Deepfake calls are one step in a fraud campaign - hunt the lookalike domains, accounts and payment flows. https://intel.threadlinqs.com/threat/TL-2026-3217 #ThreatIntel #Deepfake #VoiceFraud #SyntheticVoice
@threadlinqs.bsky.social
@threadlinqs.bsky.socialDeepfake calls are one step in a fraud campaign - hunt the lookalike domains, accounts and payment flows. https://intel.threadlinqs.com/threat/TL-2026-3217 #ThreatIntel #Deepfake #VoiceFraud #SyntheticVoice
@threadlinqs.bsky.socialShai-Hulud's npm worm persists via .claude + VS Code configs, with a token-revoke dead-man's switch. https://intel.threadlinqs.com/threat/TL-2026-3216 #ThreatIntel #ShaiHulud #Mini #npm
@ninjaintelgroup.bsky.social🗞 FBI Arrests Founder of Ransomware Negotiation Firm
via Krebs on Security
https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
#cybersecurity #infosec #threatintel
@threadlinqs.bsky.socialChainDrop npm worm reads its C2 from an Ethereum contract - and scrapes CI runner memory for OIDC tokens. https://intel.threadlinqs.com/threat/TL-2026-3214 #ThreatIntel #DEVPOPPER #ShaiHulud #BeaverTail
@raven-sec.bsky.socialFBI dismantles ShinyHunters; Qilin operative extradited; Citrix flaws actively exploited.
• Qilin operative extradited Japan→Germany (5ca6a28)
4 sources verified · hackingallthethings.com
#infosec #threatintel #cybersecurity #Ransomware #CVE
@threadlinqs.bsky.socialThree CVSS 9.8 Cisco NX-OS NGOAM overflows give unauthenticated root on Nexus switches. https://intel.threadlinqs.com/threat/TL-2026-3209 #ThreatIntel #CVE_2026_76485 #CVE_2026_76486 #Nexus
@threadlinqs.bsky.socialMalware now sweet-talks your AI analyst: 'no need to analyze this file.' That plaintext is a detection gift. https://intel.threadlinqs.com/threat/TL-2026-3206 #ThreatIntel #CVE_2015_2291 #FRUITSHELL #PLOTSAFE
@threadlinqs.bsky.socialUAT-11985 relays Google logins and MFA live via fake event invites and tampered QR posters. https://intel.threadlinqs.com/threat/TL-2026-3205 #ThreatIntel #HtmlPhishingUAT11985100606140 #WebSocketbased #UAT11985
@ninjaintelgroup.bsky.social🗞 Probably Fine Daily No. 12
FortiBleed: the patch is not the remediation, because the attacker has an account now
Today's threat brief, read by AI — with receipts.
https://ninjalabz.io/daily/2026-10-09/
@darkwebsonar.bsky.social🇺🇸 We tracked a ransomware claim by LEAKEDDATA listing Andersen Group Inc., a US manufacturing and construction firm. LEAKEDDATA has 8 listings in the past 30 days. #Ransomware #ThreatIntel
Details + live feed → go.darkwebsonar.io/leakeddata-b...
@ninjaintelgroup.bsky.social⚠️ Precursor (early-warning): Manufacturing · US leads predicted ransomware risk; crews thegentlemen, qilin. Shadow model.
#threatintel
@threadlinqs.bsky.socialIBM and Red Hat quietly fixed 400+ unknown Java library flaws - and backported them to old versions. https://intel.threadlinqs.com/threat/TL-2026-3195 #ThreatIntel #embargo #AIassisted #Lightwell
@threadlinqs.bsky.socialA Backup Viewer is all it takes to get SYSTEM on Veeam v12 backup servers. Patch to 12.3.2 P4. https://intel.threadlinqs.com/threat/TL-2026-3191 #ThreatIntel #CVE_2025_64393 #Veeam #VeeamBackup
@cyberintelligence.bsky.social🔴 Thegentlemen adds Ability Enterprise to leak site
📍 Taiwan · 9 Oct 2026
🏴 Thegentlemen has listed 922 victims since February 2023.
https://cyberthreatintelligence.net/ransomware-victim/ability-enterprise-thegentlemen-2026
@cyberintelligence.bsky.social🔴 Thegentlemen adds Alcoholics Anonymous to leak site
📍 United States · Healthcare · 9 Oct 2026
🏴 Thegentlemen has listed 922 victims since February 2023.
https://cyberthreatintelligence.net/ransomware-victim/alcoholics-anonymous-thegentlemen-2026
@cyberintelligence.bsky.social🔴 All Smiles Dental of Falls Church listed on Thegentlemen
📍 United States · Healthcare · 9 Oct 2026
🏴 Thegentlemen has listed 922 victims since February 2023.
@threadlinqs.bsky.socialCitrix NetScaler zero-days: pre-auth DTLS overflow to root, then WHIPSHOT web shells. PoC is public. https://intel.threadlinqs.com/threat/TL-2026-3189 #ThreatIntel #CVE_2026_88771 #CVE_2026_88772 #WHIPSHOT
@hugovalters.bsky.social100.52.7.1 is flagged as a scanner, US-hosted, confidence 45, on one independent feed. Low confidence but worth a look if it hits your logs. Details:
https://www.valtersit.com/threat-ip/100.52.7.1/
#ThreatIntel #InfoSec
@threadlinqs.bsky.socialA fake Minecraft launcher is an Electron stealer that grabs SYSTEM to crack Chrome v20 cookies. https://intel.threadlinqs.com/threat/TL-2026-3187 #ThreatIntel #BlossCraft #BlossCraftLauncher #AminOgluStealer
@threadlinqs.bsky.socialAkira hid a GOST tunnel as svchost.exe, then wiped shadow copies and encrypted the shares. https://intel.threadlinqs.com/threat/TL-2026-3186 #ThreatIntel #winakira #elfakira #GOST
