RebirthStress DDoS服务升级,新增Layer 4和Layer 7攻击向量,强化匿名性,影响全球组织,特别是中小企业及新目标国家瑞典、印尼的政金机构。

类型: 勒索事件

更新时间: June 29, 2025, 4:24 p.m.

地区: 其他

内容: 📡 RebirthStress Unveils Major DDoS Upgrades! A significant update from RebirthStress, a known DDoS-for-hire (booter/stresser) service, just dropped. These changes aren't just minor tweaks; they signal a serious escalation in their capabilities, making them even more dangerous for organizations worldwide. What's New & Why It Matters RebirthStress has rolled out new Layer 4 and Layer 7 attack vectors, ditched some older, less effective methods, and supercharged their anonymity features. This means they're getting smarter at bypassing current DDoS protections. Key Highlights: Layer 4 (Network Layer) Enhancements: New Muscle: Introducing AMP-STUN (using STUN protocol for amplification) and GRE (Generic Routing Encapsulation to flood networks, often bypassing firewalls). There's also a mysterious "RAND" method, possibly for randomized attack patterns. Renaming for Clarity (or Obfuscation): Methods like WSD, SSDP, COAP, and DNS are now clearly labeled as "AMP-" (e.g., AMP-DNS), highlighting their amplification nature. Various UDP methods are now grouped under "UDP-*". Out with the Old: Less effective methods like SADP, SNMP, and ICMP are gone, streamlining their arsenal. New Targets: They've added Indonesia and Sweden to their supported countries, potentially indicating new attack trends or user demand. Layer 7 (Application Layer) Enhancements: Ultimate Anonymity: Their HTTP-ONION method now uses rapid TOR exit node switching. This is a game-changer, making attribution and blocking incredibly difficult. Stealthier Attacks: TLS headers have been updated, likely to better spoof legitimate browser traffic and bypass advanced anti-DDoS services like Cloudflare or Akamai. Broader Reach: Layer 7 attacks now support a wider range of countries, including high-value commercial targets (US, Germany, Japan), regions with ongoing cyber conflicts (Russia, China, Iran), and those with potentially weaker defenses (Pakistan, Vietnam). Why This is a "High" Threat This update clearly shows the platform's intent to escalate its capabilities in bypassing anti-DDoS mitigation and boosting attack efficiency. The TOR circuit switching is particularly alarming, enabling more persistent attacks while keeping the attackers anonymous. Who's at Risk? Small-to-mid size enterprises with limited DDoS protection. Political and financial institutions in newly targeted countries like Sweden and Indonesia.

链接:

英国驾照数据被指称在暗网出售

类型: 暗网情报

更新时间: June 29, 2025, 4:01 p.m.

地区: 英国

内容: 🚨🇬🇧Alleged sale of drivers license data from UK

链接:

NoName声称对以色列多个网站实施DDoS攻击,包括市政、超市、租车、媒体和通信网站。

类型: 勒索事件

更新时间: June 29, 2025, 12:06 p.m.

地区: 以色列

内容: 🚨 DDoS Alert NoName claims to have targeted multiple websites in Israel. - Efrat Municipality - Ariel Municipality - Shufersal Online Supermarket - Budget Car Rental Israel - Besheva - Cellcom Israel - BAZAN Group - Sting TV - HOT Mobile

链接:

BlackEye-Thai声称对柬埔寨多个政府部门网站发起DDoS攻击

类型: 勒索事件

更新时间: June 29, 2025, 8:14 a.m.

地区: 柬埔寨

内容: 🚨 DDoS Alert BlackEye-Thai claims to have targeted multiple websites in Cambodia. - Ministry of Posts and Telecommunications - General Department of National Treasury - Consumer Protection Competition and Fraud Repression Directorate-General (CCF) - Ministry of Environment (MoE)

链接:

德国著名人道主义援助组织Welthungerhilfe遭RHYSIDA勒索软件攻击,攻击者计划在6-7天内公布数据。

类型: 勒索事件

更新时间: June 29, 2025, 5:19 a.m.

地区: 其他

内容: 🚨 Ransomware Alert 🚨 Welthungerhilfe (WHH) 🇩🇪 📢 Welthungerhilfe (WHH), one of the largest and most respected private organizations for development cooperation and humanitarian aid in Germany, has fallen victim to RHYSIDA ransomware. ğŸ”� Key Details: 🛡 Threat Actor: RHYSIDA 📅Published date : 29-06-2025 NB: They intend to publish the data within 6-7 days.

链接:

抗病毒厂商发布的恶意软件研究论文探讨恶意软件家族TTP变化,内容详尽但不够普及。

类型: 暗网情报

更新时间: June 29, 2025, 3:41 a.m.

地区: 其他

内容: It's a shame malware research papers from antivirus vendors aren't more popular. But, it's partially their fault when they release a research paper on how a malware family has transitioned from using 1 TTP to a slightly different TTP and it's 15,000 words and 200 Ida pictures

链接:

墨西哥毒贩获取了以色列技术公司NSO集团的Pegasus间谍软件

类型: 暗网情报

更新时间: June 29, 2025, 3:06 a.m.

地区: 墨西哥

内容: How did the Mexican Drug Cartels get access to Israeli-tech firm NSO Group Pegasus Spyware

链接:

Keymous+声称对摩洛哥多家网站发起DDoS攻击,包括皇家摩洛哥航空、Wafa保险和Managem集团

类型: 勒索事件

更新时间: June 29, 2025, 2:43 a.m.

地区: 摩洛哥

内容: 🚨 DDoS Alert 🚨 Keymous+ claims to have targeted multiple websites in Morocco. - Royal Air Maroc - Wafa Insurance - Managem Group

链接:

意大利银行网站遭受TwoNet组织的DDOS攻击,网站目前无法访问。

类型: 勒索事件

更新时间: June 29, 2025, 2:35 a.m.

地区: 意大利

内容: 🚨 DDoS Alert 🚨 TwoNet claims to have targeted the website of Bank of Italy. NB : Site is down at the moment.

链接:

KYCNOT[.]me是一个无需身份验证的加密货币交易目录,提供暗网及明网访问。

类型: 暗网情报

更新时间: June 29, 2025, 1:06 a.m.

地区: 其他

内容: KYCNOT[.]me: A directory of trustworthy alternatives for buying, exchanging, trading, & using cryptocurrencies without having to disclose your identity. Clearnet: https://kycnot[.me Onion: http://kycnotmezdiftahfmc34pqbpicxlnx3jbf5p7jypge7gdvduu7i6qjqd[.onion

链接:

GLOBAL勒索软件客户端门户当前为空,链接指向暗网地址。

类型: 暗网情报

更新时间: June 29, 2025, 12:34 a.m.

地区: 其他

内容: GLOBAL Ransomware Client Portal... currently empty http://gdbkvfe6g3whrzkdlbytksygk45zwgmnzh5i2xmqyo3mrpipysjagqyd[.onion/

链接:

Weaxor勒索软件通过暗网传播,进行勒索活动。

类型: 暗网情报

更新时间: June 28, 2025, 11:57 p.m.

地区: 其他

内容: Weaxor Ransom Chat http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd[.onion/xEQExJdqEclxkv

链接:

墨西哥毒贩攻击FBI线人手机及监控摄像头,追踪并监视FBI特工和线人进行暗杀。

类型: 暗网情报

更新时间: June 28, 2025, 11:33 p.m.

地区: 墨西哥

内容: Crazy as hell seeing Mexican Drug Cartels compromise an FBI informant cell phone to extract geolocation and cell phone call records then compromise a series of security cameras all across Mexico to track and monitor FBI agents and informants to do highly targeted assassinations

链接:

威胁行为者声称出售含20亿条美国公民数据的信息,包括SSN、电话号码、驾照记录等敏感信息。

类型: 暗网情报

更新时间: June 28, 2025, 10:25 p.m.

地区: 美国

内容: 🚨🇺🇸A threat actor is allegedly selling data containing 2 billion lines on US citizens. The listing claims the following compromised data points: • 261 million Social Security Numbers (SSNs) • 162 million phone numbers • 3 million driver’s license records Additional fields reportedly include: • Full name • Date of birth • Address • Driver’s license number • Issuing state

链接:

美国公民数据疑遭泄露,涉及全名、住址、收入等敏感信息,总量达263GB

类型: 暗网情报

更新时间: June 28, 2025, 10:18 p.m.

地区: 美国

内容: 🚨🇺🇸Alleged 263 GB Data Leak of Citizen Data from USA Data points include: • Full names • Residential addresses • Income and salary details • Property values • Number of dependents • Contact phone numbers • Email addresses (some linked to multiple accounts) • Number of pets • Additional structured data fields

链接: