Rowan Grey retweeted
a threat actor named RustScout is seeking affiliates for their new ransomware as a service (Raas) offerings where they offer a 60/40 split.
Rowan Grey retweeted
El directorio definitivo de foros de hackers y ciberdelincuencia para analistas de Threat Intelligence.
Cero teoría, pura estructura de inteligencia de amenazas aplicada.
Repositorio open-source en el primer comentario
Rowan Grey retweeted
Mission: Bypass 2FA!
Master Evilginx for man-in-the-middle phishing that captures credentials AND session cookies.
hackers-arise.com/cyberwar-m…
Rowan Grey retweeted
216[.]126[.]236[.]46: #OpenDirectory hosting a full #offensive toolkit. IoT #botnets (#Mozi/#Boatnet) + targeted attacks on a #Brazilian SaaS. #GodPotato for #privesc, #Ghostcat for file reads, #trojanized APK, cookie #stealer
Found via @Huntio
Read full thread below:
Rowan Grey retweeted
INTEL DROP
Gshell command-and-control cluster likely targeting Pakistani based orgs. Gshell is a China-aligned C2 framework observed being used against government and financial organizations.
103.112.97.64
103.112.97.163
103.112.97.199
134.122.204.46
134.122.204.86
134.122.204.106
207.56.28.60
207.56.28.82
The hosts group tightly into three back-to-back blocks:
103.112.97.0/24, 3 hosts
134.122.204.0/24, 3 hosts
207.56.28.0/24, 2 hosts
One block runs more than Gshell. 134.122.204.0/24 also hosts CobaltStrike, Plugx, Supershell.
credit Gshell discovery @huntio
#TotalInsights #ThreatIntel #gshell
team-cymru.com/total-insight…
🤖 Made with AI
Rowan Grey retweeted
🚨 New Cybercrime Platform Alert: MessiahGPT
A newly commercialized criminal AI-as-a-Service platform called MessiahGPT is being promoted to cybercriminals as an unrestricted AI environment for offensive cyber operations.
* MessiahGPT has been advertised on BreachForums
* Trellix Advanced Research Center publicly documented the platform in August 2026
* The service is marketed with capabilities related to malware development, ransomware, phishing kits, information stealers, social engineering, crypters, rootkits and exploitation support
* Operators advertise a free trial alongside paid subscription tiers
* Cryptocurrency payments are supported
* The platform also appears to maintain an associated Telegram community for promotion, updates and user interaction
* MessiahGPT is presented as operating without conventional AI safety restrictions, although claims regarding its underlying model architecture and technical performance remain partly unverified
⚠️ Analyst Note:
The important development is not simply the existence of another “uncensored AI.”
MessiahGPT represents the continued commercialization of AI-enabled cybercrime, where offensive capabilities are being packaged into accessible services that can reduce the technical barrier for less experienced threat actors.
This could accelerate phishing development, malware experimentation, social engineering and other cybercrime workflows at scale.
Organizations should monitor not only for AI-generated content, but also for the broader ecosystem of criminal platforms turning AI capabilities into subscription-based services.
Primary Source:
trellix.com/blogs/research/w…
#DDW #MessiahGPT #CyberCrime #ArtificialIntelligence #DarkWeb #ThreatIntelligence #CyberSecurity
Rowan Grey retweeted
Need Sources!
Looking for sources with insight into the initial-access market: how corporate access is sold, what buyers are looking for, and how access sales translate into ransomware attacks.
Confidentiality respected.
Rowan Grey retweeted
⚡️ #Ransomware’s New Dirty Trick: Fake Recovery Firms Are Now Targeting Victims Before the Crisis Is Even Over + Video
-Fact Checker: ✅: 1 ❌: 0 || 1/1 → Score: 100% 🦾
-Prediction: 📈 1 Positive | 📉 1 Negative
undercodenews.com/ransomware…
Rowan Grey retweeted
ATTENTION
Looking to speak w/ anyone who has information on ransomware/extortion actors who didn't honor their promises after receiving payment.
Leaked data anyway, retained access, or demanded more money. Victims, negotiators & researchers welcome. Confidentiality respected.
Rowan Grey retweeted
Huntress researcher James Northey shows how an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR. In this incident, Safe Mode also broke the ransomware, but the attacker managed to exfiltrate credentials and file shares. huntress.com/blog/akira-hits…
Rowan Grey retweeted
🛡️ Palo Alto Networks Patches 11 New Vulnerabilities Across PAN-OS, GlobalProtect, & Prisma Access
Source: cybersecuritynews.com/palo-a…
Palo Alto Networks has released its August 12, 2026 security bulletin, disclosing 11 new vulnerabilities affecting PAN-OS, the GlobalProtect App, Prisma Access Agent, and Prisma Browser, along with a monthly Chromium update rollup.
The patch batch spans information disclosure, local privilege escalation, buffer overflow, certificate validation bypass, and anti-tamper bypass flaws.
The most notable infrastructure entry is CVE-2026-0301, an information disclosure vulnerability in PAN-OS URL Filtering.
It impacts Cloud NGFW and multiple PAN-OS release branches, including 12.1, 11.2, 11.1, and 10.2, as well as Prisma Access deployments hosted on AWS and Azure.
#cybersecuritynews
Rowan Grey retweeted
‼️ WARNING: One Zoom attendee could take over every other attendee's computer.
Three flaws in Zoom's annotation feature could be exploited from inside a meeting, with no click, download, or prompt required from the victim.
Make sure your software is up to date.
Read more: thehackernews.com/2026/08/zo…
Rowan Grey retweeted
SecTor 2026 Briefing:
Ghost in the Hiring Machine: How to Spot Fake Personas Before They're on Your Payroll
Attendees will learn practical OSINT techniques for spotting fake personas and receive a checklist for thorough background checks. They will see these methods applied through two cases based on a true story, illustrating how these personas succeeded, how one could have been prevented, and where OSINT reaches its limits.
Get Your Briefings Pass Today: bit.ly/3UqRRJJ





















