except a single administrator account. * Retained control of the remaining administrative account.2026-06-28
DailyDarkWebcampaignMexico
Daily coverage of dark web activities, cybercrime forums and underground market intelligence.
Daily Dark Web: French Municipal Police Data Allegedly Leaked A threat actor claims to have leaked approximately 4,900 "mains courantes" (police incident reports/logs) belonging to the Municipal Police of Joinville-le-Pont, France. * According to the listing, the actor states the dataset was personally extracted and is offering access through a paid forum.2026-06-28
DailyDarkWebcampaignFrance
Daily coverage of dark web activities, cybercrime forums and underground market intelligence.
Daily Dark Web: Call of Duty: Mobile Internal Offsets Allegedly Released A forum user has shared what they claim is an internal `offsets dump.cs` file for the global version of Call of Duty: Mobile (package: `com.activision.callofduty.shooter`). The post includes a public download link and states the file will be reposted if the original link becomes unavailable.2026-06-28
DailyDarkWebbreachUnited States
Daily coverage of dark web activities, cybercrime forums and underground market intelligence.
Daily Dark Web: Croatian Student Database Allegedly Shared on Dark Web Forum A threat actor has published what they claim is a database containing approximately 954,000 records related to students from Croatian primary and secondary schools.2026-06-28
DailyDarkWebbreachCroatiaT1566
Daily coverage of dark web activities, cybercrime forums and underground market intelligence.
Daily Dark Web: French Hospital Patient Database Allegedly Repackaged and Shared A threat actor has published what they claim is a reformatted dataset originating from the 2024 Blackout ransomware leak targeting Centre Hospitalier d'Armentières in France. According to the post, the dataset contains information on approximately 203,928 patients, covering records from 2004 through March 2018.2026-06-28
DailyDarkWebransomwareFranceT1566
Daily coverage of dark web activities, cybercrime forums and underground market intelligence.
StealthMole: 𝗗𝗮𝘆 𝟮 𝗶𝘀 𝗶𝗻 𝗳𝘂𝗹𝗹 𝘀𝘄𝗶𝗻𝗴 𝗮𝘁 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗣𝗼𝗹𝗶𝗰𝗲 𝗘𝘅𝗽𝗼 𝟮𝟬𝟮𝟲! The best part of an event isn't the presentations. It's the conversations happening in between. Day 2 has been full of great discussions, new connections, and live demos at the StealthMole booth. Thank you to everyone who's stopped by so far! If you're at the expo today, come visit us at 𝗕𝗼𝗼𝘁𝗵 𝗔𝟮𝟯. There's still plenty of time to connect, exchange ideas, and see StealthMole in action.2026-06-25
stealthmole_intcampaignUnited States
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.
StealthMole: One thing we've learned from 𝗗𝗮𝘆 𝟭 𝗮𝘁 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗣𝗼𝗹𝗶𝗰𝗲 𝗘𝘅𝗽𝗼 𝟮𝟬𝟮𝟲 The best part of any event isn't the booth. It's the people you meet. Today was filled with conversations, new perspectives, and plenty of great moments with visitors, partners, and friends from across the industry. Thank you to everyone who spent time with us at 𝗕𝗼𝗼𝘁𝗵 𝗔𝟮𝟯.2026-06-25
stealthmole_intcampaignUnited States
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.
StealthMole: RT by @stealthmole_int: Following the Money: Mapping KidBin's Cryptocurrency Infrastructure Across Darkweb Note: When visiting this blog, you may see a "Sensitive Content" warning from Blogger. This warning is automatically generated by Google's systems based on the topics discussed on the site and does not necessarily indicate the presence of graphic or inappropriate material.2026-06-24
stealthmole_intcampaignUnknown
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.
StealthMole: RT by @stealthmole_int: Government-Related Darkweb/Deepweb Leak Activity — First Week of June 2026 Observed activity consists of 26 government-related leak or sale postings and 4 ransomware/extortion listings tied to public-sector or government-associated entities. The activity is distributed across multiple underground forums and Tor-hosted leak sites, with visible concentration on darkforums, spear, and craxpro.2026-06-10
stealthmole_intransomwareMexico
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.
StealthMole: Security OSINT Highlights — First Week of June 2026 Reporting collected during the first week of June 2026 is dominated by vulnerability disclosures and exploitation-related alerts, with a secondary concentration in malware, espionage, and intrusion activity supported by file-hash and IP indicators.2026-06-10
stealthmole_intmalwareUnited States
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.