VECERT Analyzer

🚀 Revolutionize your analysis with VECERT AnalyzerPRO V6! 🔍 We’ve worked to bring true 360° OSINT capabilities to Analyzer. From CTI to pure OSINT, gain access to a vast repository of investigative data and real-time archives. 🌐📊 Ideal for resolving and tracking cyber incidents, physical-world events, and complex investigations. Put the full power of information right at your fingertips! 🕵️‍♂️💻💸 🏢 Companies, institutions, and independent organizations can purchase a license by emailing us at: ✉️ [email protected] Start mastering the tool with our tutorials: 🎥 AnalyzerPRO - Investigation Basic I: youtube.com/watch?v=apk9XsUK… 🎥 AnalyzerPRO - Investigation Basic II: youtube.com/watch?v=2ii8huHE… #OSINT #CTI #VECERT #AnalyzerPRO #Cybersecurity #CyberIntelligence #FinancialInvestigation #DataAnalysis

⚠️ 🇮🇩 🛂 🗄️ PREVENTIVE ALERT – ALLEGED EXPOSURE OF 1.03M CLIENT FILES FROM A VISA AGENCY IN INDONESIA (ACTOR: FUGHT19707551) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: FUGHT19707551 / DATE: OCTOBER 28, 2026] The centralized cyber-intelligence system has intercepted a commercial offer on underground forums, posted on October 28, 2026, by the user Fught19707551. The post announces the availability for sale of a massive data dump—comprising 1,025,482 items organized into 30,999 client folders (with a total compressed size of 613 GB)—stolen from a visa and travel agency in Indonesia that managed its client intake via the "Backend-as-a-Service" platform, Supabase. According to the threat actor’s description, the database suffered from misconfigured Row-Level Security (RLS) policies—with the "anonymous" role left open—and a storage bucket configured as public. This allowed for the complete extraction of identity documents, passports, KTPs (Indonesian national ID cards), family registration cards (KK), bank statements, and biometric records belonging to visa applicants for international destinations (such as South Korea, Japan, the United States, the United Kingdom, the Schengen Area, etc.), collected between June 2024 and August 2025. It should be strictly noted that the occurrence of this intrusion, the actual vulnerability within the agency’s Supabase infrastructure, and the overall authenticity of the exposed records have not been officially confirmed by the affected company or by cybersecurity authorities in Indonesia. As this involves offers for sale on underground forums, the actual status of the infrastructure remains speculative and unconfirmed. Threat Actor: Fught19707551 Victim / Target: A visa and travel agency based in 🇮🇩 Indonesia (utilizing Supabase infrastructure). Sector: 🛂 Travel Services, International Visa Processing, Immigration Consulting, and Digital Identity. Date of Publication: October 28, 2026. Nature of the Incident: Alleged exfiltration and commercialization of a massive 613 GB repository containing personally identifiable information (PII), official identity documents, and financial data from over 30,000 client files. 🛡️ PREVENTIVE TECHNICAL RECOMMENDATIONS FOR CONTAINMENT (SOC / CSIRT / SUPABASE ADMINISTRATORS) Audit and Immediate Restriction of RLS Policies in Supabase: Organizations using Supabase or similar architectures must urgently review their Row-Level Security (RLS) policies and ensure that storage buckets are not configured with unrestricted public access for anonymous roles. Identity Protection and Alerts for Affected Individuals: Implement monitoring and alert mechanisms for individuals whose passports, NIK (national ID) numbers, and financial documents appear in the dataset, in order to mitigate serious risks of identity theft and cross-border financial fraud. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Inquiries and services: vecert.io/contact #Indonesia #VisaAgency #SupabaseMisconfiguration #DataLeak #DataBreach #BreachAlert #DatabaseLeak #PII #Passport #KTP #IdentityTheft #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇬🇧 🇮🇶 ✈️ 🗄️ PREVENTIVE ALERT – ALLEGED SALE OF 8.6 MILLION RECORDS FROM MAG AIRPORTS AND IRAQI DATABASES (ACTOR: LVOID) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: LVOID / DATE: OCTOBER 29, 2026] The centralized cyber-intelligence system has intercepted a sales offer on underground forums (RaidForums), posted on October 29, 2026, by the user "lVoid." The post announces the alleged sale of over 8.6 million profiles (8,672,291) linked to major airports within the Manchester Airports Group (MAG) in the United Kingdom (Manchester, Stansted, and East Midlands), as well as databases from Iraq. The post details that the package includes upcoming travel itineraries for approximately 200,000 passengers, linked to their personally identifiable information (PII) and vehicle details. This data is contained in large *tar.gz* files—reaching sizes of up to 36.4 GB for Stansted—which hold billions of events, purchases, SMS messages, and platform configurations. It is strictly noted that the veracity of this compromise, the actual intrusion into MAG Airports' systems, and the overall authenticity of the exposed records have not been officially confirmed by the airport administration or the UK’s National Cyber ​​Security Centre (NCSC). As this concerns a sales offer on an underground forum, the status of the infrastructure remains alleged and unconfirmed. Threat Actor: lVoid Victim / Target: Manchester Airports Group (MAG) — Manchester, Stansted, and East Midlands Airports — 🇬🇧 United Kingdom / 🇮🇶 Iraq. Sector: ✈️ Aviation, Critical Transport Infrastructure, Airport Operations, and Passenger Logistics. Publication Date: October 29, 2026. 🛡️ TECHNICAL RECOMMENDATIONS FOR PREVENTION AND CONTAINMENT (SOC / CSIRT / CRITICAL INFRASTRUCTURE) Immediate Forensic Audit of Passenger Systems: Manchester Airports Group (MAG) cybersecurity teams must urgently review access to their customer databases, booking platforms, and parking portals to identify the source of the data exfiltration. Revocation of Credentials and API Keys: Proactively invalidate all access keys, API tokens, and administrative accounts associated with passenger management systems across the three affected airports. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #MAGAirports #ManchesterAirport #Stansted #EastMidlands #AviationSecurity #CriticalInfrastructure #DataLeak #DataBreach #BreachAlert #DatabaseLeak #PII #LVoid #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🌐 💰 🔓 PREVENTION ALERT - ALLEGED DRAINING OF FUNDS AND ACCOUNT COMPROMISE ON POLYMARKET (USER WARNING) [STATUS: ALLEGED / UNCONFIRMED / SOURCE: SOCIAL MEDIA / DATE: OCTOBER 29, 2026] Centralized cyber-intelligence systems have intercepted an urgent alert, circulated on digital platforms on October 29, 2026, by a user identified as "CarOnPolymarket." The report warns the user community of the prediction and cryptocurrency platform Polymarket to exercise extreme caution and lock their accounts immediately. The user claims that $800,000 in assets were drained from their account and mentions another instance where an acquaintance lost $600,000. The message urges users not to interact with the website, citing the alleged compromise of multiple accounts. It is strictly noted that the veracity of this mass compromise—including any potential vulnerability in Polymarket’s smart contracts or infrastructure, as well as the authenticity of the reported losses—has not been officially confirmed by the company. As these are preliminary reports originating from social media, the actual status of the platform remains alleged and unconfirmed. #Polymarket #CryptoSecurity #DeFi #WalletDrainer #Web3Security #CryptoAlert #DataLeak #DataBreach #BreachAlert #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇩🇴 ⚡ 🗄️ PREVENTIVE ALERT – ALLEGED EXPOSURE OF 500K RECORDS FROM EDESUR DOMINICANA (ACTOR: K3RN3L_P4N1C) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: K3RN3L_P4N1C / DATE: OCTOBER 29, 2026] The centralized cyber-intelligence system has intercepted a post on underground forums (DarkForums), made on October 29, 2026, by the actor K3RN3L_P4N1C. The report announces an alleged data dump containing over 500,000 records stolen from the *Empresa Distribuidora de Electricidad del Sur* (EDESUR) in the Dominican Republic. The alleged leak includes Personally Identifiable Information (PII) of subscribers, such as customer identification numbers (NIC), identity document numbers (docId), full names, exact home addresses, email addresses, phone