RansoMonitor @RansoMonitor

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'WhiteArmor'. Session: 05e7d90e446b823946dc3dfd8210ce14835cad13b28edadc798b51c186a29f5f7b Email: whitearmorrxd@proton[.]me #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named '0x00'. #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'The Seven Deadly Sins'. #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'SCARLETTGROUP'. Leak site: scarlettgugldabhgz3uertpnxglxytddxbd5vnoma5pihfk6k5q2sid[.]onion More indicators on our LinkedIn page. #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'hyflock'. Leak site: yhgphvfgaecacgtlbn67u7yfhafe6evnj4gs4s2oyb3hzjnlhq45azqd[.]onion Email: hyflocksupport@proton[.]me More indicators on our LinkedIn page. #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'umbra'. Session: 05e968dec429b5136fd94eccbec67ce1c56c7ba10014e35a70cc60dba3d58f2836 Email: umbrasup@proton[.]me #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'BYOD'. Leak site: byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad[.]onion Email: byod@onionmail[.]org More indicators on our LinkedIn page. #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'vladivostok'. Leak site: dr5beljvyqljgq5ppro57pgetg4yeslcsexmuhvv3p46wod3odsh3fid[.]onion #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'imnotavillian'. Leak site: o6rtgcjdjqyimjxexpejddhdfbehsjn4fcsazfkgwydeb27gqhtdntyd[.]onion More indicators on our LinkedIn page. #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'Global Cybernetic Collective'. Leak site: globalco44t2yl6ltgj74cwthr6b6olggl3srg7engqfhx72f6ni3cyd[.]onion More indicators on our LinkedIn page. #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'shiba'. Tox: 6765676AACF97FB4901F73C3290D44C9A7F99C5841A3EF1BF234C15758E975569D02548B1F16 #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'n0n'. Leak site: nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad[.]onion #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'Endzone'. Leak site: endzonezgz3sqzmtqg4acp4z7ao7xc6vunfhezjsnfqrm2ksudsredyd[.]onion Email: endzone4@atomicmail[.]io More indicators on our LinkedIn page. #Ransomware

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'Galago'. Linked to Panzer. Leak site: pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid[.]onion More indicators on our LinkedIn page. #Ransomware

A seller posted a paid 1-day listing overnight offering an unauthenticated remote code execution chain against FortiWeb 8.0.0 through 8.0.1. The pitch is simple: two CVEs, full chain included, management access without credentials. That version range is the same window Fortinet already patched for the November 2025 path-traversal and command-injection pair (CVE-2025-64446 and CVE-2025-58034). Those two bugs, used together, produce unauthenticated root on an exposed appliance. If the management interface is on the internet and the box is still on 8.0.0 or 8.0.1, you are the inventory they are selling access into. Do this in order: 1.) Inventory every FortiWeb. Confirm exact build. Treat 8.0.0–8.0.1 as urgent, and do not assume later 7.x branches are clean without checking the advisory tables. 2.) Upgrade. Fortinet’s fix line for that chain starts at 8.0.2. Apply the current supported build for your branch. 3.) Pull the GUI and API off the public internet. Management belongs on a jump host or VPN, not port 8443 on a WAN address. 4.) Hunt before you declare it done. Look for unexpected local administrators, new API tokens, CLI sessions you cannot explain, and config drift after the fact. An unpatched WAF is not a failed control. It is a foothold with a trusted view of every application behind it. If you need a second set of eyes on exposure, logs, or a post-compromise review, that is the work. Patch first. Then verify nobody already used the listing.

New Ransomware Group: Barricade Cyber Solutions is monitoring a new ransomware group named 'OpnKey'. Email: SevenLockDec@cock[.]li Email: SevenLockDec@morke[.]org Ransom note: #Restore-My-Files.txt Leak threat: 72 hours #Ransomware

New Ransomware Group: @barricadecyber is monitoring a new ransomware group named 'DYSPHOR1A'. So far, the group has listed 5 victims on the disclosure site. DLS: y3maveiwszbnrziufbbberx74cvrdcsf72nxzuqxzv7ppdmmqzffazid[.]onion Clearnet: null[.]yzz[.]me TA BF Profile: breachrkhwgrjq5xasdtybukh7xwfpq3wxopwulk7ghvarig2vkuq4ad[.]onion/User-normalhunters0x TA Operator BF Profile: breachrkhwgrjq5xasdtybukh7xwfpq3wxopwulk7ghvarig2vkuq4ad[.]onion/User-normalhunters0x Telegram Channels: t[.]me/jacudeez t[.]me/normalhuntercrime

New Ransomware Group @barricadecyber is monitoring a new ransomware group named 'iah647'. So far, the group has listed 3 victims on the disclosure site. DLS: iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd[.]onion

New Ransomware Group We have started monitoring a new ransomware group named "xpl0itrs". They have listed 4 victims on the disclose site. DLS: 2kieaq6jnwgrru62wwtxaafg35q6rzweg7y2xjfnbhvq5wd4eojqv6yd[.]onion Tox: FD714A3E7C0059EF70825AF78ED544880DC9990EBF9859B798CC8F2B03 Session: 05c8ae06e40a63cfd94d3307a3461ca668aa88bb18686083d6927e969249501075

New Ransomware Group We have started monitoring a new ransomware group named "MAJINAHANASHI". They have listed 15 victims on the disclosure site. DLS: lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd[.]onion Tox: 59DE03AE55C400954D0973FFB90C251A7FDCEB3079A42DF6A6DB93E7D1915F5C47B238A2A99E Email: [email protected]