Cyber Threat Intelligence Daily

21 Nov 2024

🌐 Welcome to Cyber Threat Intelligence Daily! Your daily source for curated insights, breaking news, and actionable tips in the world of CTI. 🛡️ Stay ahead of threats, learn TTPs, and boost your defenses. 🚀 Follow us for expert updates! 💻 #CTI #CyberSecurity #ThreatIntel #Infosec

cyberthreatintelligence.netEcho.com — Ransomware Attack by WhitearmorBased in Germany. Technology sector. Disclosed 28 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Echo.com — listed by Whitearmor 📍 Germany · Technology · 28 Oct 2026 🏴 Whitearmor has listed 2 victims since October 2026. https://cyberthreatintelligence.net/ransomware-victim/echo-com-whitearmor-2026 #ransomware #whitearmor #threatintel

cyberthreatintelligence.netRyder — Ransomware Attack by WhitearmorBased in United States. Transportation sector. Disclosed 28 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Ryder — listed by Whitearmor 📍 United States · Transportation · 28 Oct 2026 🏴 Whitearmor has listed 2 victims since October 2026. https://cyberthreatintelligence.net/ransomware-victim/ryder-whitearmor-2026 #ransomware #whitearmor #threatintel

cyberthreatintelligence.netwagyu.xyz unfairness — Ransomware Attack by WhitearmorOther sector. Disclosed 28 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 wagyu.xyz unfairness — listed by Whitearmor 📍 Other · 28 Oct 2026 🏴 Whitearmor has listed 2 victims since October 2026. https://cyberthreatintelligence.net/ransomware-victim/wagyu-xyz-unfairness-whitearmor-2026 #ransomware #whitearmor #threatintel

cyberthreatintelligence.nethttps://t.me/whitearmorxd — Ransomware Attack by WhitearmorDisclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 https://t.me/whitearmorxd — listed by Whitearmor 📍 27 Oct 2026 🏴 Whitearmor has listed 2 victims since October 2026. https://cyberthreatintelligence.net/ransomware-victim/https-t-me-whitearmorxd-whitearmor-2026 #ransomware #whitearmor #threatintel

cyberthreatintelligence.netMachelen (Belgium) — Ransomware Attack by RhysidaBased in Belgium. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Machelen (Belgium) — listed by Rhysida 📍 Belgium · 27 Oct 2026 🏴 Rhysida has listed 295 victims since June 2023. https://cyberthreatintelligence.net/ransomware-victim/machelen-belgium-rhysida-2026 #ransomware #rhysida #threatintel

🏴 Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.

🧭 How Rhysida is documented to operate · Abusing Elevation Control Mechanism: Bypass User Account Control · Phishing · Command and Scripting Interpreter · Shared Modules MITRE ATT&CK techniques attributed to Rhysida overall — not a finding about how this organisation was reached.

cyberthreatintelligence.netTWICE SRL — Ransomware Attack by EmperadorDisclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 TWICE SRL — listed by Emperador 📍 27 Oct 2026 🏴 Emperador has listed 38 victims since August 2026. https://cyberthreatintelligence.net/ransomware-victim/twice-srl-emperador-2026 #ransomware #emperador #threatintel

cyberthreatintelligence.netCoast 2 Coast — Ransomware Attack by PlayBased in United States. Retail & E-Commerce sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Coast 2 Coast — listed by Play 📍 United States · Retail & E-Commerce · 27 Oct 2026 🏴 Play has listed 1,324 victims since November 2022. https://cyberthreatintelligence.net/ransomware-victim/coast-2-coast-play-2026 #ransomware #play #threatintel

🏴 Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America.

🧭 How Play is documented to operate · Valid Accounts · Valid Accounts: Domain Accounts · Valid Accounts: Local Accounts · External Remote Services MITRE ATT&CK techniques attributed to Play overall — not a finding about how this organisation was reached.

cyberthreatintelligence.netTailormade Logistics — Ransomware Attack by PlayBased in Denmark. Transportation sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Tailormade Logistics — listed by Play 📍 Denmark · Transportation · 27 Oct 2026 🏴 Play has listed 1,324 victims since November 2022. https://cyberthreatintelligence.net/ransomware-victim/tailormade-logistics-play-2026 #ransomware #play #threatintel

🏴 Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America.

cyberthreatintelligence.netUPDATE: UNM — Ransomware Attack by ByodEducation sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 UPDATE: UNM — listed by Byod 📍 Education · 27 Oct 2026 🏴 Byod has listed 3 victims since September 2026. https://cyberthreatintelligence.net/ransomware-victim/update-unm-byod-2026 #ransomware #byod #threatintel

cyberthreatintelligence.netVPC Builders — Ransomware Attack by PlayBased in United States. Professional Services sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 VPC Builders — listed by Play 📍 United States · Professional Services · 27 Oct 2026 🏴 Play has listed 1,324 victims since November 2022. https://cyberthreatintelligence.net/ransomware-victim/vpc-builders-play-2026 #ransomware #play #threatintel

🏴 Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America.

cyberthreatintelligence.netHygiena — Ransomware Attack by PlayBased in United States. Healthcare sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Hygiena — listed by Play 📍 United States · Healthcare · 27 Oct 2026 🏴 Play has listed 1,324 victims since November 2022. https://cyberthreatintelligence.net/ransomware-victim/hygiena-play-2026 #ransomware #play #threatintel

🏴 Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America.

