ShinyHunters Claims Breach of Cybersecurity Firm Resecurity, Leaks Internal Data The hacking group ShinyHunters has publicly claimed responsibility for breaching Resecurity, a U.S.-based cybersecurity company headquartered in Los Angeles. In a Telegram post shared earlier today, the group asserted full access to Resecurity’s internal systems and released screenshots as evidence. The leaked images depict internal dashboards, user management panels, token databases, and employee communication channels, exposing sensitive data including: - API keys and access tokens - Internal Mattermost chat logs, including discussions on threat intelligence and client reports - Employee details (names, email addresses, authentication tokens) - Client lists and related information - Threat intelligence documents and moderation logs Analysis of the screenshots by Hackread.com revealed real-time access tokens, Firebase Cloud Messaging (FCM) user accounts, and active employee profiles with exposed credentials. Some names visible in the images were cross-referenced with LinkedIn, appearing to match Resecurity personnel. ShinyHunters framed the attack as retaliation, accusing Resecurity of deceptive tactics—specifically, posing as buyers on dark web markets to infiltrate threat actor groups. The group referenced a prior incident involving a Vietnamese financial database, where Resecurity allegedly requested free samples under false pretenses. The post also mentioned collaboration with the Devman ransomware group and cited past breaches, including claims against CrowdStrike, as part of a broader campaign against firms they label as hypocritical. As of now, Resecurity has not publicly confirmed the breach, and the authenticity of the claims remains unverified by third parties. If validated, this would mark ShinyHunters’ first major public breach of 2026, potentially impacting Resecurity’s clients, partners, and trust in its services—particularly if sensitive intelligence or operational data was compromised. Resecurity, known for its work in cybercrime investigation, threat attribution, and digital forensics, has previously collaborated with government and private sector entities. Further developments are expected as the situation unfolds.

Silent Ransom Group (SRG) Exploits Fast Flux Network to Evade Detection The Silent Ransom Group (SRG), also known as Chatty Spider, Luna Moth, and UNC3753, has adopted a fast flux network to conceal its infrastructure, according to a recent Resecurity report. The group primarily targets law firms, finance, healthcare, insurance, and hospitality sectors industries handling sensitive data using voice phishing (vishing) and social engineering to breach networks. SRG’s tactics include phishing emails disguised as data migration or invoice requests, followed by phone calls from operatives posing as IT specialists. Victims are tricked into screen-sharing sessions and installing remote access tools, sometimes even via physical USB drops by in-person operatives. Unlike traditional ransomware groups, SRG prioritizes data exfiltration over encryption, issuing extortion threats within 30 minutes of stealing files. If victims resist, the group escalates pressure by contacting employees and partners. To evade detection, SRG leverages a fast flux botnet a technique that rapidly rotates DNS records across compromised routers, modems, IoT devices, and CPEs in 18 countries, including regions in Latin America, Eastern Europe, and the Middle East. The botnet, spread across 22 ISPs, has been linked to domains like ep6pheij[.]com and business-data-leaks[.]com, both tied to SRG’s operations. The group’s focus on law firms has had a measurable impact: nearly a quarter of all ransomware incidents in Q1 2026 targeted the legal sector, making it the fourth-most affected industry. SRG’s activities date back to at least 2022, with overlaps observed between its operations and UNC2686, a threat cluster known for BazarCall campaigns and malware like TrickBot, Ursnif, and BazarLoader.

Cybersecurity Firm Resecurity Targeted in Alleged Breach by "Scattered Lapsus$ Hunters" Threat actors identifying as Scattered Lapsus$ Hunters (SLH) claimed to have breached cybersecurity firm Resecurity, publishing screenshots on Telegram as proof of the alleged compromise. The group asserted it had stolen internal data, including employee records, client details, threat intelligence reports, and communications from a Mattermost collaboration platform. The attack was framed as retaliation for what the actors described as Resecurity’s attempts to infiltrate their operations, including posing as buyers to obtain samples of a purported Vietnam financial database. However, Resecurity disputed the claims, stating the accessed systems were part of a deliberately deployed honeypot—a decoy environment designed to monitor and analyze attacker behavior. According to the company, the threat actor first probed its systems on November 21, 2025, prompting Resecurity’s digital forensics team to deploy the honeypot in an isolated environment. The decoy contained synthetic datasets, including over 28,000 fake consumer records and 190,000 payment transactions generated via Stripe’s API, mimicking real-world data to lure the attackers. Between December 12 and 24, the threat actor made 188,000 automated exfiltration attempts using residential proxy IP addresses, exposing their infrastructure during proxy failures. Resecurity collected telemetry on the attacker’s tactics, later identifying servers linked to the operation and sharing intelligence with law enforcement. A foreign law enforcement agency, acting on Resecurity’s findings, issued a subpoena to investigate the threat actor. The group, which has previously been associated with ShinyHunters, Lapsus$, and Scattered Spider, later clarified that ShinyHunters was not involved in this incident. As of the latest update, the threat actors have not provided additional evidence beyond a Telegram post teasing further disclosures. Resecurity maintains that no legitimate production systems were compromised.

