/
data_types_exposed:credentials × victim_sectors:finance × criticity:critical × limpar

Resultados

3 casos · pág. 1/1

gbhackers.com · exploit público critical

INC and The Gentlemen ransomware affiliates leak AI-assisted intrusion ops: 8,257 Claude messages, 46 INC encryptor builds, 62 victims

SOCRadar's Threat Research Unit (STRU) found open directories on 45.227.254.43 in late September 2026. They led to six more adversary servers tied to INC Ransom and The Gentlemen affiliates. The servers held 8,257 AI messages across 133 sessions, source code, stolen credentials, victim workspaces and 46 victim-specific INC encryptor build…

CVE-2026-35616 CVE-2024-57727 CVE-2026-41940 INC Ransom The Gentlemen managed service providers finance
theregister.com · · 4 fontes · 4 atualizações critical

Ransomware groups Qilin, INC and Settra exploit PAN-OS GlobalProtect auth bypass CVE-2026-0257, pivoting to vCenter/ESXi

Palo Alto Networks Unit 42 reported on October 19, 2026 that ransomware operators are still actively exploiting CVE-2026-0257 (CVSS 7.8), an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. The flaw lets attackers bypass MFA and open unauthorized VPN sessions. Unit 42 attributes exploitation attempts to Spikey Scor…

CVE-2026-0257 CVE-2023-27532 Qilin Spikey Scorpius professional services legal services
darkreading.com · · 7 fontes · 7 atualizações critical

Storm-0940 abuses ARTEX AI agents and stolen ConnectWise Cloud Backup app credentials to hit 2,250+ Microsoft 365 tenants

Microsoft attributes the supply-chain compromise of ConnectWise Cloud Backup (formerly SkyKick) to Storm-0940, a China state-aligned actor active since at least 2021. The group has used the agentic AI penetration-testing framework ARTEX since at least September 2026 against hundreds of organizations worldwide (cyberscoop.com, thehackernew…

Storm-0940 TAG-217 aerospace defense