We combine Threat Intelligence, Offensive Security, and Automation to stay ahead of modern cyber threats.
World Wide
Joined January 2024
- Tweets5
- Following2
- Followers95
- Likes1
Meet Shadow Ledger: The Group Hijacking Official Authority to Target Brazil’s Financial Sector
A group that does not hesitate to compromise government organizations and turn their trusted infrastructure against the financial sector, exploiting the credibility that only an official government sender can carry.
Shadow Ledger is a cybercrime group whose activity has been observed in Brazil since September 2025. Its operations primarily target the financial sector, including payment institutions and fintech companies. At the same time, government organizations play a dual role in its campaigns: they are both targets of compromise and trusted infrastructure leveraged to deliver attacks against financial institutions.
We estimate that Shadow Ledger is responsible for more than 100 million in stolen funds since the group first emerged.
blog.quimerax.com/meet-shado…
The investigation enabled us to map BTMOB RAT operations in Brazil, identifying key elements of its distribution methods, supporting infrastructure, and observed TTPs.
blog.quimerax.com/btmob-expo…
QuimeraX Intelligence retweeted
Over 68,000 Exposed Firewalls.
The @quimerax_intel analyzed the FortiBleed dataset and cross-referenced it with the historical Belsen Group leak associated with the exploitation of CVE-2022-40684 in Fortinet devices.
By consolidating both datasets, we were able to identify not only devices exposed in the recent FortiBleed campaign, but also firewalls that have remained exposed across multiple years.
Our findings revealed:
• 68,732 unique IP addresses in the FortiBleed dataset (2026)
• 15,469 unique IP addresses in the Belsen Group leak (2022)
• 83,676 unique IP addresses in the combined dataset
• 525 IP addresses appearing in both leaks
These 525 devices represent the highest-risk category.
They were compromised during the 2022 campaign and still appeared in exposure data collected in 2026, suggesting a potential multi-year exposure window.
We also identified more than 350 (+600creds) Brazilian organizations appearing in the analyzed data.
To help organizations assess their exposure, QuimeraX provides a free lookup tool that allows security and infrastructure teams to search by both public firewall IP address and domain.
Check whether your organization has been affected:
tools.quimerax.com/fortiblee…
QuimeraX Intelligence retweeted
We have just shared the exploit code for the IngressNightmare vulnerability (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) at the Github: github.com/hakaioffsec/Ingre…
QuimeraX Intelligence retweeted
Our team has just successfully reproduced the IngressNightmare vulnerability (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) and created a custom exploit achieving RCE.
It's a Pre-Auth RCE affecting Ingress NGINX that allows complete cluster takeover. We'll share our exploit soon.
In the original post from the Wiz team, they didn't mention the path traversal technique used to load a malicious library via /proc.
@HakaiOffsec @quimerax_asm