cyberthreatintelligence.netMicroSearch — Ransomware Attack by PlayTechnology sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 MicroSearch — listed by Play 📍 Technology · 27 Oct 2026 🏴 Play has listed 1,324 victims since November 2022. https://cyberthreatintelligence.net/ransomware-victim/microsearch-play-2026 #ransomware #play #threatintel

🏴 Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America.

cyberthreatintelligence.netMoney Concepts Capital — Ransomware Attack by PlayBased in United States. Financial Services sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Money Concepts Capital — listed by Play 📍 United States · Financial Services · 27 Oct 2026 🏴 Play has listed 1,324 victims since November 2022. https://cyberthreatintelligence.net/ransomware-victim/money-concepts-capital-play-2026 #ransomware #play #threatintel

🏴 Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America.

cyberthreatintelligence.netQLC — Ransomware Attack by PlayBased in United States. Technology sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 QLC — listed by Play 📍 United States · Technology · 27 Oct 2026 🏴 Play has listed 1,324 victims since November 2022. https://cyberthreatintelligence.net/ransomware-victim/qlc-play-2026 #ransomware #play #threatintel

🏴 Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America.

cyberthreatintelligence.netwagyu.xyz — Ransomware Attack by WhitearmorRetail & E-Commerce sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

14h

🔴 wagyu.xyz — listed by Whitearmor 📍 Retail & E-Commerce · 27 Oct 2026 🏴 Whitearmor has listed 2 victims since October 2026. https://cyberthreatintelligence.net/ransomware-victim/wagyu-xyz-whitearmor-2026 #ransomware #whitearmor #threatintel

cyberthreatintelligence.netBASS Medical Group — Ransomware Attack by Booba projectBased in United States. Healthcare sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 BASS Medical Group — listed by Booba project 📍 United States · Healthcare · 27 Oct 2026 🏴 Booba project has listed 31 victims since June 2026. https://cyberthreatintelligence.net/ransomware-victim/bass-medical-group-booba%20project-2026 #ransomware #boobaproject #threatintel

🏴 Booba.

cyberthreatintelligence.netGRUPO PETROIL — Ransomware Attack by DirewolfBased in Mexico. Energy & Utilities sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 GRUPO PETROIL — listed by Direwolf 📍 Mexico · Energy & Utilities · 27 Oct 2026 🏴 Direwolf has listed 136 victims since April 2025. https://cyberthreatintelligence.net/ransomware-victim/grupo-petroil-direwolf-2026 #ransomware #direwolf #threatintel

🏴 Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather…

cyberthreatintelligence.netHorizon Eye Specialists & LASIK Center — Ransomware Attack by Booba projectBased in United States. Healthcare sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Horizon Eye Specialists & LASIK Center — listed by Booba project 📍 United States · Healthcare · 27 Oct 2026 🏴 Booba project has listed 31 victims since June 2026. #ransomware #boobaproject #threatintel

🏴 Booba.

cyberthreatintelligence.netHudson River Museum — Ransomware Attack by Booba projectBased in United States. Education sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Hudson River Museum — listed by Booba project 📍 United States · Education · 27 Oct 2026 🏴 Booba project has listed 31 victims since June 2026. https://cyberthreatintelligence.net/ransomware-victim/hudson-river-museum-booba%20project-2026 #ransomware #boobaproject #threatintel

🏴 Booba.

cyberthreatintelligence.netKerckstede vzw — Ransomware Attack by Booba projectBased in Belgium. Other sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Kerckstede vzw — listed by Booba project 📍 Belgium · Other · 27 Oct 2026 🏴 Booba project has listed 31 victims since June 2026. https://cyberthreatintelligence.net/ransomware-victim/kerckstede-vzw-booba%20project-2026 #ransomware #boobaproject #threatintel

🏴 Booba.

cyberthreatintelligence.netRCOA- Regent Christian Online Academy — Ransomware Attack by Booba projectBased in Canada. Education sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 RCOA- Regent Christian Online Academy — listed by Booba project 📍 Canada · Education · 27 Oct 2026 🏴 Booba project has listed 31 victims since June 2026. #ransomware #boobaproject #threatintel

🏴 Booba.

cyberthreatintelligence.netAesthetic Specialty Centre — Ransomware Attack by Booba projectBased in Pakistan. Healthcare sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Aesthetic Specialty Centre — listed by Booba project 📍 Pakistan · Healthcare · 27 Oct 2026 🏴 Booba project has listed 31 victims since June 2026. https://cyberthreatintelligence.net/ransomware-victim/aesthetic-specialty-centre-booba%20project-2026 #ransomware #boobaproject #threatintel

🏴 Booba.

cyberthreatintelligence.netBristol City Council — Ransomware Attack by WallstreetBased in United Kingdom. Government & Defense sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Bristol City Council — listed by Wallstreet 📍 United Kingdom · Government & Defense · 27 Oct 2026 🏴 Wallstreet has listed 28 victims since June 2026. https://cyberthreatintelligence.net/ransomware-victim/bristol-city-council-wallstreet-2026 #ransomware #wallstreet #threatintel

🏢 Bristol City Council is the local authority for Bristol, England. It provides public services for residents, businesses, and visitors, including council tax and benefits, housing, schools, social care, waste and recycling, transport, planning, parks, and libraries.

cyberthreatintelligence.netCharter Township of Commerce — Ransomware Attack by Booba projectBased in United States. Government & Defense sector. Disclosed 27 Oct 2026. Incident profile, threat group background and sector analysis.

🔴 Charter Township of Commerce — listed by Booba project 📍 United States · Government & Defense · 27 Oct 2026 🏴 Booba project has listed 31 victims since June 2026. #ransomware #boobaproject #threatintel