Campaigns - Threat-Intel

Inactive

TLP:CLEAR

anubis: FÉTIS Group & SECOM Engineering

Ransomware attack attributed to anubis. | Country: FR | Sector: Professional Services | Data breach at an engineering company. Financial records, project details, and personal information. | Source: https://www.ransomware.live/id/RsOJVElTIEdyb3VwICYgU0VDT00gRW5naW5lZXJpbmdAYW51Ymlz

Jun 2026 — Jun 2026

Confidence

80%

Inactive

TLP:CLEAR

Deadlock: Weinberg ''93 Építő Kft.

Ransomware attack attributed to Deadlock. | Country: HU | Sector: Manufacturing | Website: weinberg.hu | Infostealer data confirmed. | Weinberg ''93 Építő Kft., a prominent Hungarian construction and steel fabrication company. Overview: Founded in 1993 and headquartered in Sбrospatak, it is a 100% privately owned Hungarian company. Core Services: The firm specializes in general contracting and the manufacture of complex steel structures. Major Projects: They have handled significant industrial developments, including: - Volvo Trucks Hungary: Completed a 5,500 mІ advanced truck center in Ecser. - Continental Automotive: Construction of electronics manufacturing plants. - East Gate PRO Business Park: Developed BREEAM-certified sustainable warehouses. - Becton Dickinson: Expansion of a major syringe factory in Hungary. Recognitions: The company has received numerous awards, such as the Lechner Цdцn Award (2024) and the Steel Structure Award (2022). Over 650 gigabytes of sensitive internal...

Jul 2026 — Jul 2026

Confidence

80%

Inactive

TLP:CLEAR

Deadlock: Židlochovice city

Ransomware attack attributed to Deadlock. | Country: CZ | Sector: Government & Defense | Website: www.zidlochovice.cz | Internal city administration documents have been leaked. Personal data from the database will be sold on darknet forums. Mayor 'Jan Vitula' claims the attack was prevented and no data was stolen. An investigation has been launched with the police, and countermeasures are being taken. =) xD In press: https://www.denik.cz/regiony/zidlochovice-hackeri-kyberneticky-utok-vykupne-data-software-ransomware-kldr.html https://www.irozhlas.cz/zpravy-domov/poslete-bitcoiny-nebo-vas-nepustime-k-datum-urad-v-zidlochovicich-zjistuje-skody_2603172012_bva https://www.***.cz/cs/aktuality/dulezite-upozorneni-mimoradne-uzavreni-meu.html Over 150 gigabytes of internal data | Source: https://www.ransomware.live/id/xb1pZGxvY2hvdmljZSBjaXR5QERlYWRsb2Nr

Jul 2026 — Jul 2026

Confidence

80%

Inactive

TLP:CLEAR

Doommageddon: iw steelTEC Makine San. ve Tic. A.Ş.

Jul 2026 — Mar 2026

Confidence

80%

Inactive

TLP:CLEAR

Deadlock: HİDROMEK

Ransomware attack attributed to Deadlock. | Country: TR | Sector: Manufacturing | Website: www.hidromek.com | HİDROMEK is a leading Turkish manufacturer of heavy construction machinery recognized globally for its high-performance award-winning heavy equipment. Founded in Ankara in 1978 by mechanical engineer Hasan Basri Bozkurt the company operates six state-of-the-art production facilities across Turkey and Thailand. Its heavy machinery operates in more than 130 countries spanning six continents. Over 880 gigabytes of sensitive internal data were stolen from this company | Source: https://www.ransomware.live/id/SMSwRFJPTUVLQERlYWRsb2Nr

