Consultores en Seguridad Informática, Hack Security, Instructor LATAM , https://xitter.cf/t.co/Kh5C8Zk0lx , OSINT - Investigacion redes sociales - Socmint !!
Joined August 2011
- Tweets8.4K
- Following1.1K
- Followers4.5K
- Likes2.4K
Hack-Security S.A retweeted
🚨 Ransomware Alert 🚨
The Gentlemen ransomware group has added 38 new victims to their dark web portal.
Hack-Security S.A retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Hack-Security S.A retweeted
🚨Si amigos, tenemos nuevo 0day: curl2shell
🧐Puede comprometer casi cualquier Linux y yo diría muchos Windows también.
Casi el 70% de Internet afectada.
PoC: 𝚌𝚞𝚛𝚕 -𝚜 𝚑𝚝𝚝𝚙://𝚌𝟸 | 𝚜𝚑
🔥 No puede ser parcheada!
Hack-Security S.A retweeted
‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
Details: cybersecuritynews.com/tailsc…
A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups.
They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks.
The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine.
#cybersecuritynews
Readers added context they thought people might want to know
The flaws require an already-approved device in the Tailscale network with SSH rules permitting access/forwarding; they enable post-compromise lateral movement and escalation inside the tailnet, not unauthenticated remote access from outside.
tailworm.com
brandefense.io/security-news/…
tailscale.com/security-bulle…
x.com/mmaunder/statu…
😳🥴🥺🙄
⚠️ 🇪🇨 💻 ALERT/PREVENTIVE NOTICE – ALLEGED WEBSITE DEFACEMENT AND DATA EXPOSURE AT SAP .COM.EC (ACTORS: M0Z1LL4S CREW / H4D3PWN)
[STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: M0Z1LL4S CREW / H4D3PWN / DATE: OCTOBER 2026]
The centralized cyber-intelligence system has intercepted a post on social media and breach-related forums, shared by the account "m0z1ll4s crew." The report claims a compromise of the Ecuadorian domain "sap. com.ec," alleging that all information hosted on the portal has been collected.
It is strictly noted that the veracity of this compromise, the actual impact on the entity's infrastructure, and the overall authenticity of the exposed records have not been officially confirmed by the administrators of the Ecuadorian domain. Given that this information originates from social media posts and underground forums, the definitive status of the infrastructure remains unconfirmed.
Threat Actors: m0z1ll4s crew and h4d3pwn
Sector: 💻 Technology, Corporate Services, Business Consulting, and Web Infrastructure.
Nature of the Incident: Website defacement—accompanied by a message directed at the administrator—and the alleged exfiltration of user records and institutional databases. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / WEB ADMINISTRATORS)
Web Server Isolation and Restoration: Administrators of sap. com.ec should temporarily isolate the affected server, examine HTTP/S access logs to identify the entry vector (e.g., the upload of malicious files, an outdated CMS, or exposed administrative credentials), and restore the system from a clean backup.
Database and Access Account Audit: Inspect local databases to determine whether any unauthorized extraction of customer or employee data tables occurred, and proceed to reset passwords for all accounts with privileged access.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: analyzer.vecert.io
Quickly check your security at: monitor.vecert.io
Quotes and services: vecert.io/contact
#Ecuador #EC #Quito #Guayaquil #EcuadorCyber #SecurityEcuador #EcuadorTech #Defacement #Hacked #DataLeak #DataBreach #BreachForums #DatabaseLeak #m0z1ll4screw #h4d3pwn #WebSecurity #Vulnerability #Cybersecurity #Ciberseguridad #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk
Hack-Security S.A retweeted
‼️ BREAKING: Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability
Details: cybersecuritynews.com/emerge…
Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM.
The update blocks affected intermediate certificate authority certificates linked to eMudhra. According to Oracle’s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component.
Oracle rates exploitation as low complexity, with no authentication or user interaction required. Successful attacks can expose or change sensitive data, although the risk matrix lists no availability impact.
#cybersecuritynews #vulnerability
Hack-Security S.A retweeted
‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.
New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance.
Full details → thehackernews.com/2026/10/ur…
Estamos cada día más cerca. 🤖 🤖
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
Hack-Security S.A retweeted
‼️ If you run a branch older than 8.2 — 8.1, 7.x, or 5.x — PHP will not fix it.
😬 There is no patch coming for you from PHP.
Your only options are to upgrade to a supported branch, take the system off the internet, or get a backported fix from your Linux distribution or host, if they offer one.
🚨 PHP2Shell: the one-line “fix” everyone shared overnight — session.upload_progress.enabled=0 — isn’t enough on its own, the firm that suggested it now says.
A PHP core developer put it bluntly: “the only mitigation is patching / upgrading PHP.”
No patch until 14:00 UTC today.
Here’s what actually cuts your risk before then → thehackernews.com/2026/10/ph…
Hack-Security S.A retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Hack-Security S.A retweeted
Exploit público para vulnerabilidad RCE de Fortinet FortiSIEM sin login
Se ha publicado un exploit de prueba de concepto para la vulnerabilidad crítica CVE-2026-106173 en Fortinet FortiSIEM
blog.elhacker.net/2026/10/ex…
Hack-Security S.A retweeted
‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.
Researchers report potential RCE.
CVE-2026-109618 and CVE-2026-109619.
Fixes scheduled for October 21, 14:00 UTC.
Details - thehackernews.com/2026/10/ph…
Hack-Security S.A retweeted
⚠️ 🇪🇨 🏛️ PREVENTIVE ALERT: ALLEGED EXPOSURE OF THE ECUADORIAN MINISTRY OF EDUCATION DATABASE (ACTOR: PHEISITO)
[STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: PHEISITO / DATE: OCTOBER 2026]
The centralized cyber-intelligence system has intercepted a post on underground forums by a user known as "Pheisito" (representing "Pheisito's Group"). The post claims the exfiltration and publication of the Ecuadorian Ministry of Education’s database, framed as a hacktivist protest against the state institution.
It is strictly noted that the veracity of this breach, the existence of a vulnerability in the Ministry’s servers, and the overall authenticity of the data have not been officially confirmed by the authorities at the Ecuadorian Ministry of Education. The definitive status of the infrastructure remains unconfirmed.
Threat Actor: Pheisito
Victim / Affected Entity: Ministry of Education of Ecuador 🇪🇨.
Sector: 🏛️ Government, Public Education, State Administration, and Personal Data in Ecuador.
Nature of the Incident: A hacktivist protest campaign involving the release of a massive dump of institutional databases, accompanied by statements directed at the national teaching body.
🛡️ PREVENTIVE TECHNICAL CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / GOVERNMENT OF ECUADOR)
Urgent Audit of Ministry Servers: The technical teams at the Ecuadorian Ministry of Education must immediately identify the access point used to extract the database, revoke compromised credentials, and isolate the affected services.
Monitoring and Sample Analysis: Securely download and examine the contents of the linked repository to determine the exact scope of the leaked information and protect potentially affected users.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: analyzer.vecert.io
Quickly check your security at: monitor.vecert.io
Quotes and services: vecert.io/contact
#Cybersecurity #ThreatIntel #Ecuador #MinistryOfEducation #DataLeak #Pheisito #Hacktivism #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert
TUMBAMOS @Educacion_Ec Encerio ese es el NUEVO ECUADOR @DanielNoboaOk
-La database:gofile.io/d/tQNi1AZq
-Vayan a nuestro darkforums: darkforums.as/User-Pheisito -LOS QUEREMOS ESPECTADORES :3
Hack-Security S.A retweeted
MITRE ATT&CK v20 añade 9 técnicas sobre exploits de IA, bypass de MFA y evasión de CAPTCHA
blog.elhacker.net/2026/10/mi…
