Independent Journalist specializing in Cybercrime Interviews and News.
Joined March 2012
- Tweets312
- Following776
- Followers56
- Likes24
Rowan Grey retweeted
Update: BYOD releasing decryption keys for hospital only and offering to pay patients that were affected $2,500...
"UPDATE: UNM
We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That's the whole reason why we came about and we plan to keep it that way."
BYOD ransomware group has posted the University of New Mexico aka UNM
"36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours."
Rowan Grey retweeted
Update of the update:
University of New Mexico aka UNM is completely removed and missing from the BYOD DLS as of this morning 👍👍👍👍
Update: BYOD releasing decryption keys for hospital only and offering to pay patients that were affected $2,500...
"UPDATE: UNM
We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That's the whole reason why we came about and we plan to keep it that way."
Rowan Grey retweeted
Spacebears ransomware DLS caught mid debug crash on its onion portal. PHP 8.3.6, Laravel 10.43.0, Ignition exposed via SQLSTATE. Stack trace, filesystem paths, controller source, raw SQL queries and env vars visible. Code shows scripted view count inflation.
Rowan Grey retweeted
🇺🇸 🚨 N0N EXTORTION GROUP CLAIMS ATTACK ON BROADCAST TECH FIRM AMAGI
The n0n extortion group has listed Amagi Media Labs, a cloud broadcast and streaming-TV technology company whose playout and ad-insertion platform is used by TV networks and FAST channels, on its leak site.
The group reportedly says it intends to publish the data within a few days.
No sample has been verified, and Amagi has not publicly confirmed an incident.
The claim has not been independently verified.
⚠️ Analyst Note:
Amagi runs playout and ad technology for a large number of broadcasters and streaming channels, so a real compromise could expose customer contracts, channel configurations and platform credentials, and in a worst case affect channel delivery for media clients. n0n has posted several victims in quick succession. We assess this as an unverified threat-actor claim, NOT confirmation of a breach.
Source: this is for subscribers only. Subscribe: teapawt.net/DailyDarkWeb/creator-s…
#DDW #DarkWeb #Amagi #Broadcast #Streaming #Media #n0n #Ransomware #Extortion #ThreatIntelligence #CyberSecurity
Rowan Grey retweeted
a threat actor named RustScout is seeking affiliates for their new ransomware as a service (Raas) offerings where they offer a 60/40 split.
Rowan Grey retweeted
Mission: Bypass 2FA!
Master Evilginx for man-in-the-middle phishing that captures credentials AND session cookies.
hackers-arise.com/cyberwar-m…
Rowan Grey retweeted
216[.]126[.]236[.]46: #OpenDirectory hosting a full #offensive toolkit. IoT #botnets (#Mozi/#Boatnet) + targeted attacks on a #Brazilian SaaS. #GodPotato for #privesc, #Ghostcat for file reads, #trojanized APK, cookie #stealer
Found via @Huntio
Read full thread below:
Rowan Grey retweeted
INTEL DROP
Gshell command-and-control cluster likely targeting Pakistani based orgs. Gshell is a China-aligned C2 framework observed being used against government and financial organizations.
103.112.97.64
103.112.97.163
103.112.97.199
134.122.204.46
134.122.204.86
134.122.204.106
207.56.28.60
207.56.28.82
The hosts group tightly into three back-to-back blocks:
103.112.97.0/24, 3 hosts
134.122.204.0/24, 3 hosts
207.56.28.0/24, 2 hosts
One block runs more than Gshell. 134.122.204.0/24 also hosts CobaltStrike, Plugx, Supershell.
credit Gshell discovery @huntio
#TotalInsights #ThreatIntel #gshell
team-cymru.com/total-insight…
🤖 Made with AI
Rowan Grey retweeted
🚨 New Cybercrime Platform Alert: MessiahGPT
A newly commercialized criminal AI-as-a-Service platform called MessiahGPT is being promoted to cybercriminals as an unrestricted AI environment for offensive cyber operations.
* MessiahGPT has been advertised on BreachForums
* Trellix Advanced Research Center publicly documented the platform in August 2026
* The service is marketed with capabilities related to malware development, ransomware, phishing kits, information stealers, social engineering, crypters, rootkits and exploitation support
* Operators advertise a free trial alongside paid subscription tiers
* Cryptocurrency payments are supported
* The platform also appears to maintain an associated Telegram community for promotion, updates and user interaction
* MessiahGPT is presented as operating without conventional AI safety restrictions, although claims regarding its underlying model architecture and technical performance remain partly unverified
⚠️ Analyst Note:
The important development is not simply the existence of another “uncensored AI.”
MessiahGPT represents the continued commercialization of AI-enabled cybercrime, where offensive capabilities are being packaged into accessible services that can reduce the technical barrier for less experienced threat actors.
This could accelerate phishing development, malware experimentation, social engineering and other cybercrime workflows at scale.
Organizations should monitor not only for AI-generated content, but also for the broader ecosystem of criminal platforms turning AI capabilities into subscription-based services.
Primary Source:
trellix.com/blogs/research/w…
#DDW #MessiahGPT #CyberCrime #ArtificialIntelligence #DarkWeb #ThreatIntelligence #CyberSecurity
Rowan Grey retweeted
Need Sources!
Looking for sources with insight into the initial-access market: how corporate access is sold, what buyers are looking for, and how access sales translate into ransomware attacks.
Confidentiality respected.
Rowan Grey retweeted
⚡️ #Ransomware’s New Dirty Trick: Fake Recovery Firms Are Now Targeting Victims Before the Crisis Is Even Over + Video
-Fact Checker: ✅: 1 ❌: 0 || 1/1 → Score: 100% 🦾
-Prediction: 📈 1 Positive | 📉 1 Negative
undercodenews.com/ransomware…
Rowan Grey retweeted
ATTENTION
Looking to speak w/ anyone who has information on ransomware/extortion actors who didn't honor their promises after receiving payment.
Leaked data anyway, retained access, or demanded more money. Victims, negotiators & researchers welcome. Confidentiality respected.
Rowan Grey retweeted
Huntress researcher James Northey shows how an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR. In this incident, Safe Mode also broke the ransomware, but the attacker managed to exfiltrate credentials and file shares. huntress.com/blog/akira-hits…
Rowan Grey retweeted
🛡️ Palo Alto Networks Patches 11 New Vulnerabilities Across PAN-OS, GlobalProtect, & Prisma Access
Source: cybersecuritynews.com/palo-a…
Palo Alto Networks has released its August 12, 2026 security bulletin, disclosing 11 new vulnerabilities affecting PAN-OS, the GlobalProtect App, Prisma Access Agent, and Prisma Browser, along with a monthly Chromium update rollup.
The patch batch spans information disclosure, local privilege escalation, buffer overflow, certificate validation bypass, and anti-tamper bypass flaws.
The most notable infrastructure entry is CVE-2026-0301, an information disclosure vulnerability in PAN-OS URL Filtering.
It impacts Cloud NGFW and multiple PAN-OS release branches, including 12.1, 11.2, 11.1, and 10.2, as well as Prisma Access deployments hosted on AWS and Azure.
#cybersecuritynews
ALT Palo Alto Networks Patches 11 New Vulnerabilities Across PAN-OS, GlobalProtect, & Prisma Access
Rowan Grey retweeted
‼️ WARNING: One Zoom attendee could take over every other attendee's computer.
Three flaws in Zoom's annotation feature could be exploited from inside a meeting, with no click, download, or prompt required from the victim.
Make sure your software is up to date.
Read more: thehackernews.com/2026/08/zo…
Rowan Grey retweeted
SecTor 2026 Briefing:
Ghost in the Hiring Machine: How to Spot Fake Personas Before They're on Your Payroll
Attendees will learn practical OSINT techniques for spotting fake personas and receive a checklist for thorough background checks. They will see these methods applied through two cases based on a true story, illustrating how these personas succeeded, how one could have been prevented, and where OSINT reaches its limits.
Get Your Briefings Pass Today: bit.ly/3UqRRJJ
