wanted by however many agencies.
your aws key
Joined March 2026
- Tweets393
- Following21
- Followers2.1K
- Likes52
box turtle retweeted
🚨 Teenagers suspected of leading ransomware group arrested in international operation
Authorities from nine countries have disrupted KillSec, a ransomware group linked to almost 1,000 attacks worldwide.
⠀
A 16-year-old is suspected of serving as the group’s administrator and main operator.
Another suspected developer recently turned 18 and was a minor during several of the alleged offenses.
⠀
The operation resulted in:
• Three arrests
• Eight searches in Spain, Greece, the UK and Romania
• Five servers seized
• KillSec-operated domains seized
• At least 110 TB of stolen data secured
⠀
KillSec allegedly exploited poorly secured access points, particularly cloud storage, to steal sensitive data.
Victims were threatened with publication unless they paid a ransom.
The investigation remains ongoing.
box turtle retweeted
Gruppo Spaggiari Parma listed on the xpl0itrs DLS
Claims 6.1 TB of data taken
#osint #threatintel
box turtle retweeted
🚨 Data Breach Alert: xpl0itrs claims BMW Group as a victim.
The threat actor claims employee + customer PII (names, addresses, cars, VINs), config/API data, subsidiary maps, and data on 36 other car brands.
Asking price: $1.2k
box turtle retweeted
We are now monitoring a new leak site, Xpl0itrs. Four victims so far:
🇺🇸 RapidFort
🇺🇸 Dynatrace
🇦🇺 Oz Hair & Beauty
🇮🇹 redacted EdTech vendor (6.1TB claimed)
Two security vendors in the first four. That's the part I don't buy. No samples, just a countdown and a $12k price.
Claims until proven.
box turtle retweeted
The FBI has issued a FLASH on the cybercriminal group TeamPCP, which has carried out large-scale software supply chain compromises by targeting widely used developers and security tools. The group has infiltrated victim environments and extracted sensitive data, including cloud access tokens, SSH keys, and Kubernetes secrets. TeamPCP has also engaged in extortion and collaboration with cyber actors from other threat actor groups, publishing victim names on a public leak site and threatening to release stolen data.
Read the FLASH for more on TeamPCP’s tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and recommendations to protect your organization: ic3.gov/CSA/2026/260702.pdf
ALT FBI alert dated July 2, 2026, warning about cyber criminal group TeamPCP with official FBI seal in background.
box turtle retweeted
There are vulnerability brokers who have never published a single CVE, never spoken at a conference, never appeared in any public research. They just buy zero days quietly, resell them to governments quietly, and make more money than most Series A startups.
box turtle retweeted
😮😬
🚨 TeamPCP has posted a community statement addressing rumors and announcing the end of a partnership with HasanBroker.
The actor states that TeamPCP will no longer work with HasanBroker, citing poor treatment of staff and claiming HasanBroker was phished and lost access to his own domains and database, allegedly having to ask TeamPCP to retrieve it from an earlier breach attributed to Xploitrs.
The actor frames the post as a "sign of life," denying speculation that the team's spokesperson had been arrested or compromised, and explains that control of the alias would have transferred to another operator had that occurred. The actor invites contact regarding the forum, partnering on operations, or access and data, providing Session and Tox accounts.
Claim is unverified.
💥 Stop guessing what's redacted. Paid subscribers see everything: darkwebinformer.com/pricing
box turtle retweeted
🇺🇸 Dynatrace - A threat actor is claiming to sell an alleged internal Dynatrace GitHub organization dump containing 246 repositories and approximately 8.46 GB of data.
According to the actor, the dataset was obtained through a compromised developer Personal Access Token (PAT) and includes infrastructure topology, CI/CD configurations, Kubernetes management details, Terraform modules, ArgoCD deployment information, cloud account references, and internal deployment credentials.
The actor is offering the dataset for $12,000 and claims it contains information that could assist in mapping Dynatrace's internal cloud and software delivery environments.
Daily Dark Web has not independently verified the authenticity of the claims or the alleged repository contents.
Analyst Note: Infrastructure and CI/CD exposures can present greater long-term risk than traditional customer data leaks, as they may provide attackers with visibility into deployment pipelines, cloud environments, privileged service accounts, and software supply chain operations.
#DDW #Intelligence #DarkWeb #Dynatrace
box turtle retweeted
> be @github
> be acquired by @Microsoft
> get annoyed because @ChaoticEclipse0 published 0-days or because @xploitrsturtle2 published github's compromise evidences / proofs that github was successfully breached
> start a ban-wave targeting any "hacker related profile"
> ban me on Monday around 4am without any notices
> let my appeal ticket rot forever under some infinite SLA with zero explanation for the ban
> lock me out from updating dozens of open-source repos i contribute to
dude, i know i don’t have a profile full of followers, stars, famous projects or hype-driven repos, and i’m still learning so i can publish better work, but what kind of insane policy is this?
randomly banning security researchers with no warning, no reason, not even a basic email explaining what happened, just because @msftsecresponse has beef with some other security researcher? are triagers’ egos really that weak?
i’ve already seen multiple people on X getting hit by the same thing (like @yebtimothy, @MiroslavSraga, @CollinsCaxton4, @wavey0x and another guy that i forgot his username here on X), so i’m definitely not the only one.
now imagine everyone else who doesn’t want to go public and is just taking this garbage silently, GEEZ
box turtle retweeted
🚨🇺🇸 A threat actor known as xpl0itrs is advertising a dataset allegedly tied to Dynatrace, a publicly traded observability and monitoring SaaS platform whose primary customers are Fortune 500 enterprises.
The actor claims to have dumped the company's internal infrastructure GitHub organization using a developer's Personal Access Token (PAT), totaling 246 repositories and 8.46 GB. The listed manifest allegedly includes complete infrastructure topology, Vault endpoints and secret paths, ArgoCD deployment infrastructure, AWS account IDs and GCP KMS infrastructure, CI/CD pipelines, Kubernetes cluster state, signing certificate infrastructure, and secret management details.
The actor further claims the dump exposes over 1,000 employee records with GitHub handles, names, and corporate emails, along with Sigstore developer signing material. Samples and a sample repository have been posted as alleged proof, with the data offered for $12,000 USD (negotiable) and contact arranged via Tox and a Session ID.
Claim is unverified.
💥 Stop guessing what's redacted. Paid subscribers see everything: darkwebinformer.com/pricing
box turtle retweeted
Yes I did just dox myself.
My mum's friend made this for me, if you have spare cash I'd appreciate a donation, if you don't, continue following and appreciating my work.
Everyone's kind words mean so much to me.
gofundme.com/f/94qk6x-help-j…
