@threatcluster

Threat intelligence as data: a REST API, free IOC and MISP feeds and an MCP server. Over 20,000+ sources and ransomware leak sites.

 Covent Garden, London
threatcluster.io
Joined July 2025
  • Tweets5.7K
  • Following635
  • Followers622
1.5KMedia
Microsoft Windows estates face LATRODECTUS as an IcedID replacement loader linked by Elastic and Malpedia to LUNAR SPIDER. - MITRE tracks LATRODECTUS as a Windows downloader active since 2023 via email campaigns. - ThreatFox radar holds 12 Latrodectus entries through 21 October 2026.
1
56
Full cluster + IOCs → threatcluster.io/cluster/lat…

Latrodectus Malware: New Windows Loader Threat Discovered - ThreatCluster

Latrodectus, also known as BlackWidow and IceNova, is a Windows malware loader identified in October 2023. It acts as a backdoor, enabling attackers to download and execute additional malicious...

threatcluster.io
13
33 new leak-site listings overnight, krybit busiest with 6. 9 new validated IOCs. Critical Path Traversal Vulnerability in Postiz Exposes Server Files Critical Vulnerabilities in Kiloview E3 NDI Encoder Exposed Ransomware Attack Disrupts TG-iPASS Portal in Telangana
1
88
Every story, the leak-site list and who is moving, in today's edition. threatcluster.io/digest/arch…

Critical Path Traversal Vulnerability in Postiz Exposes Server Files (+5 more)

A critical vulnerability, CVE-2026-115932, has been identified in Postiz, allowing unauthenticated users to exploit path traversal flaws. This…

threatcluster.io
12
Aurora claims 8 GB from ARX Group SA, 7 files, other, CH. 44 victims were listed on leak sites in 24 hours. Qilin was the most active with 6. threatcluster.io/dark-web?ut…
1
65
Qilin claims 6 victims including Tamponnt, FR, and Commonwealth Community Bank, US financial services. The group named three others in Europe and one US government entity.
1
18
N0N claims 6 victims including Texcar Inc., 4 GB, manufacturing, and two healthcare providers in the US and Argentina. The group targets various sectors with multiple data sizes.
10
46 new leak-site listings overnight, qilin busiest with 12. 70 new validated IOCs. Top of today's digest. Initia Chain Exploit Results in $2.6 Million Theft Pakistan Targeted by Israeli Spyware Ad Campaign Loblaw Data Breach Affects 2 Million Shoppers
1
103
Every story, the leak-site list and who is moving, in today's edition. threatcluster.io/digest/arch…

Initia Chain Exploit Results in $2.6 Million Theft (+2 more)

On October 23, 2026, an unauthorized actor exploited a vulnerability on Initia Chain, allowing them to mint tokens without authorization. This…

threatcluster.io
19
Public exploit for GitLab CVE-2026-110264 dropped on 23 October, the same day Ruby shipped Regexp fixes in three releases. threatcluster.io/cluster/reg…
1
1
7
334
PHP2Shell went from an anonymous Hacker News post to government websites going offline across Europe within a day. The post was on the feed 20 minutes after it went up. The incident page was live 9 minutes before BleepingComputer’s first article and more than 15 hours before the BBC’s. The CVE pages were up more than 18 hours before NVD published. By Thursday morning the story had 942 articles from 338 independent publishers. This blog post covers the full timeline of events, and where the alerts and indicators went. blog.threatcluster.io/php2sh…
62
Group-IB and NyxLab tie actor k0t to theft of 70,000+ credentials from Fortinet and Palo Alto edge devices worldwide IOCs (6): mesh[.]buttruyen[.]com agent[.]afahimsa[.]top alknene[.]shop meshcentral[.]girydsfsggvb[.]com +2 more Full set: threatcluster.io/cluster/hac…

Hackers Exploit Firewalls, Compromise 70,000 Credentials Globally - ThreatCluster

A large-scale cyber campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the compromise of over 70,000...

threatcluster.io
1
83
Ransomware leak sites added 33 victims in 24h, slightly below the 37 daily baseline, as Fulcrumsec listed EMARKETER with 16.19 TB of data. threatcluster.io/dark-web?ut…
89
Amazon logged PHP2Shell exploit traffic to MadPot on 17 Oct, four days before CVE-2026-109618/109619 disclosure. IOCs (4): 4d02f14d109458cb0d696b65456918fcd724ca385aa30c688f08554c8899938c 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b +2 more Full set: threatcluster.io/cluster/cri…

Critical PHP Vulnerabilities Exploited Before Public Disclosure - ThreatCluster

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that...

threatcluster.io
129
25 new leak-site listings overnight, n0n busiest with 7. Critical PHP Vulnerabilities Trigger Global Cybersecurity Alert Global PHP Vulnerability Sparks Urgent Patch Efforts Amid Exploitation Attempts Critical PHP Vulnerabilities Prompt Urgent Security Updates
1
78
Every story, the leak-site list and who is moving, in today's edition. threatcluster.io/digest/arch…

Critical PHP Vulnerabilities Trigger Global Cybersecurity Alert (+7 more)

On October 21, 2026, critical vulnerabilities in PHP, a programming language powering 70% of websites, were disclosed, prompting a worldwide rush to patch…

threatcluster.io
14
Prince of Persia APT shifted Tornado C2 to US-based Namecheap shared hosting, hiding among thousands of legitimate domains. IOCs (6): noonrpxv[.]privatedns[.]org uiavuflyjqodj[.]hbmc[.]net tegfxbnk[.]site vtykvjbmhkpah[.]hbmc[.]net +2 more Full set: threatcluster.io/cluster/ira…

Iranian Nation-State Group Hosts C2 Infrastructure in the US - ThreatCluster

Semperis has identified the Iranian nation-state threat group known as Prince of Persia operating a command-and-control (C2) server in the United States for the first time in a decade. This discovery...

threatcluster.io
1
259
BlackX UEFI bootkit used in APT attacks on diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. IOCs (6): www[.]archivetj[.]com DAE7E7C4EEC2AC0DC7963C44A5A4F47D930C5508 D82539BFC2CC7CB504BE74AC74DF696B13DB486A +3 more Full set: threatcluster.io/cluster/new…

New BlackX UEFI Bootkit Targets Central Asian Diplomatic Agencies - ThreatCluster

In early 2026, a new UEFI bootkit named BlackX was discovered targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. This bootkit exploits the Baton Drop vulnerability to install...

threatcluster.io
4
202
Ransomware leak sites list 39 new victims, slightly above the 7-day average. Braincipher posts mvjllp.com with a 1.66 TB data claim on countdown. threatcluster.io/dark-web?ut…
39
Fortinet rates PHP2Shell CVE-2026-109618 as CVSS 9.8, but VulnCheck says most public exploits only crash PHP or leak data. - Fortinet PSIRT lists the bug as critical and not known to be exploited. - VulnCheck reports only a few working RCE PoCs among dozens on GitHub.
1
1
296
Full cluster → threatcluster.io/cluster/php…

PHP2Shell Vulnerabilities Impact Fortinet, Cisco, and Palo Alto Networks - ThreatCluster

Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow remote code execution on web servers....

threatcluster.io
135
Load more