Shadowcat Labs

We built a Telegram & darknet monitoring platform. → Vetted cybercrime channels tracked → IOCs extracted automatically → Multi-language, translated to English → Built for investigators, not dashboards Follow for weekly threat intel from real data. darknetmonitor.org

chinese-language ad in a monitored channel for an iOS wallet harvesting platform sold as a managed service. dual path: drive-by web compromise for iOS 13–18 where loading the landing page is enough, plus a fake-app route targeting iOS 18+ that pulls seed phrases directly. ✔️ Claimed capacity for millions of daily visitors on a lock-free architecture, three months in stable operation ✔️ Dual attack path: drive-by web compromise against iOS 13 to 18 where the landing page alone brings a device online, plus a fake-app route for iOS 18 to 27 that harvests seed phrases ✔️ An operator console with device and staff management, staff grouping and production leaderboards ✔️ Real-time dashboard pushing device check-ins, seed phrases captured and balance changes to a Telegram bot #iOS

Breachforums' own database has been breached.

The 1 November claim from Cyber Partisans has progressed. #cpartisans_by is now publishing from the set under the banner "СЕКРЕТНАЯ СТАТИСТИКА РОССТАТА — ГОСТАЙНОЕ СТАНОВИТСЯ ЯВНЫМ", and Rosstat has denied the leak. The Cyber Partisans note in their own post that Roskomnadzor and Aeroflot denied the same way before material was published. #cyberpartisans

DATASUCKERS quit. Two lines in Russian, “Goodbye. There will be no more public activity from us.” That’s the group that spent 9 October defending its dumps against accusations they were AI-generated. An exit right after a credibility fight belongs in the actor profile.

1 Nov: CyberPartisans BY and Silent Crow claimed a destructive compromise of Rosstat, with 23 TB taken and 25,000 devices affected. Rosstat acknowledged attacks on its sites from 29 Oct to 1 Nov and denied any data leak. Its statement confirms the attacks, not the 23 TB.

we saw this in monitored channels on the 29th before lookout published today. blackhatsect0r chat was already circulating details on a telegram android call-based RCE — attacker calls, you answer, that's it. no CVE, no PoC, no vendor disclosure at that point. lookout confirmed it today. fixed in 12.10.4. update your telegram. settings → privacy & security → calls → "my contacts" or "nobody" as a stop-gap. lookout.com/threat-intellige…

Blackhatsect0r claims to have stolen 50,344 contact records and 114,214 PDFs (46.6 GB) from La Mutuelle Communale, a French mutual insurance provider. Cyberattaque.org says it examined samples containing personal, banking and health-related data. full claimed volume not independently verified, no victim statement published yet. cyberattaque.org/cyberattaqu… #ThreatIntel #CTI #France

We read a year of ShinyHunters drama on Telegram so you don’t have to. Rey’s arrested, Rey’s back, the forum’s “fictional,” and the brand is on sale for $3k. 🔗 shadowcatlabs.substack.com/p… #ShinyHunters #BreachForums #ScatteredLAPSUSHunters

RBL LEVIATHAN GHOST and allied groups announced a return to operations against East Asia and Western targets. Account StarPez offered DDoS attack services and proof of capabilities. The channel also shared free database access, including Indonesian DUKCAPIL data and logs with default credentials. Several attacks were claimed against Israeli and other websites. A data leak of PFC India was shared. StarPez and other actors promoted DDoS plans and tools for sale. #DDOS #CTI

card-sale advertisements in monitored channels named banks across 15+ countries this week. pulling out the geography for visibility. US: JPMorgan Chase, BofA, Wells Fargo, Citi, Capital One, PNC, Navy Federal and others. UK: Barclays, HSBC, Lloyds, NatWest, Monzo, Starling and others. Canada: RBC, TD, CIBC, BMO. Australia: Commonwealth, NAB, Westpac, ANZ, St.George, Suncorp, Bendigo & Adelaide, Macquarie, Bank of Queensland, Cuscal, ING, HSBC Ireland: Allied Irish Bank, Bank of Ireland, Avantcard, Revolut Business Germany: Deutsche Bank, Commerz Finanz Denmark: Nordea, Danske Bank France: Natixis Switzerland: Cornèr China: BOCOM, in a mixed card-sale advertisement #ThreatIntel #CTI #fraud

one-click Yahoo account takeover with persistence advertised for $2,750. but someone is selling it with enough confidence to put a price on it and a demo offer. #ThreatIntel #CTI

A new stealer panel called Warlock Portal (also "WarLock Stealer") launched and was promoted near-simultaneously across several telegram channels. Claimed features: 25 grabber modules covering browser data crypto wallets and RDP connections PE and ELF stubs a searchable logs database an OSINT workspace AND HVNC sold in tiers for crypto and gift cards.

Coreveil: a $200 crypter that pivot into a stealer TA started form asking for a broken RAT builds and then launched his own stealer. 👇 full story on our substack shadowcatlabs.substack.com/p… #crypter #stealer

DDoSia Informer pushed another Czech target-list rotation (20 added, 33 removed), this round naming cdcargo.cz (Czech Railways cargo), the public e-procurement portal ezak.cz, goldservice.cz, servant.cz, tor-industries.cz, vanad.cz, and sst.cz. NoName and DDoSia Project kept running anti-Czech propaganda posts, and NoName reposted Russian MoD battlefield-casualty figures. IT ARMY OF RUSSIA re-advertised the closed MARKET.XSSF.NET Ukraine-leak exchange.