Incransom Claims Meirc Breach, Threatens to Leak 1TB of Client Data
May 26, 2026
Incransom has claimed a full-network breach of Meirc Training & Consulting on May 25, threatening to publish 1TB of employee
Threat Actors
Incransom Claims Meirc Breach, Threatens to Leak 1TB of Client Data
Incransom has claimed a full-network breach of Meirc Training & Consulting on May 25, threatening to publish 1TB of employee and client data within one ...
DragonForce Lists Indiana Greenhouse Firm Heartland Growers
DragonForce ransomware listed Indiana wholesale greenhouse firm Heartland Growers on its dark web leak site amid escalating agricultural sector targeting.
Nova Ransomware Hits Brazilian Government Agency and Turkish Tech Firm
Nova ransomware claimed Brazil's SECONT and Turkey's Adensa Teknoloji on May 24, its third posting in three days spanning South America, Europe, and Turkey.
Qilin Ransomware Batch-Lists 7 Victims Across Five Countries
Qilin ransomware disclosed seven victims in a single May 24 batch across five countries, including a Czech financial firm and US accounting services provider.
Nightspire Ransomware Hits US Healthcare in Nine-Victim Batch
Nightspire ransomware posted nine victims on May 24 including US adult day center La Familia, an Egyptian Papa John's franchise, and a consumer lender across ...
ShinyHunters Claims 42M Charter Records, Sets May 27 Deadline
ShinyHunters listed Charter Communications with 42 million claimed records and a May 27 dump deadline; Charter confirmed an investigation with authorities.
Netherlands Seizes 800 Stark Industries Servers, Arrests Two
Dutch FIOD agents seized 800 servers and arrested two at Stark Industries successor WorkTitans for violating EU sanctions tied to Russian cyber operations.
ShinyHunters Claims 260K Baker Distributing Salesforce Records
Baker Distributing Company was added to ShinyHunters' Salesforce extortion campaign with 260,000 CRM records exposed and a May 27 public leak deadline.
DPRK npm Packages Use Hugging Face to Exfiltrate Developer Credentials
OX Security found DPRK-linked npm packages using postinstall hooks to deploy a keylogging infostealer that exfiltrates credentials via the Hugging Face API.
INJ3CTOR3 Deploys JOMANGY Webshell in FreePBX Campaign
CRIL documented INJ3CTOR3 deploying new JOMANGY webshell alongside a six-layer self-healing persistence mechanism against FreePBX VoIP systems for toll fraud.
DragonForce Lists Indiana Greenhouse Firm Heartland Growers
May 26, 2026
DragonForce ransomware listed Indiana wholesale greenhouse firm Heartland Growers on its dark web leak site amid escalating agricultural sector targeting.
Nova Ransomware Hits Brazilian Government Agency and Turkish Tech Firm
May 26, 2026
Nova ransomware claimed Brazil’s SECONT and Turkey’s Adensa Teknoloji on May 24, its third posting in three days spanning South
Qilin Ransomware Batch-Lists 7 Victims Across Five Countries
May 26, 2026
Qilin ransomware disclosed seven victims in a single May 24 batch across five countries, including a Czech financial firm and
Nightspire Ransomware Hits US Healthcare in Nine-Victim Batch
May 26, 2026
Nightspire ransomware posted nine victims on May 24 including US adult day center La Familia, an Egyptian Papa John’s franchise,
ShinyHunters Claims 42M Charter Records, Sets May 27 Deadline
May 25, 2026
ShinyHunters listed Charter Communications with 42 million claimed records and a May 27 dump deadline; Charter confirmed an investigation with
Netherlands Seizes 800 Stark Industries Servers, Arrests Two
May 25, 2026
Dutch FIOD agents seized 800 servers and arrested two at Stark Industries successor WorkTitans for violating EU sanctions tied to
ShinyHunters Claims 260K Baker Distributing Salesforce Records
May 25, 2026
Baker Distributing Company was added to ShinyHunters’ Salesforce extortion campaign with 260,000 CRM records exposed and a May 27 public
DPRK npm Packages Use Hugging Face to Exfiltrate Developer Credentials
May 22, 2026
OX Security found DPRK-linked npm packages using postinstall hooks to deploy a keylogging infostealer that exfiltrates credentials via the Hugging
INJ3CTOR3 Deploys JOMANGY Webshell in FreePBX Campaign
May 22, 2026
CRIL documented INJ3CTOR3 deploying new JOMANGY webshell alongside a six-layer self-healing persistence mechanism against FreePBX VoIP systems for toll fraud.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.