numbers, service supply status, and accumulated debt amounts. It is strictly noted that the veracity of this intrusion, the vulnerability exploited in EDESUR’s servers, and the overall authenticity of the exposed records have not been officially confirmed by the state-owned electric utility or by cybersecurity authorities in the Dominican Republic. As this concerns data dumps published on underground forums, the definitive status of the infrastructure compromise remains alleged and unconfirmed. Threat Actor: K3RN3L_P4N1C Victim : *Empresa Distribuidora de Electricidad del Sur* (EDESUR) — 🇩🇴 Dominican Republic. Sector: ⚡ Electric Sector, Energy Distribution, and Strategic Public Utilities. Publication Date: October 29, 2026. Nature of the Incident: Alleged data breach and offering of relational databases containing subscriber records, electricity supply details, geographic locations, and financial debt status, comprising over 500,000 entries. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / ELECTRICITY SECTOR) Audit and Review of Billing and Customer Service Systems: EDESUR’s technical teams must immediately isolate the relevant servers, database query gateways, and associated web portals to identify the initial data extraction vector. Forced Rotation of Credentials and API Keys: Invalidate all service accounts, database access tokens, and administrative credentials that hold privileges over subscriber data repositories. Early Warning for Affected Citizens: Implement monitoring and alert guidelines for users whose personal data—including national identification numbers and addresses—appear in the compromised dataset, in order to mitigate the risks of identity theft and telephone-based scams. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / ELECTRICITY SECTOR) Audit and Review of Billing and Customer Service Systems: EDESUR’s technical teams must immediately isolate the relevant servers, database query gateways, and associated web portals to identify the initial data extraction vector. Forced Rotation of Credentials and API Keys: Invalidate all service accounts, database access tokens, and administrative credentials that hold privileges over subscriber data repositories. Early Warning for Affected Citizens: Implement monitoring and alert guidelines for users whose personal data—including identification numbers and addresses—appear in the dataset, in order to mitigate the risks of identity theft and telephone scams. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security status at: monitor.vecert.io Inquiries and services: vecert.io/contact #DominicanRepublic #EDESUR #ElectricUtility #PowerDistributor #DataLeak #DataBreach #BreachAlert #DatabaseLeak #PII #DarkForums #K3RN3L_P4N1C #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇻🇪 🛜 🗄️ PREVENTIVE ALERT - ALLEGED EXPOSURE OF VNET CONTRACT AND SUBSCRIBER DATA (ACTOR: X01X00) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: X01X00 / VICTIM: VNET / DATE: OCTOBER 29, 2026] Centralized cyber-intelligence systems have intercepted a "proof of concept" (PoC) post, released on October 29, 2026, by the threat actor x01x00, targeting the Venezuelan telecommunications company VNET. The report contains JSON-formatted snippets that appear to expose internal records, including customer contracts, email addresses, phone numbers, and details regarding connectivity plans (VNET 200, VNET 600). It is strictly noted that the veracity of this compromise, the actual intrusion into the company’s servers, and the overall authenticity of the exposed records have not been officially confirmed. As this information appeared on clandestine platforms, the actual status of the infrastructure remains alleged and unconfirmed. Threat Actor: x01x00 Victim / Target: VNET (vnet.com.ve) — 🇻🇪 Venezuela. Sector: 🛜 Telecommunications, Internet Service Provider (ISP). Date of Publication: October 29, 2026. 🔍 TECHNICAL BREAKDOWN OF THE COMPROMISED INFORMATION Identifiers: Subscriber `contractId`. Personally Identifiable Information (PII): Email addresses (`email`, `accountEmail`) and mobile phone numbers (`telefono`, `accountMobile`). Service Details: Subscribed plans (plan, current plan, plan ID), account status, and notifications regarding system restrictions. 