⚠️ 🇪🇨 🏛️ PREVENTIVE ALERT: ALLEGED EXPOSURE OF THE ECUADORIAN MINISTRY OF EDUCATION DATABASE (ACTOR: PHEISITO) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: PHEISITO / DATE: OCTOBER 2026] The centralized cyber-intelligence system has intercepted a post on underground forums by a user known as "Pheisito" (representing "Pheisito's Group"). The post claims the exfiltration and publication of the Ecuadorian Ministry of Education’s database, framed as a hacktivist protest against the state institution. It is strictly noted that the veracity of this breach, the existence of a vulnerability in the Ministry’s servers, and the overall authenticity of the data have not been officially confirmed by the authorities at the Ecuadorian Ministry of Education. The definitive status of the infrastructure remains unconfirmed. Threat Actor: Pheisito Victim / Affected Entity: Ministry of Education of Ecuador 🇪🇨. Sector: 🏛️ Government, Public Education, State Administration, and Personal Data in Ecuador. Nature of the Incident: A hacktivist protest campaign involving the release of a massive dump of institutional databases, accompanied by statements directed at the national teaching body. 🛡️ PREVENTIVE TECHNICAL CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / GOVERNMENT OF ECUADOR) Urgent Audit of Ministry Servers: The technical teams at the Ecuadorian Ministry of Education must immediately identify the access point used to extract the database, revoke compromised credentials, and isolate the affected services. Monitoring and Sample Analysis: Securely download and examine the contents of the linked repository to determine the exact scope of the leaked information and protect potentially affected users. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Cybersecurity #ThreatIntel #Ecuador #MinistryOfEducation #DataLeak #Pheisito #Hacktivism #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert

⚠️ CRITICAL PREVENTIVE ALERT 🇦🇷 🇨🇴 🇪🇨 🇪🇸 🇲🇽 🌐: ALLEGED COMPILATION AND MASSIVE LEAK OF 3.4 TERABYTES OF SENSITIVE GLOBAL DATA (ACTOR: ESQUELESQUAD / SKULL1172) [STATUS: UNCONFIRMED; EVIDENCE VISIBLE BUT NOT VERIFIED / THREAT ACTOR: SKULL1172 / COLLECTIVE: ESQUELESQUAD / DATE: OCTOBER 2, 2026] The centralized cyber-intelligence system has detected a major post made on underground forums on October 2, 2026, by user Skull1172, representing the EsqueleSquad collective. The report announces the release of a massive, up-to-date compilation of databases leaked during 2026, totaling 3.4 terabytes and over 264 million records across five countries. It is strictly noted that the veracity of this massive breach and the authenticity of the repositories have not been officially confirmed by the affected government or corporate entities. The definitive status of the leak remains unconfirmed. Threat Actor / Collective: EsqueleSquad Reported Total Volume: 3.4 Terabytes / 264,144,000 files and records. File Formats: JSON, PDF, TXT, SQL, and JPG images. Affected Countries and Sectors: Argentina 🇦🇷: Government, civilian, credit, and state sectors. Colombia 🇨🇴: Government and state sectors. Ecuador 🇪🇨: Civilian sector. Spain 🇪🇸: Civilian sector. Mexico 🇲🇽: Civil, state, and credit-related levels. 🔍 TECHNICAL BREAKDOWN OF INFORMATION AND EXPOSED DATA TYPES According to the description on the underground forum, the massive compilation includes highly sensitive PII (Personally Identifiable Information) records and financial infrastructure data: Types of Data Included: Biometric data and passwords. Credit scores and credit histories. National ID numbers, identity documents, and tax ID numbers. Full names, home addresses, and telephone numbers. Bank records, credit card numbers, and vehicle ownership details. Corporate and personal email addresses. Claims of Attacks and Website Defacement: The group also claims responsibility for intrusions and visual modifications (defacement) of platforms in the region, notably: CIPPEC - OEAR (Argentine Electoral Observatory). PANROTAS.COM.BR (Brazil). CASTELMONTE EDU AR (Argentina). FOLPRENSA. ALDIA.COM.EC (Ecuador). 🛡️ TECHNICAL RECOMMENDATIONS FOR PREVENTION AND CONTAINMENT (SOC / CSIRT / GOVERNMENTS) Regional Incident Response Coordination: Government cybersecurity teams in Argentina, Colombia, Ecuador, Spain, and Mexico must activate emergency protocols to audit exposed state repositories. Monitoring and Early Warning for Financial Institutions: Restrict access to identity validation platforms and notify banking systems to mitigate the fraudulent use of leaked data. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Cybersecurity #ThreatIntel #EsqueleSquad #DataLeak #GlobalAlert #Argentina #Colombia #Ecuador #Spain #Mexico #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert

⚠️ GLOBAL PREVENTIVE ALERT 🌐 📨: MASSIVE 🇧🇷 🇮🇹 🇳🇱 🇦🇷 🇩🇪 🇬🇧 🇫🇷 🇺🇸 🇦🇺 🇮🇳 🇨🇴 🇨🇱 🇪🇸 🇪🇨 🇵🇪 DUMP OF 2.5 MILLION COMPROMISED SMTP SERVERS (ACTOR: SPAMMERSFAMILY) [STATUS: CONFIRMED, EVIDENCE VERIFIED / THREAT ACTOR: SPAMMERSFAMILY / DATE: SEPTEMBER 29, 2026] The centralized cyber-intelligence system has detected a post on underground forums made on September 29, 2026, by the user Spammersfamily (holding MVP rank). The report announces the public, mass distribution of a compressed file containing 2.5 million compromised SMTP servers, exposing email credentials and highly critical mail-sending gateways on a global scale. Threat Actor / Group: Spammersfamily. Activity Type: Mass dump and distribution of SMTP access credentials (mail server databases for mass-mailing campaigns). Sector: 📨 Email Infrastructure, Telecommunications, and Offensive Cybersecurity. Geographic Scope: Global, with a significant presence in commercial and government domains across Latin America and Europe. 📊 TECHNICAL STATISTICS AND DATASET METRICS Automated analysis of the source file (2M SMTPs_20262909134018.txt) yields the following key metrics regarding the exfiltrated volume: Total Lines Read: 2,487,083 records. Valid Records: 2,487,026 processed entries. Invalid Lines: 57 discarded records. Count by Key Category Government and Military Domains (.gov / .gob / .mil): 5,520 servers. Latin American Domains: 162,735 servers. 2. Top 10 Most Mentioned TLDs (Extensions) .com: 1,867,379 records. .br 🇧🇷 (Brazil): 123,218 records. .it 🇮🇹 (Italy): 100,895 records. .net: 42,641 records. .nl 🇳🇱 (Netherlands): 25,845 records. .ar 🇦🇷 (Argentina): 15,494 records. .de 🇩🇪 (Germany): 13,178 records. .uk 🇬🇧 (United Kingdom): 13,076 records. .org: 12,769 records. .fr 🇫🇷 (France): 11,533 records. 3. Breakdown of Detected Government and Military Domains The dataset includes access to critical state infrastructure across multiple countries, notably: .gov.br 🇧🇷 (Brazil): 3,044 records. .gov 🇺🇸 (General US/International): 514 records. .gob.ar 🇦🇷 (Argentina): 341 records. .gob.mx 🇲🇽 (Mexico): 299 records. .gov.uk 🇬🇧 (United Kingdom): 299 records. .gob.pe 🇵🇪 (Peru): 228 records. .gov.co 🇨🇴 (Colombia): 187 records. .gob.ec 🇪🇨 (Ecuador): 160 records. .mil (Global military): 140 records. Additionally, access has been recorded from domains in Australia 🇦🇺 (.gov.au), India 🇮🇳 (.gov.in), Brazil 🇧🇷 (.mil.br), Colombia 🇨🇴 (.mil.co), Chile 🇨🇱 (.gob.cl), Argentina 🇦🇷 (.mil.ar), and Spain 🇪🇸 (.gob.es). 🛡️ TECHNICAL RECOMMENDATIONS FOR PREVENTION AND CONTAINMENT (SOC / CSIRT / EMAIL ADMINISTRATORS) Immediate SMTP Credential Rotation: Organizations with domains appearing in the samples must revoke passwords, rotate application keys, and disable exposed service accounts. Implementation of SPF, DKIM, and DMARC Policies: Strengthen email authentication records to prevent the impersonation of institutional domains by third parties using these leaked lists. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Cybersecurity #ThreatIntel #SMTPDump #Spammersfamily #DataLeak #GlobalAlert #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert