@cyberintelligence.bsky.social🔴 Santos Brasil (port operations) — listed by N0n
📍 Brazil · Transportation · 12 Oct 2026
🏴 N0n has listed 9 victims since September 2026.
https://cyberthreatintelligence.net/ransomware-victim/santos-brasil-port-operations-n0n-2026
@cyberintelligence.bsky.social🔴 Spo****** Public Schools — listed by Nightspire
📍 Education · 12 Oct 2026
🏴 Nightspire has listed 341 victims since February 2025.
https://cyberthreatintelligence.net/ransomware-victim/spo-public-schools-nightspire-2026
@cyberintelligence.bsky.social🔴 Superterminais (port terminal operations) — listed by N0n
📍 Brazil · Transportation · 12 Oct 2026
🏴 N0n has listed 9 victims since September 2026.
@threadlinqs.bsky.socialpyronut, a fake Pyrogram fork, hides a Telegram-controlled RCE backdoor in Client.start(). https://intel.threadlinqs.com/threat/TL-2026-3366 #ThreatIntel #Pyronut #telegram #Python
@cyberintelligence.bsky.social🔴 T.S. Lines (intra-Asia container shipping) — listed by N0n
📍 Taiwan · Transportation · 12 Oct 2026
🏴 N0n has listed 9 victims since September 2026.
@cyberintelligence.bsky.social🔴 T2S (terminal systems operations) — listed by N0n
📍 Brazil · Transportation · 12 Oct 2026
🏴 N0n has listed 9 victims since September 2026.
https://cyberthreatintelligence.net/ransomware-victim/t2s-terminal-systems-operations-n0n-2026
@cyberintelligence.bsky.social🔴 Tsuneishi / Kambara Kisen (shipbuilding and ship management) — listed by N0n
📍 Japan · Manufacturing · 12 Oct 2026
🏴 N0n has listed 9 victims since September 2026.
@cyberintelligence.bsky.social🔴 TTI Algeciras (container terminal operations) — listed by N0n
📍 Spain · Transportation · 12 Oct 2026
🏴 N0n has listed 9 victims since September 2026.
@cyberintelligence.bsky.social🔴 VIATechnik, tech leader, added to Metaencryptor's leak site
📍 United States · Technology · 12 Oct 2026
🏴 Metaencryptor has listed 55 victims since August 2023.
https://cyberthreatintelligence.net/ransomware-victim/viatechnik-metaencryptor-2026
@cyberintelligence.bsky.social🔴 Yusen Logistics Hong Kong (3PL logistics) — listed by N0n
📍 Hong Kong · Transportation · 12 Oct 2026
🏴 N0n has listed 9 victims since September 2026.
@cyberintelligence.bsky.social🔴 ZPMC (port machinery and terminal engineering) — listed by N0n
📍 China · Manufacturing · 12 Oct 2026
🏴 N0n has listed 9 victims since September 2026.
@hapsis.bsky.socialRetail giant Ahold Delhaize takes systems offline after cyberattack
@hapsis.bsky.socialInside AvisLoader: A Windows Malware Loader Built to Resist Disruption
@threadlinqs.bsky.socialXWorm is back as a plugin platform - rootkit, webcam spying and ransomware loaded in memory on demand. https://intel.threadlinqs.com/threat/TL-2026-3363 #ThreatIntel #XWorm #Remcos #XCoderTools
@inferlume.bsky.socialCritical vulnerabilities in Gitea and Bricksforge WordPress plugins face active exploitation as CyberXero deploys autonomous AI agents and P7 DarkSword raids iOS keychains. Explore our full technical brief.
@threadlinqs.bsky.socialAvisLoader's C2 runs over Tox P2P - no domain to sinkhole, delivered by fake DocuSign ClickFix lures. https://intel.threadlinqs.com/threat/TL-2026-3362 #ThreatIntel #AvisLoader #UACMe #ClickFix
@netsecio.bsky.socialUnit 42 uncovers 'Blinder Tunnel,' an Iranian-nexus campaign targeting Iraqi critical infrastructure. Attackers use fake job lures, a custom ShelbyLoader V2 malware, and GitHub for C2 communications. #ThreatIntel #Iran #CyberSecurity #APT
🌐 cyber[.]netsecops[.]io
@threadlinqs.bsky.socialGitLab's CI/CD regex compiler flaw allows unauthenticated code execution on self-managed servers. https://intel.threadlinqs.com/threat/TL-2026-3356 #ThreatIntel #CVE_2026_97229 #GitLab #RCE
@threadlinqs.bsky.socialGoogle DevSite's OAuth secret was also its Flask signing key - forged cookies led to pickle RCE. https://intel.threadlinqs.com/threat/TL-2026-3355 #ThreatIntel #Python #pickletoolsdis #curl
@cyberintelligence.bsky.social🔴 PIC GROUP, INC — listed by Akira
📍 United States · Other · 12 Oct 2026
🏴 Akira has listed 1,632 victims since April 2023.
https://cyberthreatintelligence.net/ransomware-victim/pic-group-inc-akira-2026