Jul 2026 — Jun 2026

Confidence

80%

Inactive

TLP:CLEAR

Global Secret Group: Hinduja Tech | BMW Group & Škoda Auto

Jul 2026 — Jul 2026

Confidence

80%

Inactive

TLP:CLEAR

CRPxO: ANADOLU SİGORTA

Jul 2026 — Jul 2026

Confidence

80%

Inactive

TLP:CLEAR

CRPxO: DOĞAN HOLDİNG

Jul 2026 — Jul 2026

Confidence

80%

Inactive

TLP:CLEAR

direwolf: Leafwell

Aug 2026 — Aug 2026

Confidence

80%

Inactive

TLP:CLEAR

aurora: FREYWILLE

Ransomware attack attributed to aurora. | Country: AT | Sector: Retail & E-Commerce | Website: FREYWILLE | [jewelry] FREYWILLE — the Austrian luxury fire-enamel jewelry house with 70+ boutiques across Europe, the Americas, Middle East, Russia/CIS, and Asia-Pacific. <censored> <censored> 142+ employee files with salary statements (2024–2026), social security numbers (ELDA), employment contracts across 24 countries, COVID vaccination records, passport copies, visa card statements spanning a decade, and personnel files. FREYWILLE's trade secrets — complete 2025 product costing for all lines (18ct gold, plated, textiles), and the crown jewels: enamel colour recipes from the Siebdruck department. FREYWILLE's fire-enamel technique is what makes the brand unique. The formulations for SPHINX, JOYB2, and Entwurf colour systems are in the dataset. Defence files from 40+ lawsuits across Austria, the US, China, France, Canada, Slovakia, Poland, and Belgium — including a criminal proceedings file...

Aug 2026 — Aug 2026

Confidence

80%

Inactive

TLP:CLEAR

genesis: Interim HealthCare

Aug 2026 — Aug 2026

Confidence

80%

Inactive

TLP:CLEAR

anubis: FÉTIS Group & SECOM Engineering

Ransomware attack attributed to anubis. | Country: FR | Sector: Professional Services | Data breach at an engineering company. Financial records, project details, and personal information. | Source: https://www.ransomware.live/id/RsOJVElTIEdyb3VwICYgU0VDT00gRW5naW5lZXJpbmdAYW51Ymlz

Jun 2026 — Jun 2026

Confidence

80%

Inactive

TLP:CLEAR

Deadlock: Židlochovice city

Ransomware attack attributed to Deadlock. | Country: CZ | Sector: Government & Defense | Website: www.zidlochovice.cz | Internal city administration documents have been leaked. Personal data from the database will be sold on darknet forums. Mayor 'Jan Vitula' claims the attack was prevented and no data was stolen. An investigation has been launched with the police, and countermeasures are being taken. =) xD In press: https://www.denik.cz/regiony/zidlochovice-hackeri-kyberneticky-utok-vykupne-data-software-ransomware-kldr.html https://www.irozhlas.cz/zpravy-domov/poslete-bitcoiny-nebo-vas-nepustime-k-datum-urad-v-zidlochovicich-zjistuje-skody_2603172012_bva https://www.***.cz/cs/aktuality/dulezite-upozorneni-mimoradne-uzavreni-meu.html Over 150 gigabytes of internal data | Source: https://www.ransomware.live/id/xb1pZGxvY2hvdmljZSBjaXR5QERlYWRsb2Nr

Jul 2026 — Jul 2026

Confidence

80%

Inactive

TLP:CLEAR

Deadlock: Weinberg ''93 Építő Kft.

Ransomware attack attributed to Deadlock. | Country: HU | Sector: Manufacturing | Website: weinberg.hu | Infostealer data confirmed. | Weinberg ''93 Építő Kft., a prominent Hungarian construction and steel fabrication company. Overview: Founded in 1993 and headquartered in Sбrospatak, it is a 100% privately owned Hungarian company. Core Services: The firm specializes in general contracting and the manufacture of complex steel structures. Major Projects: They have handled significant industrial developments, including: - Volvo Trucks Hungary: Completed a 5,500 mІ advanced truck center in Ecser. - Continental Automotive: Construction of electronics manufacturing plants. - East Gate PRO Business Park: Developed BREEAM-certified sustainable warehouses. - Becton Dickinson: Expansion of a major syringe factory in Hungary. Recognitions: The company has received numerous awards, such as the Lechner Цdцn Award (2024) and the Steel Structure Award (2022). Over 650 gigabytes of sensitive internal...

Jul 2026 — Jul 2026

Confidence

80%

Inactive

TLP:CLEAR

Doommageddon: iw steelTEC Makine San. ve Tic. A.Ş.

Jul 2026 — Mar 2026

Confidence

80%