Rapid SQL Server Ransomware Attacks Highlight Critical Security Gaps Recent investigations reveal that attackers can move from initial SQL Server access to full ransomware deployment in as little as 32 minutes a timeline that underscores the speed and efficiency of modern cyber threats. The DFIR Report’s analysis of a BlueSky ransomware incident and SEKOIA’s Mallox honeypot research demonstrate how exposed or poorly secured SQL Server instances become prime targets for rapid encryption and operational disruption. ### How Attacks Unfold 1. Initial Access - Attackers exploit publicly exposed TCP port 1433 (SQL Server’s default port), often via brute-force attacks targeting the built-in *sa* account or weak credentials. - SQL injection remains a distinct but equally dangerous vector, though its impact depends on application permissions and available SQL features. 2. Privilege Escalation to OS Control - Once inside, attackers test for command execution outside the database engine. Common methods include: - xp_cmdshell (disabled by default but easily enabled with sysadmin privileges). - CLR (Common Language Runtime) and OLE Automation, which allow payload staging. - SQL Agent jobs and linked servers for lateral movement. - Sophos MDR observed attackers using xp_cmdshell to run discovery commands (whoami, systeminfo) before deploying ransomware. 3. Ransomware Deployment & Backup Sabotage - Attackers disable services, encrypt MDF/LDF files (SQL database files), and delete backups or Volume Shadow Copies (VSS) to prevent recovery. - In one ALPHV ransomware case, threat actors destroyed all backups during encryption, turning a breach into a full-scale restore crisis. - Backup co-location storing backups on the same server or network remains a critical vulnerability, with 51% of state/local government victims reporting successful backup compromise (Sophos, 2024). ### Why SQL Server is a High-Value Target - Centralized Data: A single SQL instance often supports finance, operations, and line-of-business applications, making encryption a multi-department disruption. - Configuration Drift: Overprivileged service accounts, enabled dangerous features (xp_cmdshell, CLR), and unpatched linked servers create easy escalation paths. - Backup Failures: Even with backups in place, 79% of energy/water sector victims reported backup compromise, with 55% taking over a month to recover (Sophos). ### Key Hardening Measures Security teams can mitigate risks by prioritizing: 1. Blocking public exposure of port 1433 (restrict access to VPNs, bastion hosts, or trusted networks). 2. Disabling the *sa* account (renaming offers minimal protection; disable it entirely). 3. Enforcing Windows Authentication (reduces brute-force risks but requires clean Active Directory hygiene). 4. Disabling *xp_cmdshell*, CLR, and OLE Automation unless explicitly required. 5. Reviewing SQL service accounts (avoid local admin/domain privileges; use Group Managed Service Accounts (gMSA)). 6. Isolating backups (off-host, immutable storage, and 3-2-1 backup model with tested restores). 7. Enabling auditing (monitor for sp_configure changes, xp_cmdshell usage, and failed sa logins). ### Detection Opportunities Early signs of compromise include: - SQL audit logs (unexpected xp_cmdshell or sp_configure commands). - Windows Event Logs (processes spawned by sqlservr.exe). - EDR alerts (unusual service account activity or backup repository access). - Network telemetry (anomalous outbound connections post-compromise). ### The Bigger Picture While checklists reduce obvious risks, legacy environments often accumulate hidden vulnerabilities stale permissions, forgotten linked servers, or overprivileged service accounts that attackers exploit. The fastest attacks (e.g., 32-minute ransomware deployment) highlight the need for continuous monitoring and rapid response to detect and disrupt intrusions before encryption begins. SQL Server ransomware remains a high-impact, low-friction attack vector, with threat actors leveraging both speed and leverage to maximize disruption. Organizations must address both technical controls and operational drift to close gaps before attackers exploit them.

BreachForums Data Leak Exposes 324K Cybercriminals in Dramatic Retaliation On January 9, an individual using the alias "James" published a massive database containing the real identities and details of 323,986 BreachForums users, including administrators, moderators, and members of the notorious hacking community. The leak, framed as an act of retribution, targeted key figures behind BreachForums and ShinyHunters, with James claiming disillusionment with the groups’ shift toward attacking French targets. The manifesto, written in a theatrical 23-part style, portrayed James as a long-standing hacker who mentored these groups before turning against them. Among those named were French nationals Dorian Dali, Nahyl Ojeda, and Ali Aboussi, many of whom were reportedly teenagers or young adults. James declared the leak a move to "settle their destiny" by exposing them to authorities. Resecurity, a cybersecurity firm, confirmed the authenticity of the leaked data, which included usernames, email addresses, IP addresses, and registration details. While some members used anonymous email services, others relied on mainstream providers like Gmail, making identification easier for law enforcement. The data also revealed a global distribution of members, with concentrations in the U.S., Germany, Netherlands, France, Turkey, and the U.K., as well as significant activity in the Middle East and North Africa. The leak is expected to disrupt cybercriminal operations by stripping away anonymity, a cornerstone of groups like ShinyHunters. Shane Barney, CISO at Keeper Security, noted that the exposure of real identities and IP histories could accelerate investigations, making it harder for members to operate without fear of attribution. BreachForums, a successor to the shuttered RaidForums, has been a hub for trading stolen data, hacking tools, and personal information. Previous law enforcement actions, including the 2023 arrest of Conor Brian Fitzpatrick (pompompurin) and the 2024 sentencing of ShinyHunters member Sebastien Raoult, have failed to permanently dismantle the forum. This latest breach, however, may prove more damaging by exposing the infrastructure and identities of its members. While BreachForums users have dismissed the leak as outdated, Resecurity warned that many reuse registration details across underground platforms, meaning the data remains a valuable resource for law enforcement. The incident underscores the ongoing cat-and-mouse game between cybercriminals and authorities, with this leak marking a significant blow to one of the dark web’s most active marketplaces.