🇲🇽 🚨 MEXICO: QILIN RANSOMWARE CLAIMS ATTACK ON EYE-CARE NETWORK SALAUNO The Qilin ransomware group has added salauno, a Mexican eye-care provider that runs a network of ophthalmology clinics, to its data-leak site. The listing gives no description of the data allegedly stolen and no sample details. The claim has not been independently verified, and salauno has not publicly confirmed an incident. ⚠️ Analyst Note: Ophthalmology clinics hold patient medical records, diagnoses, surgical histories and payment data, so a real breach would put sensitive health information at risk. Qilin has repeatedly hit healthcare providers, and some attacks have disrupted patient services. Patients should watch for phishing or fraud that cites their appointments. We assess this as an unverified ransomware claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Mexico #Qilin #Ransomware #Healthcare #Ophthalmology #PatientData #ThreatIntelligence #CyberSecurity

¡YA LLEGÓ EL MATADOR! 🇲🇽👹

#Ransomware El grupo #Qilin cumplió su amenaza contra @MCMTelecom y ha liberado más de 115 GB de datos El listado de archivos incluye carpetas con nombres de clientes como Walmart, OXX, CFE, Liverpool, y dependencias: SAT, INE e INFONAVIT. #Ciberseguridad #México

⚠️ 🇲🇽 🏛️ PREVENTIVE ALERT: ALLEGED LEAK AND EXPOSURE OF DOCUMENTS FROM THE ATTORNEY GENERAL'S OFFICE (FGR) AND INACIPE (ACTOR: CUTZINGER AND SOULHEMTEAM) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: CUTZINGER AND SOULHEMTEAM / DATE: OCTOBER 2026] The centralized cyber-intelligence system has detected a new post on underground forums by user "cutzinger," in collaboration with "Gara157SP" and the group "SoulhemTeam" . The report announces the exfiltration and disclosure of institutional information and service protocols belonging to Mexico's Attorney General's Office (FGR) and the National Institute of Penal Sciences (INACIPE). It is strictly noted that the veracity of this compromise and the full scope of the affected infrastructure have not been officially confirmed by Mexican government authorities. The definitive status of the infrastructure remains unconfirmed. Threat Actors: cutzinger, Gara157SP, and the SoulhemTeam group. Victim / Affected Entity: Attorney General's Office (FGR) and National Institute of Penal Sciences (INACIPE) in Mexico. Sector: 🏛️ Government, Law Enforcement/Justice, National Security, and Legal Education in Mexico 🇲🇽. Nature of the Sample: Structured documentation in JSON format regarding regulatory protocols, services for crime victims, manuals, and legal operational guidelines. 🛡️ TECHNICAL PREVENTIVE CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / GOVERNMENT) Document Management Server Audit: FGR and INACIPE technology teams must immediately review access permissions for their internal documentation platforms and web portals to rule out active perimeter breaches. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Cybersecurity #ThreatIntel #Mexico #FGR #INACIPE #DataLeak #SoulhemTeam #Cutzinger #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert

🇲🇽 🚨 MEXICO: SINALOA STATE GOVERNMENT DATABASE (~1M CITIZEN RECORDS) ALLEGEDLY LEAKED A threat actor group on an underground forum claims to have published a database of about 1 million records allegedly taken from the official website of the Government of Sinaloa, Mexico (sinaloa[.]gob[.]mx). The actors claim the dataset includes: * Full names * CURP numbers (Mexico's unique population registry ID) * Home and apartment address details * Municipality, province and internal administrative codes The claim has not been independently verified. ⚠️ Analyst Note: If authentic, names, CURP and home addresses together would enable identity theft, impersonation of government services and targeted phishing against Sinaloa residents. The same group claimed a Durango state government database earlier today, which points to a pattern of attacks on Mexican state portals. Treat this as an unverified claim, not confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Mexico #Sinaloa #Government #DataBreach #DataLeak #PII #ThreatIntelligence #CyberSecurity

🚨| FILTRAN REGISTRO DE DETENIDOS DE LA POLICÍA DE TIJUANA: INCLUYENDO MENORES DE EDAD Un grupo de ciberdelincuentes filtró una base con las detenciones de la SSPC de Tijuana de marzo de 2024 y actualizada hasta hoy, 12 de octubre de 2026. Trae nombre completo, fecha de nacimiento, apodo y delito de cada persona. Según su último registro, se extrajo ESTA MISMA MADRUGADA. Es una filtración sensible, pues expone a 558 ADOLESCENTES, 41 de ellos de 14 años o menos, con nombre y fecha de nacimiento. Son personas detenidas, NO SENTENCIADAS, cuya identidad la ley protege de forma especial. También quedan expuestos 2,730 nombres de fiscales, agentes del Ministerio Público y policías investigadores, ligados a casos de narcomenudeo, armas y aprehensiones. En Tijuana, eso es ponerles un blanco encima. El patrón de los archivos apunta a descargas con un usuario válido del sistema municipal, no a un hackeo externo. Falta confirmar si fue alguien de dentro o una cuenta robada.

⚠️ 🇲🇽 ⚽ PREVENTIVE ALERT: ALLEGED DATA EXFILTRATION FROM THE LIGA MX / FMF INTERNAL SYSTEM (SIID) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: STNXZ / DATE: OCTOBER 2026] The centralized cyber-intelligence system has detected a post on underground forums by a user identified as "stnxz." The report claims the complete exfiltration of data from the Liga MX / FMF internal system (SIID), compromising production databases, access credentials, player salary records, confidential medical files, and official documentation. Please be advised that the veracity of this breach and the overall authenticity of the exposed data have not been officially confirmed by the Mexican Football Federation (FMF) or Liga MX. The definitive status of the infrastructure remains unconfirmed. Threat Actor: stnxz Victim / Affected Entity: Liga MX / Mexican Football Federation (FMF) — Internal System (SIID). Sector: ⚽ Professional Sports, Football (Soccer), Sports Administration, and Professional Leagues in Mexico 🇲🇽. 🔍 TECHNICAL BREAKDOWN OF THE DATA According to the detailed description provided on the underground forum, the volume of data allegedly exfiltrated includes: User Accounts and Credentials: 12,679 user accounts (out of a total of 13,171 registered), including passwords in clear text, covering portals for Liga MX, the FMF, sports clubs, Major League Soccer (MLS), and the federation. Salary and Contractual Records: 334 salary records for players belonging to Liga MX and the Liga de Expansión BBVA, including contract identifiers, monthly amounts in Mexican pesos (MXN), and scheduled payment numbers. Player Medical and Personal Files: 336 files on football players containing highly sensitive data: CURP (Unique Population Registry Code), RFC (Tax ID), and detailed medical information (blood type, Rh factor, allergies, height, and weight). Official Identification and Documentation: 799 official "Fan ID" documents in PDF format. 4,193 internal files consisting of SQL queries from across the platform. Credentials and Critical Infrastructure: 5 connection strings for production databases (LIGAMX\PRIMARYDB, FMF\DBFMF, Amateur\SAF). Production SMTP credentials. The JWT signing key and the password encryption passphrase. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / LIGA MX) Immediate Rotation of Secrets and Keys Cryptographic Measures: The technology teams at the FMF and Liga MX must immediately revoke and rotate all database credentials, SMTP keys, JWT signing keys, and access credentials for the 13,000 registered users. Forensic Audit of Perimeters and Databases: Temporarily isolate the environments exposed within the connection strings (PRIMARYDB, DBFMF, SAF), review access logs to identify the initial intrusion vector, and audit the security of both institutional and club-level platforms. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly verify your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Cybersecurity #ThreatIntel #Mexico #LigaMX #FMF #FootballSecurity #DataLeak #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert

⚠️ 🇲🇽 🛡️ PREVENTIVE ALERT: ALLEGED IDOR VULNERABILITY AND EXFILTRATION OF 12.7 MILLION QUOTES AT AHORRA SEGUROS (ACTOR: UMBRA / BELIAL01BIT) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: UMBRA / BELIAL01BIT / DATE: OCTOBER 14, 2026] The centralized cyber-intelligence system has intercepted a technical disclosure and hacking report circulated by the actor Umbra (attributed to Belial01bit) on clandestine messaging channels. The alleged incident details the exploitation of a critical IDOR/BOLA (Insecure Direct Object Reference / Broken Object Level Authorization) vulnerability on the Mexican platform Ahorra Seguros, reportedly affecting over 12.7 million historical quotes and catalogs from leading insurers such as Quálitas, GNP, and Banorte. It is strictly noted that the veracity of this compromise and the overall operational impact have not been officially confirmed by the company or the insurers involved. The definitive status of the infrastructure remains unconfirmed. Threat Actor: Umbra / Belial01bit. Victim / Affected Entity: Ahorra Seguros policy comparison and purchasing platform Sector: 🛡️ InsurTech, Automotive Insurance, and Financial E-commerce in Mexico 🇲🇽. Reported Data Volume: Over 12.7 million quotes collected from 2020 through October 2026, including personally identifiable information (PII), vehicle details, and payment records. 🔍 TECHNICAL DETAILS OF THE VULNERABILITY EXPLAINED BY THE ACTOR According to the technical report and the extraction script (Ahoorra_seguros.py) shared by the attacker, the vulnerability stems from critical access control and authentication flaws within the platform's APIs: Inverted Authentication Model (Anonymous Visitor Token): Any anonymous internet user can obtain a JWT access token valid for 24 hours by sending a POST request containing a static constant (secret) extracted directly from the purchasing website's public JavaScript code. Consecutive, Unsigned Identifiers (IDOR / BOLA): Query links utilize a numeric request identifier (`idSolicitud`)—a strict consecutive counter (ranging from 1 to 12.7 million) encoded in Base64—without any HMAC signature or symmetric encryption. By accessing the API endpoint, an attacker can indiscriminately query any individual's records without validating resource ownership. Local Decryption of Sensitive Data (AES-256-CBC): The system stores supplementary issuance information in encrypted blobs. However, the cryptographic key and initialization vector (IV) are hardcoded in plain text within the frontend JavaScript files, allowing for the immediate, unmasked decryption of payment data, card details, tax IDs (RFC), national ID numbers (CURP), and issued policies. 🛡️ TECHNICAL PREVENTIVE CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / DEVELOPMENT) Immediate Implementation of Authorization Controls (BOLA/IDOR Defense): Modify API endpoints to rigorously verify that the authenticated user is the legitimate owner of the quote or request being queried. Removal of Secrets and Cryptographic Keys from the Frontend: Remove static global authentication tokens and symmetric encryption keys (AES) from public JavaScript packages, moving decryption and validation logic exclusively to the server. Replacement of Sequential Identifiers: Replace simple numerical counters with random unique identifiers (UUIDv4) or cryptographically signed hashes to prevent mass enumeration. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Cybersecurity #ThreatIntel #Mexico #AhorraSeguros #IDOR #DataLeak #Umbra #Belial01bit #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert