Telegram Intel Intelligence
Live threat intelligence collected from criminal Telegram channels — real-time threat actor communications, malware distribution campaigns, and first-look intelligence before it hits mainstream reporting.
Telegram Intel — Archive & Latest
DragonForce Ransomware Cartel, Noodle RAT Espionage Cluster + ScreenConnect Invitation Lures: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose DragonForce's ransomware cartel expansion, Chinese-speaking actors deploying Noodle RAT across APAC, and ScreenConnect RAT delivery via fake event invites. High urgency for enterprise SOC teams.
N0N Ransomware Gang: 23 New Leak-Site Listings in 24 Hours — Sector Targeting Analysis, Verification Caveats & Detection Rules
N0N posted 23 alleged victims to its leak site in a single day, claiming manufacturing, healthcare, and technology targets across the US, EG, and NL. All claims remain unverified.
PaperCut NG/MF AI-Orchestrated Exploitation: CVE-2026-81578/82078, Chisel SOCKS5, AD Credential Theft — OTX Detection Pack
OTX: exposed AI workbench shows PaperCut NG/MF exploitation, second RCE, reverse-SOCKS5 persistence and credential/AD theft across education victims; patch and hunt now.
THEGENTLEMEN Ransomware Gang: 31 New Leak-Site Listings in 48 Hours — Sector Targeting Analysis, Detection Rules & Response Priorities
THEGENTLEMEN has listed 31 organizations on its dark web leak site, skewing toward healthcare and government. Unverified claims — but defenders in these sectors should hunt now.
BambooToken MQTT C2, PeckBirdy Scambling Infrastructure & Fake MP4 NetSupport RAT: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal MQTT-based BambooToken/PlugX campaign across Asia, 1.7M PeckBirdy casino-laundering domains, and fake MP4 files delivering encrypted NetSupport RAT. High urgency.
KREMLIN Banking Extension, SysGoRAT Espionage & ARMORY CASTLE BeyondTrust Zero-Day: OTX Pulse Analysis — Enterprise Detection Pack
Three active campaigns: REF9334 KREMLIN banking malware targets Brazil, CL-UNK-1211 AI-built SysGoRAT hits government Linux, ARMORY CASTLE exploits BeyondTrust CVE-2026-102764 zero-day.
KGB RAT, KREMLIN, Variola & ARMORY CASTLE: OTX Pulse Analysis — Infostealer, Browser Hijack, and Zero-Day Exploitation Detection Pack
OTX pulses reveal FUD RAT sales, Chrome extension banking theft in Brazil, AI-orchestrated PaperCut exploitation, a ClickFix implant, and a PRC-nexus BeyondTrust zero-day. Hunt now.
N0N Ransomware Gang: 17 Leak-Site Listings in 4 Days — Cross-Sector Campaign Analysis & Detection Rules
N0N's dark web leak site shows 17 new victim claims in four days, spanning healthcare, technology, financial services and retail. Unverified claims — but defenders should hunt now.
CISA KEV Flash: 7 CVEs Added — Atlassian, Ivanti, PAN-OS & AhsayCBS Under Active Exploitation
CISA confirms 7 new actively exploited CVEs hitting Atlassian DC products, Ivanti Connect Secure, PAN-OS, AhsayCBS, Cisco SEG & Windows Shell. Patch now.
Iron Man System + YamStore PhaaS: OTX Pulse Analysis — Global Postal, Bank and Government Lure Infrastructure
OTX: Iron Man System/YamStore PhaaS sells postal, bank and gov lure kits to Chinese-speaking buyers; finance, health, telecom and retail should hunt IOCs now.
N0N Ransomware Gang: 14 Leak-Site Listings — Sector Targeting Analysis & Detection Rules
N0N lists 14 orgs across tech, healthcare, finance, retail and services; verify VPN/RDP/CI edge exposure and hunt pre-encryption staging.
Iron Man & CoGUI PhaaS Ecosystem: Chinese-Language Phishing Kit Disruption — OTX Pulse Analysis & Enterprise Detection Pack
OTX pulses expose the Iron Man/YamStore PhaaS ecosystem and CoGUI/CoAceV/CoFish_Ws kits hitting finance, government, and Japanese enterprises. High urgency: hunt and block now.
Agentic AI-Driven Spring Batch Intrusion + CoGUI/CoAceV/CoFish_Ws Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack
Live OTX pulses: LLM-agent orchestrated server takeover via exposed Spring Batch endpoint, and disruption of 3 Chinese-language phishing kits targeting Japanese finance & consumer brands. HIGH urgency.
N0N Ransomware Gang: 12 New Leak-Site Listings — Sector Exposure, Verification Limits & Detection Rules
N0N listed 12 organizations across technology, services, healthcare, retail and financial sectors in US/NL/BR; claims are unverified. Prioritize edge, virtualization and pre-encryption detection.
PEERSTITCH FortiGate Implant + Iron Man PhaaS Ecosystem: OTX Pulse Analysis — Edge Device & Phishing Detection Pack
CL-STA-0954 deploys PEERSTITCH memory-resident implant on FortiManager via CVE-2024-47575/CVE-2025-61624; Iron Man PhaaS kit mapped. Telecom, finance, gov at risk. Urgent patching + IOC sweep required.
Calendly Meta Phishing Kit + Candiru AdFection + CoGUI/CoAceV/CoFish Disruption: OTX Enterprise Detection Pack
OTX: fake Calendly Meta interviews steal Facebook/Google creds; Candiru AdFection zero-click ads; CoGUI/CoAceV/CoFish kits hit Japan. Hunt now.
Aoki Infostealer Targets AI Coding Assistant Credentials + CoGUI Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack
Aoki infostealer now harvests AI assistant API keys; fake Calendly/Meta phishing bypasses 2FA; AI agents breach servers. High urgency for credential-heavy environments.
WALLSTREET Ransomware Gang: 13 New Leak-Site Listings in 48 Hours — Sweden-Heavy Campaign Analysis & Detection Engineering
WALLSTREET listed 13 organizations on its dark web leak site Oct 13–14, 2026, with heavy concentration in Sweden and healthcare/professional services. Claims remain unverified — defenders should hunt now.
ShellBot, Fisieredoor & VShell Credential-Theft Campaigns Targeting Linux SSH and Windows Database Servers: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Q3 2026 brute-force campaigns hitting Linux SSH and Windows MS-SQL/MySQL servers, deploying ShellBot, Fisieredoor, XMRig, HackBrowserData, and web shells. High urgency for exposed infrastructure.
N0N Ransomware Gang: 25 Leak-Site Listings Including Port & Shipping Concentration — Sector Analysis & Detection Rules
N0N has listed 25 organizations on its dark web leak site, including a cluster of port and shipping entities. Maritime, healthcare, and financial orgs should harden now.
Godzilla Webshell + SweetPotato/PrintSpoofer IIS Intrusion Set: OTX Pulse Detection Pack for Windows Web Servers
OTX pulse flags Q3 2026 attacks on IIS/Tomcat via CVE-2019-18935, webshells, WordPress scanning and Potato privilege escalation; hunt and patch now.
CVE-2024-21762 FortiGate SSL-VPN Exploitation + MeshCentral RMM Persistence: Thai Telecom Intrusion — OTX Detection Pack
Active intrusion against Thai ISP 3BB via CVE-2024-21762 FortiGate SSL-VPN exploit, MeshCentral RMM for C2/persistence. Telecom sector. High urgency.
Storm-2561 Fake WatchGuard VPN SEO Poisoning: Signed Installer Trust Abuse + Credential Harvest — OTX Detection Pack
Storm-2561 SEO-poisoned fake WatchGuard VPN pages steal creds twice, then drop a genuine signed client. Block lookalike domains; verify VPN logins now.
AgentTesla FTP Exfiltration + Storm-2561 Fake WatchGuard VPN Credential Phishing: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose AgentTesla phishing with FTP exfiltration and Storm-2561's fake WatchGuard VPN sites harvesting credentials via SEO poisoning. High urgency.
N0N Ransomware Gang Claims 42 New Leak-Site Listings — Maritime & Logistics Cluster Emerges, Detection Rules Included
N0N lists 42 organizations on its leak site, with a heavy maritime/port-operations cluster spanning BR, KR, TR, SG, ID, JP and CN. All claims unverified.
N0N Ransomware Gang: 43 Listings in Latest Posting Wave — Maritime & Port Operations Campaign Analysis with Detection Rules
N0N's leak site lists 43 organizations, including an apparent coordinated wave against port, terminal, and shipping operators. Maritime, logistics, healthcare, and financial sectors should hunt now.
Log4Shell-Linked Malicious Domains Behind CDN Infrastructure: OTX Pulse Analysis of Shared-IP C2 & Precision Blocking — Enterprise Detection Pack
OTX pulse flags malicious domains moonlighthathel[.]org and ukankingwithea[.]com hidden behind shared CloudFront IPs; 15 hosts affected. Precision DNS triage and Log4Shell exposure checks urged.
N0N Ransomware Gang: 50 Leak-Site Claims — Maritime & Port-Logistics Surge Analysis and Detection Engineering
N0N claims 50 new listings, 13+ of them maritime/port-logistics operators posted in a single day. Shipping, terminal, and logistics orgs should hunt pre-ransom staging now.
Noir Crypto Wallet Drainer Abuses DNS-over-HTTPS for C2: OTX Pulse Analysis — Enterprise Detection Pack
Noir, an AI-developed crypto wallet drainer, uses DNS TXT records and DoH as dynamic C2 via Cloudflare Pages. Web3 users targeted. Urgency: High.
VulcanRAT207.A + Kimsuky 'GitPower': OTX Pulse Analysis — WhatsApp-Delivered RAT Chains & Nation-State Espionage Detection Pack
OTX pulses expose TA4922's WhatsApp-delivered VulcanRAT207.A SYSTEM-escalation chain and Kimsuky's GitPower spear-phishing op against Ukrainian diplomats. High urgency.
N0N Ransomware Gang: 50 Organizations Listed in Coordinated Maritime & Logistics Campaign — Sector Analysis & Detection Rules
N0N has listed 50 organizations — heavily concentrated in maritime shipping, ports, and logistics across Asia-Pacific and South America. Claims remain unverified; defenders in these sectors should hunt now.
Brand Deal Phishing Campaign Targeting YouTube Creators: SSO Abuse & Google Credential Theft — OTX Pulse Detection Pack
OTX pulse exposes a sponsorship-scam phishing operation impersonating Nike, Spotify & Hollyland to hijack YouTube creator Google accounts via fake brand-deal portals. Hunt now.
N0N Ransomware Gang Claims 50 Victims in Coordinated Maritime & Logistics Leak-Site Campaign — Sector Analysis & Detection Rules
N0N has listed 50 organizations — heavily concentrated in ports, container shipping, and logistics — on its dark web leak site. Maritime and transportation security teams should hunt now.
N0N Ransomware Gang: 12 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules
N0N listed 12 organizations across CA/US/AU, spanning healthcare, technology and professional services. All listings are unverified actor claims; defenders should hunt pre-encryption staging now.
N0N Leak-Site Claims: 13 Organizations Listed Across CA/US/AU — Sector Targeting Analysis & Detection Rules
N0N listed 13 organizations across Technology, Healthcare, Professional Services and undisclosed sectors in CA/US/AU; claims are unverified. Regulated-data sectors should hunt staging and edge exposure now.
SILENTRANSOMGROUP: 5 New Leak-Site Listings in 6 Days — Professional Services Sector in the Crosshairs
SILENTRANSOMGROUP has listed 5 organizations on its dark web leak site since 2026-10-06, concentrated in US professional services. All claims are single-source and unverified.
N0N Ransomware Gang: 12 Leak-Site Listings in One Week — Healthcare & Tech Targeting Analysis with Detection Rules
N0N listed 12 organizations on its leak site in five days, with healthcare, technology, and professional services firms in the US, CA, and AU named. Claims unverified; defenders should hunt now.
JFrog Artifactory Zero-Day Chain (CVE-2026-42016 / CVE-2026-42018 / CVE-2026-82329): In-the-Wild Exploitation Drops Rust Backdoor via log.gitclone.org C2 — OTX Detection Pack
Active in-the-wild chaining of three critical JFrog Artifactory CVEs enables auth bypass, admin takeover, and Rust backdoor deployment via Groovy plugins. Patch and hunt now.
JeetBot Twitch Extension OAuth Token Theft: OTX Pulse Analysis — Enterprise Detection Pack
Malicious 'JeetBot' Twitch extension stole OAuth tokens from ~30.5k users, sending sessions to Russian-linked proxies; revoke tokens and block jeetbot.cc now.
KATARU IoT Botnet + Mirai-Style Telnet Brute-Force: OTX Pulse Analysis — Linux LPE Exploit & Detection Pack
KATARU IoT malware brute-forces Telnet credentials, deploys three public Linux LPE exploits, and establishes encrypted C2. IoT/OT networks at risk — hunt now.
Google Trust-Proxy Phishing Chain + ScreenConnect Follow-On: OTX Detection Pack for Credential Harvesting
OTX: global phishing abuses six Google services as trusted redirects to harvest credentials across manufacturing, government, finance and NGOs; ScreenConnect flagged as possible follow-on.
Google Infrastructure Trust-Proxy Phishing Campaign + ScreenConnect Delivery: OTX Pulse Analysis — Enterprise Detection Pack
Global phishing campaign weaponizes six Google services as trust proxies to deliver ScreenConnect and harvest credentials. Manufacturing, government, finance, and NGO targets. Hunt now.
DRAGONFORCE Ransomware Gang: 4 New Leak-Site Listings Across Manufacturing, Energy & Technology — Claims Analysis & Detection Rules
DRAGONFORCE has listed 4 organizations in PE, TW, BR, and FR on its leak site this week. Manufacturing, Energy, and Technology teams should review detections now.
Melofee Linux Implant Resurfaces: APT41 Toolset Evolution with Reptile Kernel Rootkit — OTX Detection & Hunting Pack
OTX pulse reveals APT41's Melofee Linux implant evolved with modular hot-loadable components and Reptile-based kernel rootkit. High urgency for Linux server fleets.
CISA KEV Flash: 6 CVEs Added — BIND, Struts, ProFTPD & Citrix NetScaler Under Active Attack
CISA confirms active exploitation of 6 CVEs across ISC BIND, Apache Struts, Strapi, ONLYOFFICE, ProFTPD, and Citrix NetScaler. Federal remediation deadlines are binding — patch now.
Casbaneiro Banking Trojan (Metamorfo/Ousaban) Distributed C2 Campaign: OTX Pulse Analysis — LATAM Financial Sector Detection Pack
Casbaneiro banking trojan targets LATAM finance users via phishing PDFs, HTA downloaders and AutoIt loaders with geofenced C2. High urgency for credential theft.
RHYSIDA Ransomware Gang: 3 New Leak-Site Claims — US Professional Services & Government Targeting Analysis and Detection Rules
RHYSIDA has listed three US organizations — two professional services firms and one county government — on its dark web leak site. Claims are unverified; affected sectors should review detection content.
Mantax Otax Mobile Ransomware + NEBULA npm Supply-Chain RAT: OTX Pulse Analysis — Cross-Platform Detection Pack
OTX pulses expose Indonesian Android ransomware with Firebase C2 spyware and a 7-package npm supply-chain op dropping a Windows RAT. High urgency.
GRIMWEDGE & SUPERSTOMP 0-Day Chain: UTA0560 and JungleBamboo Exploit CVE-2026-85880 in NGO Targeting Campaign
Two Chinese threat actors chain unpatched Chrome/Windows 0-days (CVE-2026-85046/85880/87491) to deploy GRIMWEDGE, SUPERSTOMP, and LONGTALE against U.S. NGOs. Urgent patch-gap risk.
GRIMWEDGE/SUPERSTOMP Chrome-Windows 0-Day Chain + Djinn Stealer/TaskWeaver Credential Raid: OTX Detection Pack
OTX: UTA0560/JungleBamboo Chrome+Windows 0-day chain and Djinn Stealer/TaskWeaver credential raids; patch, hunt Node/Chrome artifacts, reset secrets.
Showing 50 of 1458 reports. Archive expands automatically as new intel is generated.
Every Telegram Intel Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.