Hack-Security S.A retweeted
Dias atras @usuariosdigital reportaba una alerta de posible hackeo al @ECU911_ el sistema que se usa en #Ecuador para emergencias de ese pais. Hoy investigando al parecer el hackeo es real y se habla en foros de telegram de venta de informacion extraida. No han emitido ningun comunicado oficial la entidad afectada, esto es muy grave. @Telecom_Ec @EcuCERT_EC @MIT_Ecuador #AlertaDigitalEC
Hack-Security S.A retweeted
VirusTotal analiza IPv4 públicas para exponer servidores C2 e infraestructura de malware
VirusTotal ha implementado el escaneo diario del espacio IPv4 público para ayudar a los equipos de seguridad a localizar servidores de comando y control
blog.elhacker.net/2026/10/vi…
Hack-Security S.A retweeted
No es paranoia, las tecnologías de vigilancia estatal crecen sin control en América Latina es.wired.com/articulos/no-es…
Sobre el reporte que hicimos con @derechosdigital en el marco del OLAD
Hack-Security S.A retweeted
Vulnerabilidades críticas en WordPress permiten ataques XSS, SQLi y filtración de datos
WordPress lanzó la versión 7.1.3 el 6 de octubre de 2026 para corregir vulnerabilidades de cross-site scripting (XSS), inyección SQL y divulgación de información, entre otras fallas de seguridad
blog.elhacker.net/2026/10/vu…
Hack-Security S.A retweeted
⚠️ CRITICAL PREVENTIVE ALERT 🇦🇷 🇨🇴 🇪🇨 🇪🇸 🇲🇽 🌐: ALLEGED COMPILATION AND MASSIVE LEAK OF 3.4 TERABYTES OF SENSITIVE GLOBAL DATA (ACTOR: ESQUELESQUAD / SKULL1172)
[STATUS: UNCONFIRMED; EVIDENCE VISIBLE BUT NOT VERIFIED / THREAT ACTOR: SKULL1172 / COLLECTIVE: ESQUELESQUAD / DATE: OCTOBER 2, 2026]
The centralized cyber-intelligence system has detected a major post made on underground forums on October 2, 2026, by user Skull1172, representing the EsqueleSquad collective. The report announces the release of a massive, up-to-date compilation of databases leaked during 2026, totaling 3.4 terabytes and over 264 million records across five countries.
It is strictly noted that the veracity of this massive breach and the authenticity of the repositories have not been officially confirmed by the affected government or corporate entities. The definitive status of the leak remains unconfirmed.
Threat Actor / Collective: EsqueleSquad
Reported Total Volume: 3.4 Terabytes / 264,144,000 files and records.
File Formats: JSON, PDF, TXT, SQL, and JPG images.
Affected Countries and Sectors:
Argentina 🇦🇷: Government, civilian, credit, and state sectors.
Colombia 🇨🇴: Government and state sectors.
Ecuador 🇪🇨: Civilian sector.
Spain 🇪🇸: Civilian sector. Mexico 🇲🇽: Civil, state, and credit-related levels.
🔍 TECHNICAL BREAKDOWN OF INFORMATION AND EXPOSED DATA TYPES
According to the description on the underground forum, the massive compilation includes highly sensitive PII (Personally Identifiable Information) records and financial infrastructure data:
Types of Data Included:
Biometric data and passwords.
Credit scores and credit histories.
National ID numbers, identity documents, and tax ID numbers.
Full names, home addresses, and telephone numbers.
Bank records, credit card numbers, and vehicle ownership details.
Corporate and personal email addresses.
Claims of Attacks and Website Defacement:
The group also claims responsibility for intrusions and visual modifications (defacement) of platforms in the region, notably:
CIPPEC - OEAR (Argentine Electoral Observatory).
PANROTAS.COM.BR (Brazil).
CASTELMONTE EDU AR (Argentina).
FOLPRENSA.
ALDIA.COM.EC (Ecuador).
🛡️ TECHNICAL RECOMMENDATIONS FOR PREVENTION AND CONTAINMENT (SOC / CSIRT / GOVERNMENTS)
Regional Incident Response Coordination: Government cybersecurity teams in Argentina, Colombia, Ecuador, Spain, and Mexico must activate emergency protocols to audit exposed state repositories.
Monitoring and Early Warning for Financial Institutions: Restrict access to identity validation platforms and notify banking systems to mitigate the fraudulent use of leaked data.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: analyzer.vecert.io
Quickly check your security at: monitor.vecert.io
Quotes and services: vecert.io/contact
#Cybersecurity #ThreatIntel #EsqueleSquad #DataLeak #GlobalAlert #Argentina #Colombia #Ecuador #Spain #Mexico #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert
Hack-Security S.A retweeted
⚠️ GLOBAL PREVENTIVE ALERT 🌐 📨: MASSIVE 🇧🇷 🇮🇹 🇳🇱 🇦🇷 🇩🇪 🇬🇧 🇫🇷 🇺🇸 🇦🇺 🇮🇳 🇨🇴 🇨🇱 🇪🇸 🇪🇨 🇵🇪 DUMP OF 2.5 MILLION COMPROMISED SMTP SERVERS (ACTOR: SPAMMERSFAMILY)
[STATUS: CONFIRMED, EVIDENCE VERIFIED / THREAT ACTOR: SPAMMERSFAMILY / DATE: SEPTEMBER 29, 2026]
The centralized cyber-intelligence system has detected a post on underground forums made on September 29, 2026, by the user Spammersfamily (holding MVP rank). The report announces the public, mass distribution of a compressed file containing 2.5 million compromised SMTP servers, exposing email credentials and highly critical mail-sending gateways on a global scale.
Threat Actor / Group: Spammersfamily.
Activity Type: Mass dump and distribution of SMTP access credentials (mail server databases for mass-mailing campaigns).
Sector: 📨 Email Infrastructure, Telecommunications, and Offensive Cybersecurity.
Geographic Scope: Global, with a significant presence in commercial and government domains across Latin America and Europe.
📊 TECHNICAL STATISTICS AND DATASET METRICS
Automated analysis of the source file (2M SMTPs_20262909134018.txt) yields the following key metrics regarding the exfiltrated volume:
Total Lines Read: 2,487,083 records.
Valid Records: 2,487,026 processed entries.
Invalid Lines: 57 discarded records.
Count by Key Category
Government and Military Domains (.gov / .gob / .mil): 5,520 servers. Latin American Domains: 162,735 servers.
2. Top 10 Most Mentioned TLDs (Extensions)
.com: 1,867,379 records.
.br 🇧🇷 (Brazil): 123,218 records.
.it 🇮🇹 (Italy): 100,895 records.
.net: 42,641 records.
.nl 🇳🇱 (Netherlands): 25,845 records.
.ar 🇦🇷 (Argentina): 15,494 records.
.de 🇩🇪 (Germany): 13,178 records.
.uk 🇬🇧 (United Kingdom): 13,076 records.
.org: 12,769 records.
.fr 🇫🇷 (France): 11,533 records.
3. Breakdown of Detected Government and Military Domains
The dataset includes access to critical state infrastructure across multiple countries, notably:
.gov.br 🇧🇷 (Brazil): 3,044 records.
.gov 🇺🇸 (General US/International): 514 records.
.gob.ar 🇦🇷 (Argentina): 341 records.
.gob.mx 🇲🇽 (Mexico): 299 records.
.gov.uk 🇬🇧 (United Kingdom): 299 records.
.gob.pe 🇵🇪 (Peru): 228 records.
.gov.co 🇨🇴 (Colombia): 187 records.
.gob.ec 🇪🇨 (Ecuador): 160 records.
.mil (Global military): 140 records. Additionally, access has been recorded from domains in Australia 🇦🇺 (.gov.au), India 🇮🇳 (.gov.in), Brazil 🇧🇷 (.mil.br), Colombia 🇨🇴 (.mil.co), Chile 🇨🇱 (.gob.cl), Argentina 🇦🇷 (.mil.ar), and Spain 🇪🇸 (.gob.es).
🛡️ TECHNICAL RECOMMENDATIONS FOR PREVENTION AND CONTAINMENT (SOC / CSIRT / EMAIL ADMINISTRATORS)
Immediate SMTP Credential Rotation: Organizations with domains appearing in the samples must revoke passwords, rotate application keys, and disable exposed service accounts.
Implementation of SPF, DKIM, and DMARC Policies: Strengthen email authentication records to prevent the impersonation of institutional domains by third parties using these leaked lists.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: analyzer.vecert.io
Quickly check your security at: monitor.vecert.io
Quotes and services: vecert.io/contact
#Cybersecurity #ThreatIntel #SMTPDump #Spammersfamily #DataLeak #GlobalAlert #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert
