Ex-NSA | Ex-8200 | Ex-GCHQ | Ex-CIA | Ex-MI6 | Ex-Mossad | Ex-KGB. Five Eyes, zero sleep. Tweets reviewed by at least 3 agencies.
127.1
Joined November 2024
- Tweets2.8K
- Following1.8K
- Followers343
- Likes3.8K
Antonio Calderón retweeted
Campaign against MSSQL. Brute force initial access. Deploys XMR miner. By fortinet.
C2/staging:
site.vietnam852[.]com:88
ftp.vietnam852[.]com:88
server.vietnam852[.]com:8000
www.swordaa[.]com:8000
site.hfgjjkrewjk[.]com
site.jiancai008[.]com
Try our platform for the bigger picture. $19/user.
#CyberSecurity
Antonio Calderón retweeted
🚨Cyber Alert Update‼️
🇹🇼Taiwan - 𝗧𝗦𝗠𝗖
On November 12, Taiwan Semiconductor Manufacturing Company (TSMC) confirmed the unauthorized exposure of current and former employees’ personal data linked to a third-party cloud provider, with no evidence that its own systems or customer data were compromised.
On November 8, Hackmanac identified a post by threat actor SmithBrianI, who claimed to be selling approximately 6.9 GB of sensitive employee data across 46,000 files, including personal, contact, identification, and banking information, for 3 BTC.
Threat actor: SmithBrianI
Sector: Manufacturing
Data exposure (claimed): 6.9 GB (46,000 files)
Data type: Employee personal data, including identification, contact and banking information
Observed: Nov 8, 2026
Status: Confirmed data exposure; threat actor's claim pending verification
ESIX©: 4.67
Full details and impact assessment on HackRisk.io
Antonio Calderón retweeted
The Python community has lost one of its early contributors. 🕊️
Guido van Rossum, Python's creator, announced the passing of Tim Peters at the age of 74.
Peters was Python's second real user, creator of Timsort, author of the Zen of Python (PEP 20), and a member of the Python Software Foundation board for 13 years.
His contributions will live on in the Python ecosystem.
Rest in peace, Tim Peters. ❤️
Antonio Calderón retweeted
‼️ Hackers copied the customer database of the pension and insurance arm of Caixa, Brazil's state-owned bank. Names and tax IDs of all 7.6 million active clients were taken.
Former clients were hit too. For some, home addresses, phone numbers, emails and birth dates went with them.
The breach was found on 6 November and disclosed six days later. The company says it has no sign that passwords, bank details or balances were affected.
Antonio Calderón retweeted
VMware ESXi backdoor
193[.]5[.]65[.]114
45[.]158[.]196[.]81
45[.]158[.]196[.]141
a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10
Writeup by Recorded. First seen m
MalwareBazaar (sample available).
#CyberSecurity #Malware
Antonio Calderón retweeted
🚨🇨🇴 Colombia's national health surveillance system allegedly compromised, 5.2 million records offered for sale
The actor "NyxarGroup" is selling 5,227,341 records allegedly obtained from SIVIGILA, Colombia's public health surveillance system operated by the National Institute of Health (INS).
The dataset reportedly contains disease surveillance notifications, patient identifiers, demographic information, geographic locations, and healthcare reporting details.
The group has published a sample of 100,000 records and is asking $500 for the complete database.
Claim is currently unverified.
Antonio Calderón retweeted
⚠️ 🇨🇴 🏥 🗄️ PREVENTIVE ALERT - ALLEGED SALE OF SIVIGILA DATA (INS COLOMBIA)
[STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: NyxarGroup / REPORT DATE: NOVEMBER 12, 2026]
Centralized cyber-intelligence systems have intercepted a post on underground forums (recorded on November 12, 2026) by the group NyxarGroup, advertising the sale of data. The report claims a breach and the subsequent offering for sale of the entire database from the SIVIGILA public health surveillance platform, operated by the National Institute of Health (INS) of Colombia
The group is offering a batch of 2,527,341 records, asserting that they possess the complete database (contrary to previous, smaller-scale posts involving 50,000 records) and providing a public sample of 100,000 records for verification purposes.
It is strongly emphasized that the occurrence of this intrusion, the direct compromise of the National Institute of Health’s servers, and the overall authenticity of the data repositories being offered for sale have not been officially confirmed by the INS or Colombian cybersecurity authorities.
Threat Actor: NyxarGroup
Victim : National Institute of Health (INS) — SIVIGILA Platform ( .ins.gov.co) — 🇨🇴 Colombia.
Sector: 🏛️ Government, Public Health, Epidemiology, and Health Information Systems. Publication Date: November 12, 2026.
Reported Volume: 2,527,341 total records (with an initial public sample of 100,000 records).
Nature of the Incident: Alleged compromise of epidemiological surveillance systems, massive exfiltration of health records, and potential personally identifiable information (PII).
🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / HEALTH SECTOR)
Urgent Audit of Servers and Web Access: IT teams at the National Institute of Health (INS) and the Ministry of Health must immediately audit the SIVIGILA infrastructure, review access logs, and verify the integrity of databases to rule out active breaches.
Credential Revocation and Endpoint Hardening: Invalidate any exposed administrative access credentials and secure application programming interfaces (APIs) and web portals against automated data extraction.
Protection of Sensitive Health Data: Assess the regulatory and privacy impact resulting from the potential exposure of epidemiological records and the personal data of patients or individuals submitting reports.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: analyzer.vecert.io
Quickly check your security at: monitor.vecert.io
Quotes and services: vecert.io/contact
#Colombia #INS #SIVIGILA #DataLeak #DataBreach #BreachAlert #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk
Antonio Calderón retweeted
Today, as part of Operation Endgame, the FBI and our partners announced the disruption of the malware and botnet known as Gootloader. Since 2018, Gootloader malware infected more than 25,000 computers worldwide and was used in ransomware attacks against at least 44 U.S.-based victims, resulting in millions of dollars in losses.
As part of the coordinated international operation, @FBIDenver and partners removed the Gootloader malware from over 100 computer servers and seized the U.S. domain names used by criminals to deliver and control the malware. Private-sector partner The Shadowserver Foundation assisted with identifying infections, victim notification, and remediation.
justice.gov/opa/pr/gootloade…
ALT Dark-themed notice stating a website has been seized by U.S. authorities due to malware enforcement under OPERATION ENDGAME.
Antonio Calderón retweeted
CEO of the Year has a nice ring to it.
Congratulations to AMD Chair and CEO @LisaSu on this well-deserved recognition from @YahooFinance! 👏
yhoo.it/4kdfEYI
Antonio Calderón retweeted
Nobody do any hacking right now...Microsoft Defender XDR...
"Title: Users may be unable to connect to multiple Microsoft 365 services
User impact: Users may be unable to connect to multiple Microsoft 365 services.
More info: Potentially impacted services include:
- Exchange Online
- Microsoft Teams
- SharePoint Online
- Microsoft Copilot 365
- Microsoft Defender XDR
Current status: We're investigating an issue impacting multiple Microsoft 365 services and we've determined the affected infrastructure is experiencing elevated load across multiple regions, which is likely contributing to the connectivity errors. We're restarting and repairing impacted portions of this infrastructure to restore capacity, and reviewing an unexpected increase in a specific type of service traffic to determine whether it's contributing to the elevated load. In parallel, we're evaluating options to redirect traffic to alternate infrastructure to expedite relief.
Scope of impact: This issue may affect users attempting to access the affected Microsoft 365 services.
Next update by: Thursday, November 12, 2026, at 8:30 PM UTC
"
Antonio Calderón retweeted
‼️ BREAKING: Security journalist Brian Krebs says the man running Qilin, the world's most active ransomware gang, is 36-year-old Aleksey Yakovtsev of St. Petersburg.
Researchers traced the boss's handle "Haise" through old forum names to a mail[.]ru address whose password was built from one of them.
That address sits in leaked records from Russia's own hacked government services portal.
Qilin has claimed 365+ victims in three months.
Antonio Calderón retweeted
NVIDIA announces CEO transition. Read the release: nvidianews.nvidia.com/news/n…
Antonio Calderón retweeted
🚨 Hackers are breaching MSPs through compromised ScreenConnect panels, deploying rogue remote access tools to customer devices.
@HuntressLabs reports 6 compromised MSPs and 286 affected endpoints across 47 organizations, with the numbers rising.
Attackers can also reportedly pivot from infected endpoints back to MSP technicians' workstations, stealing browser sessions and authentication tokens to access additional ScreenConnect panels.
ConnectWise told BleepingComputer it is investigating and warns technicians not to open interactive sessions with suspected compromised devices.
💡Details here: bleepingcomputer.com/news/se…
Antonio Calderón retweeted
Unfair that CEOs who aren’t into Asian girls get fewer dating options from spy agencies.
Where are the French/Russian/Iranian honeypots? Not one spy girl sent my way. Are they even trying?
France is excused — their decision-makers aren’t into girls. Everyone else: try harder!