🛡️ PREVENTIVE TECHNICAL CONTAINMENT RECOMMENDATIONS (FOR SOC / CSIRT / ADMINISTRATORS) Perimeter Audit and Review: VNET’s technical teams must urgently review their access logs and databases to rule out any breaches or unauthorized data exfiltration. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security status at: monitor.vecert.io Quotes and services: vecert.io/contact #VNET #Venezuela #Telecommunications #ISP #DataLeak #DataBreach #BreachAlert #DatabaseLeak #PII #X01X00 #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇬🇷 🇪🇸 🇮🇹 🇧🇬 🇬🇧 🇷🇺 🌐 🏴‍☠️ ALERT/PREVENTIVE WEBSITE DEFACEMENT, DDoS, AND MASSIVE DATA LEAK (ACTOR: ANKA TEAM) [STATUS: ALLEGED / UNCONFIRMED / GROUP: ANKA TEAM (LEADER: DXEIZ) / DATE: OCTOBER 29, 2026] Centralized cyber-intelligence systems have intercepted a significant post on underground forums, published on October 29, 2026, by the actor DxeiZ (leader of the hacktivist group Anka Team). The report details the launch of "Operation October 29"—a coordinated cyberattack campaign involving the defacement of 29 key institutional and academic websites, distributed denial-of-service (DDoS) attacks against high-profile government and international portals, and an alleged massive leak of over 588 million data records. The compromised targets include prestigious universities and public agencies in Greece, Spain, Italy, Bulgaria, the United Kingdom, and Russia, as well as corporate and automotive industry platforms. It is strictly noted that the veracity of these intrusions, the actual effectiveness of the denial-of-service attacks, the true volume of the 588 million exfiltrated data records, and the overall integrity of the exposed information have not been officially confirmed by the affected institutions or international cybersecurity organizations. As these claims originate from propaganda-style communications on underground forums, the actual status of the infrastructure remains unconfirmed. Responsible Group: Anka Team Stated Motivation: Patriotic commemoration of the founding of the Republic ("Operation October 29"). General Scope: 29 major websites defaced. Multiple government and international portals subjected to DDoS attacks. Alleged seizure or extraction of over 588 million data records. Affected Countries and Entities: 🇬🇷 Greece, 🇪🇸 Spain, 🇮🇹 Italy, 🇧🇬 Bulgaria, 🇬🇧 United Kingdom, 🇷🇺 Russia, and global platforms. 🔍 TECHNICAL BREAKDOWN OF TARGETS 1. Defaced Websites: The group listed a series of affected government, university, and corporate domains and institutions: Greece (.gr): Multiple departments of the National Technical University of Athens (NTUA – e.g., mkae.mech.ntua.gr, esties.ntua.gr, lee.civil.ntua.gr, circuits.ece.ntua.gr, dpms-as.mech.ntua.gr), the Aristotle University of Thessaloniki (medhef.med.auth.gr), the Panteion University research center (behaviorism.panteion.gr), as well as secondary education institutes and the Attika Directorate of Education. Spain and Italy (.es, .it): IE University Publishing (iepublishing.ie.edu), Airzone portals in Europe (myzone.airzoneitalia.it, myzone.airzone.es, myzone.airzonefrance.fr, myzone.airzone.pt), the University of Pisa (ing-ele.ing.unipi.it), the Italian National Bar Council (formazionecontinua.cnf.it), and commercial management agencies. Bulgaria and Russia (.bg, .ru): South-West University (ph.swu.bg), UNIBIT Finance (fin.unibit.bg), as well as Russian state-run lyceums and universities such as Samara (lyceum.ssau.ru) and Kazan (ksuae.kgasu.ru). Other Targets: Academic resources from University College London (cel-resources.ucl.ac.uk), Amazon Web Services infrastructure (common-assets.s3.amazonaws.c…), Century 21 Hong Kong portals, and dealer networks (dealer-mitsubishi.com, bicycle.braking.com). 2. Infrastructure Affected by DoS/DDoS Attacks: Status verification reports (via Check-Host) were recorded for high-profile government and tourism portals: Government of Bulgaria (gov.bg, tourism.government.bg) and the Bulgarian Ministry of Foreign Affairs (mfa.bg). Russia’s Electronic Visa System (evisa.kdmid.ru) and its official tourism portal (discoverrussia.ru). Tourism platforms in the United Kingdom (visitbritain.com, visitengland.com). 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (FOR SOC / CSIRT / ADMINISTRATORS) Web System Auditing and Restoration: IT teams at the listed universities and public agencies must urgently verify the integrity of their web servers, restore files altered during defacement attacks, and audit activity logs (access logs). 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #AnkaTeam #Defacement #DDoS #DataLeak #CyberAttack #Greece #Spain #Italy #Bulgaria #Russia #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇮🇸 🚗 🗄️ PREVENTIVE ALERT – ALLEGED DATA LEAK & CLIENT EXPOSURE AT PORSCHE DEALERSHIP / BÍLABÚÐ BENNA IN ICELAND (THREAT ACTOR: MARX1337) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: MARX1337 / DATE: OCTOBER 29, 2026] Centralized cyber-intelligence systems have intercepted screenshots from monitoring sources and underground forums detailing a sale offer posted by the threat actor "Marx1337." The report indicates the alleged exfiltration of databases containing client information, sales leads, and vehicle configurations from the official Porsche dealership in Iceland. It is strictly noted that the occurrence of this intrusion, the specific vulnerability exploited within the dealership's systems, and the overall authenticity of the exposed records have not been officially confirmed by either Bílabúð Benna or Porsche AG. As this concerns a sale offer on an underground forum, the actual status of the affected infrastructure remains unconfirmed. Threat Actor: Marx1337 Victim / Target: Porsche Dealership, Iceland Sector: 🚗 Luxury Automotive, Official Dealerships, and Vehicle Sales in 🇮🇸 Iceland. 🔍 TECHNICAL BREAKDOWN OF THE DATA Structure of the Exfiltrated CRM Data: Identification Fields: First name, last name, contact identifier (Contact ID), and Icelandic personal/tax identification number (*Kennitala*). Contact Information: Mobile and work phone numbers (Phone number 1 / 2), and client email addresses (Email 1 / 2). Commercial Interests and Notes: Vehicle models viewed, sales follow-up notes in Icelandic, and configuration URLs linked to the official Porsche portal (configurator. porsche.com). Documentary Samples Included: Detailed vehicle price quotes (such as for a Macan 4, valued at over 14.9 million ISK including optional equipment), which reveal the trail of local buyers. 🛡️ PREVENTIVE TECHNICAL CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / AUTOMOTIVE SECTOR) Audit of CRM Systems and Lead Platforms: IT administrators at Bílabúð Benna must immediately audit access to their sales databases, web portals, and customer management systems to identify the source of the data exfiltration. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly verify your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Porsche #Iceland #Reykjavik #BilabudBenna #AutomotiveLeak #CRMData #DataLeak #DataBreach #BreachAlert #DatabaseLeak #Marx1337 #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇨🇱 🇺🇾 🇲🇽 🇦🇷 🇵🇾 🇩🇴 🇪🇸 🗄️ 🏴‍☠️ ALERT/PREVENTION – NEW WAVE OF DATA LEAKS AND INSTITUTIONAL COMPROMISES IN LATIN AMERICA AND EUROPE [STATUS: ALLEGED / UNCONFIRMED / DATE: OCTOBER 29, 2026] Centralized cyber-intelligence systems have intercepted two incident-monitoring dashboards—documented via visual evidence—detailing multiple posts regarding alleged data exfiltration. These incidents reportedly occurred between October 28 and 29, 2026, and are attributed to various threat actors (including Synq1xxss, homercracker, sameen, qillnihhers, cutzinger, karsovx, skyling, OscarElMasCapito, Hackero$, and GhostLeakers). The report outlines a critical situation involving the exposure of databases belonging to public institutions, healthcare systems, educational entities, and government registries in Chile, Uruguay, Mexico, Argentina, Paraguay, the Dominican Republic, and Spain. It is strictly noted that the veracity of these intrusions, the persistence of unauthorized access, and the overall authenticity of the exposed data volumes have not been officially confirmed by the affected entities or the relevant government authorities. As these reports originate from clandestine platforms and forums, the definitive status of the compromised infrastructure remains unconfirmed. 🌐 SUMMARY OF INTERCEPTED CASES - RedClínica (full 2026 data) & other clinics - SICFE Uruguay (1.5 million records) - UTU Uruguay (educational data) - SICECO (employee data, Guerrero) - Argensoft (831,968 individuals) - Paraguay (database) - State Health Institute (government-related) - IMG Hospital, Dominican Republic (15,284 individuals) - Educastur, Spain - Care Center for... Current Cases - Government of Jalisco - Argentina ANSES - Guerrero - SICECO - Municipality of Parras de la Fuente 🛡️ PREVENTIVE TECHNICAL CONTAINMENT RECOMMENDATIONS (FOR SOC / CSIRT / ADMINISTRATORS) Immediate Forensic Audit: IT teams at affected government agencies, hospitals, universities, and companies must urgently review their access logs to identify initial entry vectors (such as breaches in web gateways, stolen credentials, or database vulnerabilities). Revocation of Credentials and Sessions: Immediately invalidate all API tokens, cloud access keys, and administrative user accounts that hold privileges over the compromised servers. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security status at: monitor.vecert.io Inquiries and Services: vecert.io/contact #DataLeak #DataBreach #BreachAlert #DatabaseLeak #CyberAttack #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk #LatinAmerica #Chile #Uruguay #Mexico #Argentina #Paraguay #DominicanRepublic #Spain

⚠️ 🌐 🎮 💻 PREVENTIVE ALERT – ALLEGED COMPROMISE OF EPIC GAMES’ GITHUB ORGANIZATION & VALID ACCESS TO PRIVATE UNREAL ENGINE REPOSITORIES (THREAT ACTOR: KAIDO) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: KAIDO / DATE: OCTOBER 28, 2026] A centralized cyber-intelligence system has intercepted a notification—circulated by a threat actor known as "Kaido"—within clandestine monitoring channels. The report claims the availability and sale of four valid access tokens linked to Epic Games’ official GitHub organization. The post details access to a total of 56 repositories (both public and private), allegedly exposing major proprietary projects such as Unreal Engine and "zen." It further lists high-level privilege scopes, including full control over private repositories ("repo"), workflow management ("workflow"), and organizational read access ("read:org"). It is strictly noted that the authenticity of this token breach, the current validity of the access being offered, and the overall integrity of the exposed corporate repositories have not been officially confirmed by Epic Games or GitHub’s security teams. As this involves the sale of credentials and tokens on illicit marketplaces, the actual status of the infrastructure remains unconfirmed. Threat Actor: Kaido. Victim / Target: Epic Games’ official GitHub organization. Sector: 🎮 Video Game Development, Game Engines (Unreal Engine), Global Technology and Software. Publication Date: October 28, 2026. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / SOFTWARE DEVELOPMENT) Immediate Revocation of Tokens and API Keys: Epic Games’ security teams must urgently invalidate all Personal Access Tokens (PATs), OAuth tokens, and GitHub integrations associated with the compromised accounts to terminate any active sessions. Integrity Audit of Repositories (Unreal Engine and zen): Conduct a comprehensive forensic analysis of GitHub audit logs to detect unauthorized cloning, modifications to workflows, or the insertion of malicious code (supply chain poisoning). Forced Rotation of Corporate Credentials: Enforce strict multi-factor authentication (preferably using FIDO2-based physical security keys) for all developers with permissions for critical intellectual property repositories. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly verify your security at: monitor.vecert.io Quotes and services: vecert.io/contact #EpicGames #UnrealEngine #GitHub #TokenLeak #AccessTokens #SupplyChainSecurity #DevSecOps #DataLeak #DataBreach #BreachAlert #Kaido #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇵🇾 🛃 🗄️ PREVENTIVE ALERT - ALLEGED VULNERABILITY & NATIONWIDE ACCESS TO PARAGUAY CUSTOMS (DNIT SOFIA) SYSTEMS (ACTOR: ZFOLEAKS) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: ZFOLEAKS / DATE: OCTOBER 28, 2026] The centralized cyber-intelligence system has intercepted a communication on clandestine channels, disseminated on October 28, 2026, by the threat actor ZfoLeaks. The report claims the discovery of a critical vulnerability within the query system used by the customs facilities of Paraguay’s National Directorate of Tax Revenue (DNIT) — specifically, the "DNIT SOFIA Query Facilities." The attacker asserts having unrestricted access to the entirety of Paraguay’s customs data nationwide, and has publicly expressed uncertainty regarding whether to proceed with a massive data leak or to forgo publication. It is strictly noted that the veracity of this security flaw, the actual intrusion into DNIT/Customs servers, and the overall authenticity of the claimed access have not been officially confirmed by the National Directorate of Tax Revenue (DNIT) or Paraguay’s Computer Emergency Response Team (CERT-PY). As these are preliminary claims originating from clandestine messaging channels, the actual status of the infrastructure remains unconfirmed. Threat Actor: ZfoLeaks Victim / Target: National Directorate of Tax Revenue (DNIT) — SOFIA Query Facilities (Paraguay Customs) — 🇵🇾 Paraguay. Sector: 🏛️ Public Government Sector, Customs, Foreign Trade, Tax Collection, and Border Control. Publication Date: October 28, 2026. Nature of the Incident: Disclosure of a vulnerability and unauthorized global access to national-level customs databases and records. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / CERT-PY) Immediate Audit and Patching of SOFIA Endpoints: DNIT technology and security teams must urgently audit the servers and web portals associated with the SOFIA Query Facilities system to identify and mitigate the reported vulnerability vector. Isolation and Monitoring of Active Connections: Conduct a comprehensive review of access logs to identify any bulk queries or exfiltration of customs data that may have occurred in recent hours. Revocation of Credentials and Vulnerable Endpoints: Temporarily disable query services exposed to the public network that lack robust authentication, until the integrity of the environment can be guaranteed. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly verify your security at: monitor.vecert.io Inquiries and services: vecert.io/contact #Paraguay #DNIT #ParaguayCustoms #SOFIA #ZfoLeaks #CustomsLeak #GovSec #DataLeak #DataBreach #BreachAlert #DatabaseLeak #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇦🇷 🗄️ 🏥 PREVENTION ALERT - ALLEGED MASS EXPOSURE OF CITIZEN RECORDS, HEALTHCARE DATABASES, AND NATIONAL SYSTEMS IN ARGENTINA (THREAT ACTOR: ORDER66) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: ORDER66 / DATE: OCTOBER 28, 2026] Centralized cyber-intelligence systems have intercepted a case-monitoring dashboard detailing a massive series of posts made on October 28, 2026, by the threat actor "Order66." The report indicates the ALLEGED exfiltration and availability of several critical Argentine databases, affecting both general citizen registries and national healthcare infrastructure. The listed items include 14,237,190 citizen records, healthcare databases containing nearly 1.2 million records (Argentina Healthcare: 1,196,795), the Argentine Integrated Health Information System (SISA), corporate domains (interfy.com.ar), registries of healthcare professionals (rpe.dsalud.com.ar), and the SINIDE system, which contains 172,000 records. It is strictly noted that the veracity of these intrusions, the persistence of unauthorized access, and the overall authenticity of the exposed data volumes have not been officially confirmed by government entities or Argentina’s Agency for Access to Public Information (AAIP). As these reports originate from data brokers on clandestine platforms, the definitive status of the affected infrastructure remains unconfirmed. Threat Actor: Order66. Target Country: 🇦🇷 Argentina. Publication Date: October 28, 2026. 🔍 TECHNICAL BREAKDOWN OF INTERCEPTED CASES 1. General Citizen Registry: Title: 14,237,190 Citizens. Volume: Over 14.2 million personal records of Argentine citizens. 2. Healthcare Sector and Medical Records: Title: Argentina Healthcare 1,196,795 (Classification: Healthcare). Volume: Nearly 1.2 million patient or medical record entries within the healthcare sector. 3. SISA (Argentine Integrated Health Information System): Title: SISA - Argentine Healthcare. Nature: Compromise of databases belonging to the nation’s official public health and epidemiological system. 4. Corporate and Professional Platforms: Title: interfy.com.ar. Title: rpe.dsalud.com.ar (Classification: Healthcare – Healthcare Professional Registry). 5. SINIDE: Title: SINIDE: 172,000. Volume: 172,000 institutional records. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / PUBLIC SECTOR) Audit of Connectivity and Credentials in Healthcare Systems: IT teams within the affected healthcare entities and national agencies must immediately review access logs for SQL databases and ministerial portals linked to SISA. Revocation and Mandatory Rotation of API Keys: Proactively invalidate all service credentials, access tokens, and administrative accounts that hold privileges over the exposed servers. Early Warning Regarding Fraud and Social Engineering: Prepare public awareness campaigns in light of the high risk that these massive datasets could be exploited for telephone scams, identity theft, and targeted fraud in Argentina. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Argentina #Order66 #CitizenData #Healthcare #SISA #SINIDE #DataLeak #DataBreach #BreachAlert #DatabaseLeak #PII #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

⚠️ 🇲🇾 🏛️ 🗄️ PREVENTIVE ALERT – ALLEGED COMPROMISE OF MALAYSIAN E-SYARIAH COURT SYSTEMS, STATE DATABASES, AND LATERAL GOVERNMENT NETWORK ACCESS (THREAT ACTOR: BYTETOBREACH) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: BYTETOBREACH / DATE: OCTOBER 28, 2026] The centralized cyber-intelligence system has intercepted a high-impact post on underground forums, made on October 28, 2026, by the threat actor "bytetobreach." The report claims the compromise and exfiltration of source code from the entire Malaysian Sharia court ecosystem (e-Syariah), including regional databases for several states, such as Selangor, Penang, and Sarawak. Furthermore, the attacker asserts that they maintain persistent network access, noting that other Malaysian government agencies are reachable within the same network infrastructure (citing domains such as mot.gov.my, jpa.gov.my, mpi.gov.my, ukas.gov, jwp.gov.my, and hict.gov.my, among others). The post includes several screenshots as proof, along with data backups hosted on external platforms. It is strictly noted that the veracity of this intrusion, the persistence of access to the judicial systems, and the overall authenticity of the exposed source code and databases have not been officially confirmed by Malaysia’s National Cyber ​​Security Agency (NACSA/MyCERT) or the e-Syariah court administration. As this information originates from claims made by threat actors on underground forums, the actual status of the infrastructure remains unconfirmed. Threat Actor: bytetobreach Primary Victim/Target: e-Syariah Court System (Syariah Judiciary Department Malaysia / Jabatan Kehakiman Syariah Malaysia) and regional judicial systems (Selangor, Penang, Sarawak) — 🇲🇾 Malaysia. Stated Secondary Scope: Potential lateral network access to other Malaysian public agencies (mot.gov.my, jpa.gov.my, mpi.gov.my, ukas.gov, jwp.gov.my, hict.gov.my, etc.). Sector: 🏛️ Government Public Sector, Judiciary, Administration of Justice, and State Bodies. Publication Date: October 28, 2026. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / NACSA ​​MALAYSIA) Perimeter Isolation and Disconnection of e-Syariah Gateways: Malaysian government incident response teams must immediately isolate the e-Syariah system’s servers and web portals to sever any persistent access channels or command-and-control (C2) links maintained by the attacker. Audit of Lateral Movement within Government Networks: Urgently review authentication logs and network traffic between judicial servers and the aforementioned ministerial domains (mot.gov.my, jpa.gov.my, etc.) to rule out privilege escalation or cross-system persistence. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Malaysia #eSyariah #Judiciary #GovSec #CyberAttack #DataLeak #DataBreach #BreachAlert #SourceCodeLeak #DatabaseLeak #Bytetobreach #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk