CYBERMON DRI ANALYSIS
Breach claims, underground forum activity, and digital risk analysis from the CyberMon research team — written for security leaders who need signal, not noise.
LockBit came back within days of a major law-enforcement takedown. DeadLock never needed a conventional server to begin with. A look at EtherHiding, decentralized dead drops, and the first state-sponsored use of blockchain-based malware infrastructure — and what it means for defenders.
An underground forum advertisement for a new "Vexy" affiliate program claims Rust-based Windows, Linux, and ESXi lockers behind a $200 invitation fee — and its leak site is already listing ten claimed victims, seven of them Indian organizations. Here's what's advertised, what's observed, and what remains unproven.
MeduzaLocker's data-leak site lists a victim named "Licindia," linked to licindia.com, with a categorized repository spanning Financial, HR, Legal, Marketing, Reports and Clients data offered for $50,000. Here's what the leak site actually shows, what it doesn't prove, and what to do next.
Real AI SOC deployment still sits at just 1-5% of organizations, yet fewer than half of CISOs can honestly say they know what their own AI agents are doing. A practical governance, readiness, and vendor-evaluation guide for moving from pilot to production without creating a new problem in the process.
TripleX claims roughly 1TB of Bank of Baroda customer and operational data — and unlike most underground claims, the bank has publicly confirmed a security incident. Here's what's confirmed, what's still alleged, and what to do next.
A threat actor claims to be selling 569GB of RapidFort data — 140,061 files from 48 S3 buckets — tied to the CanisterWorm/TeamPCP supply-chain campaign, including cloud credentials, Kubernetes configs, and vulnerability-database internals.
The extortion group Kazu claims to hold 413GB of PappyJoe healthcare-management data, including 6.8M+ patient records. Here's the forum evidence, the Kazu group's activity timeline, and what it means for healthcare platforms.
A threat actor claims to be selling 35GB+ of Accenture source code, RSA keys, SSH keys, Azure PATs, and Azure Storage access keys. Here's what the forum evidence shows and what it means for third-party risk.