Bluchip News

☠️ Lamashtu lists Bender Tribunenbau Lamashtu listed Bender GmbH Tribunenbau on October 5 at 07:31 UTC. Status marked data leaked. No proof files. No data inventory. Bender is a German manufacturer of mobile grandstands and stages. 70 years operating. Serves Formula 1, MotoGP, World Cup skiing. TÜV certified. Lamashtu first observed April 2026. 48 public disclosures. Active. The listing is live. The stage is set. ☠️ Lamashtu 将 Bender Tribunenbau 列入泄露网站 Lamashtu 于 10 月 5 日 07:31 UTC 将 Bender GmbH Tribunenbau 列入泄露网站。状态标记为数据已泄露。无证明文件。无数据清单。Bender 是一家德国移动看台和舞台制造商。运营 70 年。服务 Formula 1、MotoGP、世界杯滑雪赛。TÜV 认证。Lamashtu 于 2026 年 4 月首次被观察到。48 条公开披露。仍在活动。 上架是活的。舞台已搭好。 @bluchipnews

☠️ Qilin lists Onsemi Qilin added Onsemi to its leak site on October 5 at 13:15 UTC. No data inventory. No file count. No proof files posted. Onsemi is a semiconductor manufacturer headquartered in Scottsdale, Arizona. Power and sensing chips. Revenue $6.8 billion in 2025. Qilin claimed INOVA Semiconductors GmbH on October 2. Two semiconductor companies in four days. Qilin accounts for roughly 15 percent of all ransomware attacks tracked in August 2026. The listing is live. The sector is the signal. Join the conversation, link below. ☠️ Qilin 将 Onsemi 列入泄露网站 Qilin 于 10 月 5 日 13:15 UTC 将 Onsemi 列入其泄露网站。无数据清单。无文件数量。无证明文件发布。Onsemi 是一家总部位于亚利桑那州斯科茨代尔的半导体制造商。电源和传感芯片。2025 年营收 68 亿美元。Qilin 于 10 月 2 日声称攻击了 INOVA Semiconductors GmbH。四天内两家半导体公司。Qilin 占 2026 年 8 月追踪到的所有勒索软件攻击的约 15%。 上架是活的。行业就是信号。 @bluchipnews @bluchipchat

☠️ NightSpire lists Malaysian port operator NightSpire added Port of Tanjung Pelepas to its leak site. The listing names the port operator and sets a ransom deadline. No data inventory disclosed. No proof files posted. Port of Tanjung Pelepas is Malaysia's largest container port. Located in Johor. Handles over 10 million TEU annually. Strategic gateway for Southeast Asian trade. NightSpire is a ransomware group active since early 2026. The group targets maritime, logistics, and critical infrastructure. The listing is live. The deadline is running. ☠️ NightSpire 将马来西亚港口运营商列入泄露网站 NightSpire 将丹戎帕拉帕斯港列入其泄露网站。上架列出了港口运营商名称，并设定了赎金截止日期。未披露数据清单。未发布证明文件。 丹戎帕拉帕斯港是马来西亚最大的集装箱港口。位于柔佛州。年吞吐量超过 1000 万标准箱。东南亚贸易的战略门户。NightSpire 是一个自 2026 年初活跃的勒索软件组织。该组织针对海事、物流和关键基础设施。 上架是活的。倒计时在走。 @bluchipnews

☠️ BYOD lists Royal Selangor BYOD added Royal Selangor to its leak site on October 5. 300,000 lines of data. Names, emails, phone numbers, addresses, purchase amounts, payment methods. The group posted one line with the listing: this is pretty juicy stuff you do not want getting out there. Royal Selangor is a Malaysian pewter manufacturer. Founded 1885. Annual revenue around $120 million. BYOD is a new group. Three victims on the board. The listing is live. The data is the pressure. The resale value of this data on the black market runs between $500,000 and $3 million. The group is new. The victim list is short. That is how they all start. ☠️ BYOD 将 Royal Selangor 列入泄露网站 BYOD 于 10 月 5 日将 Royal Selangor 列入其泄露网站。30 万行数据。姓名、电子邮件、电话号码、地址、购买金额、付款方式。该组织在帖子上留了一句话：这是你不想泄露出去的好东西。 Royal Selangor 是一家马来西亚锡器制造商。1885 年成立。年营收约 1.2 亿美元。BYOD 是一个新组织。公告板上有三个受害者。上架是活的。数据是压力。 这批数据在黑市上的转售价值在 50 万到 300 万美元之间。组织是新的。受害者名单很短。他们都是这样开始的。 @bluchipnews

☠️ The Gentlemen claim Center State Engineering The Gentlemen added Center State Engineering to its leak site on October 4. The victim is a civil engineering consultancy in Monroe Township, New Jersey. Roughly 15 employees. Municipal clients across central New Jersey. The group claims 340 GB taken, including project files, client records, and financial data. The Gentlemen offers affiliates 90 percent of paid ransoms. The industry standard is 70 to 80. The group has claimed more than 750 victims worldwide since mid-2025. Second most active RaaS program of the year. The core operator is a former Qilin affiliate who left after a payment dispute. The listing is a claim. The data is the pressure. ☠️ The Gentlemen 声称攻击 Center State Engineering The Gentlemen 于 10 月 4 日将 Center State Engineering 列入其泄露网站。受害者是新泽西州门罗镇的一家土木工程咨询公司。约 15 名员工。客户为中泽西各地的市政部门。该组织声称窃取了 340 GB 数据，包括项目文件、客户记录和财务数据。 The Gentlemen 向附属机构提供 90% 的赎金分成。行业标准是 70% 到 80%。自 2025 年中期以来，该组织已在全球声称超过 750 个受害者。今年第二活跃的勒索软件即服务项目。核心运营者是一名前 Qilin 附属机构成员，因付款纠纷离开。 上架是声称。数据是压力。 @bluchipnews

☠️ Base chain vault contract hacked, $6M stolen with $31.7M still at risk A treasury vault contract on the Base chain was compromised on October 5, 2026, resulting in the theft of $6 million. Attackers exploited a Safe multisignature wallet to add a malicious contract to the lending whitelist, draining 1,783 aBaswstETH. On chain analysis indicates the stolen funds were redeemed for 1,783 wstETH on Aave V3. The breach resulted from weak multisignature governance and inadequate access controls. The project team had not initiated any Safe transactions in the past 25 days, suggesting possible social engineering or internal collusion. Aave and the Base chain remain unaffected, but approximately $31.7 million in the vault is still at risk. The six is gone. The thirty one is still sitting there. ☠️ Base链金库合约被黑，600万美元被盗，3170万美元仍面临风险 2026年10月5日，Base链上一个金库合约遭到入侵，导致600万美元被盗。攻击者利用一个Safe多签钱包，将一个恶意合约添加到借贷白名单中，盗走1,783枚aBaswstETH。链上分析显示，被盗资金已在Aave V3上兑换为1,783枚wstETH。 此次入侵源于多签治理薄弱和访问控制不足。该项目团队在过去25天内未发起任何Safe交易，暗示可能存在社会工程攻击或内部勾结。Aave和Base链未受影响，但金库中约3170万美元仍面临风险。 六百万没了。三千一百万还在那里。 @bluchipnews

☠️ Tower Insurance named on ransomware leak site A ransomware group listed Tower Insurance on a cyber extortion leak site, claiming stolen data from the dual listed insurer. Tower confirmed it was aware of unverified information posted on cyber forums and is investigating with external cybersecurity consultants. Tower had 323,000 customers as of January 2026 and operates across New Zealand and the Pacific. A listing is a pressure tactic, not confirmation of a breach. The group holds the data. Tower holds the investigation. The group is holding the data. Tower is holding the statement. ☠️ Tower Insurance被勒索软件泄露网站点名 一个勒索软件组织将Tower Insurance列入网络勒索泄露网站，声称窃取了这家双重上市保险公司的数据。Tower确认知悉网络论坛上发布的未经证实的信息，正与外部网络安全顾问合作调查。 截至2026年1月，Tower拥有32.3万名客户，业务覆盖新西兰和太平洋地区。被列入泄露网站是一种施压手段，并非入侵确认。组织握着数据。Tower握着调查。 组织握着数据。Tower握着声明。 @bluchipnews

☠️ Hauts de France breach exposes 700,000 Two regional service providers, Atexo and Docaposte, were compromised. Names, emails, and potentially bank details were stolen. FrenchBreaches spotted the data on a cybercrime forum Saturday and cited 700,000 affected individuals. The stolen files include apprenticeship contracts, bank details, housing certificates, and data from Génération#HDF, a card program for high school students and apprentices. The region filed a complaint and closed the affected platforms. The exact number of victims remains unconfirmed. The platforms are closed. The data is on the forum. ☠️ 上法兰西大区数据泄露，70万人受影响 地区两家服务提供商Atexo和Docaposte遭入侵。姓名、电子邮件及可能的银行信息被盗。FrenchBreaches周六在一个网络犯罪论坛上发现了数据，称涉及70万人。 被盗文件包括学徒合同、银行信息、住宿证明，以及针对高中生和学徒的Génération#HDF卡片项目数据。地区已提出投诉并关闭受影响平台。确切受害人数尚未确认。 平台关闭了。数据在论坛上。 @bluchipnews

☠️ Hyundai Capital leak hits 146 loan brokers Hyundai Capital confirmed a hacking attack through an overseas IP address on its mortgage loan broker inquiry page around 5:08 PM on October 2. Data on 146 brokers was exposed, including names, mobile numbers, emails, Credit Finance Association registration numbers, internal broker IDs, and resident registration numbers. The company blocked the attacking IP and the page immediately. Formed an incident response task force. Reported to the Financial Supervisory Service and KISA at 3:30 PM on October 3. The attack follows breaches at Shinhan, KB Kookmin, Hana, and BNK Busan Bank. Authorities found traces of an AI powered penetration tool on attack servers linked to the broader campaign. The IP is blocked. The data is not. ☠️ 现代资本泄露事件，146名贷款经纪人受影响 现代资本确认，10月2日下午5时08分左右，其住房贷款经纪人查询页面通过海外IP地址遭到攻击。146名经纪人的数据被泄露，包括姓名、手机号码、电子邮件、信贷金融协会注册号、内部经纪人编号及居民登记号码。 公司立即封锁攻击IP和页面，成立事故响应工作组，于10月3日下午3时30分向金融监督院和KISA报告。此次攻击发生在新韩银行、KB国民银行、韩亚银行和BNK釜山银行遭入侵之后。当局在攻击相关服务器上发现了AI驱动渗透工具的痕迹。 IP被封锁了。数据没有。 @bluchipnews

☠️ Warlock abuses SharePoint flaws to drop ransomware Suspected China linked group Warlock weaponized Microsoft SharePoint vulnerabilities against critical infrastructure across Latin America, Europe, and Africa. Intruders breached on premises servers, collected ASP.NET machine keys, and executed arbitrary code inside application pools. Attackers terminated security software on 40 hosts within two hours using vulnerable drivers, then distributed ransomware to 33 machines through Windows SYSVOL replication. One compromised driver and two hours of work. Thirty three critical systems encrypted, delivered straight through Windows domain replication. ☠️ Warlock 利用 SharePoint 漏洞部署勒索软件 疑似具有中国背景的组织 Warlock 武器化微软 SharePoint 漏洞，针对拉美、欧洲和非洲的关键基础设施发起攻击。入侵者攻破本地部署的服务器，收集 ASP.NET machine key，并在应用程序池内执行任意代码。攻击者利用带漏洞的驱动在两小时内终止了 40 台主机的安全软件，随后通过 Windows SYSVOL 复制机制将勒索软件分发至 33 台机器。 一个受损的驱动和两小时的操作。三十三台关键系统被加密，直接通过 Windows 域复制完成分发。 @bluchipnews

☠️ Rats and Roaches Part 3 of 3: The Roaches The educator trains the next wave and funnels them to the vendor. The investigator feeds threat actors to the feds and builds a consulting book. The detective takes donations and collects from both. None were in the crew. None wore a badge. All sold someone. John Hammond taught cyber threat emulation and the adversarial mindset at the DoD Cyber Training Academy. Now Principal Security Researcher at Huntress. Huntress runs $250 million ARR and a $2 billion valuation. ZachXBT takes advisory work for Paradigm. Paradigm runs $12.7 billion under management. On January 18, 2026, the Hyperliquid Foundation transferred 10,000 HYPE tokens, worth $254,000, his second largest institutional donation. The intel economy and the crypto economy run on institutional money. The researcher sits between the criminals and the capital, selling to both. The industry covers the crime committed against institutions. It never covers the crime committed by them. The names change. The racket does not. They sold the room. They were never in it. --- ☠️ 老鼠与蟑螂 第三部分（共三部分）：蟑螂 教育者训练下一波人，把他们引向供应商。调查者把威胁行为者喂给联邦调查局，同时建立自己的咨询业务。侦探收捐赠，同时从两边收钱。都不在团伙里。都没戴过警徽。都卖了人。John Hammond 曾在国防部网络训练学院教授网络威胁模拟和对抗思维。现在是 Huntress 的首席安全研究员。Huntress 年经常性收入 2.5 亿美元，估值 20 亿美元。ZachXBT 为 Paradigm 做顾问工作。Paradigm 管理 127 亿美元资产。2026 年 1 月 18 日，Hyperliquid 基金会转账了 10,000 枚 HYPE 代币，价值 254,000 美元，他第二大的机构捐赠。情报经济和加密经济都靠机构资金运转。研究员坐在罪犯和资本之间，同时卖给两边。这个行业报道针对机构的犯罪。从不报道机构犯下的犯罪。名字会变。生意不变。他们卖了那个房间。他们从来不在里面。 @bluchipnews

☠️ Rats and Roaches Part 2 of 3: The Rack A malware as a service RAT rents for $250 a month. An infostealer subscription runs $1,024 annually. A DDoS for hire subscription starts at $45 a month. Bulletproof hosting is a $1 billion a year market. A bulletproof VPS runs $50 to $500 a month. Nuclear grade hosting runs $2,000 to $10,000 a month. The premium is the willingness to say no to law enforcement. Same rack, other shelf. A threat intel subscription. An incident response retainer. A conference ticket. A consulting day rate. Dark Web and Cybercrime Investigations, $125. Dark Web 2, CTI Researcher, $175. Put on the black hat of a researcher and use a hacker's toolset. One shelf sells the lock. The other sells the key that does not fit. --- ☠️ 老鼠与蟑螂 第二部分（共三部分）：货架 一个恶意软件即服务的 RAT 月租 250 美元。一个信息窃取器订阅年费 1,024 美元。一个 DDoS 即服务订阅月费 45 美元起。防弹托管是一个每年 10 亿美元的市场。一个防弹 VPS 月费 50 到 500 美元。核级托管月费 2,000 到 10,000 美元。溢价在于愿意对执法部门说不。同一个货架，另一层。一份威胁情报订阅。一笔事件响应预聘费。一张会议门票。一个咨询日费率。《暗网与网络犯罪调查》，125 美元。《暗网 2，CTI 研究员》，175 美元。戴上研究员的黑帽，使用黑客的工具集。一层卖锁。另一层卖配不上那把锁的钥匙。 @bluchipnews

☠️Triangle of Capital Part 3 of 3: The Sink The banking system is the biggest sink there is. Real estate. Luxury goods. Shell companies. Trusts. Art. Everything that holds value and asks nothing. $75 billion sits on chain, trapped. The exits are closing. The largest mixers combined process $10 million a day. Twenty years to clear the backlog. So the money waits. It cycles through smaller doors. It pays the spread. It moves in pieces. The sink is patient. It has always been patient. Binance moved $18.4 trillion in 2023. The US fined it $4.3 billion. The DOJ said it processed transactions for Hamas, al-Qaeda, ISIS, and sanctioned states. By volume, the penalty was 0.02 percent. The price of the door. ☠️ 资本三角 第三部分（共三部分）：沉没池 银行系统是最大的沉没池。房地产。奢侈品。空壳公司。信托。艺术品。一切保值且不问来源的东西。750亿美元困在链上，被困住。出口正在关闭。最大的混币器合计每天处理1000万美元。需要二十年才能清理积压。所以钱在等待。它通过更小的门循环。它支付差价。它分批移动。沉没池很有耐心。它一直都有耐心。 币安在2023年转移了18.4万亿美元。美国对其罚款43亿美元。司法部称其为哈马斯、基地组织、ISIS和受制裁国家处理了交易。按交易量计算，罚款为0.02%。这就是门的价格。 @bluchipnews

☠️Triangle of Capital Part 1 of 3: The Mix The shadow economy moves trillions a year. $2.68 billion in crypto theft year to date. $154 billion in illicit flow this year. None of it stays where it lands. It has to be mixed. Swapped. Moved. Made clean. Same as cash. Same as anything that needs to disappear. The banking system is the biggest sink there is. Always has been. Crypto just made the mixing faster. The chain does not care whose money it is. The banks do not either. The paperwork does. ☠️ 资本三角 第一部分（共三部分）：混合 影子经济每年流动数万亿美元。今年迄今为止加密货币被盗金额达26.8亿美元。今年非法资金流动达1540亿美元。这些钱不会停留在落地的任何地方。它必须被混合、兑换、转移、洗白。和现金一样。和任何需要消失的东西一样。银行系统是最大的沉没池。一直都是。加密货币只是让混合变得更快。 区块链不在乎这是谁的钱。银行也不在乎。在乎的是文书。 @bluchipnews

☠️ Shadow Economy Part 3 of 3: The industry The Gentlemen surged to second by victim count by April, claiming over 320 victims since mid 2025, 240 this year alone. Their affiliate split is 90 percent, against the standard 80. The 10 point gap pulled operators from every established brand. At the bottom, a no code ransomware kit sells for $400. BreachForums was the floor of the market. Its own database leaked in January 2026. 323,988 user accounts. BreachForums is back and live. Barrier to entry is $400. Qilin made $193 million. The distance between them is the industry. ☠️影子经济 第三部分：产业链 The Gentlemen 到4月升至受害者数量第二，自2025年中以来声称超过320个受害者，其中240个在今年。他们的附属分成是90%，高于行业标准的80%。这10个百分点的差距从所有老牌团伙拉走了操作者。最底层，一套无代码勒索软件卖400美元。BreachForums 曾是市场的底层。2026年1月，它自己的数据库泄露了。323,988个用户账户。BreachForums 回来了，还在运行。 入场门槛400美元。Qilin 赚了1.93亿美元。两者之间的距离，就是这个行业。 @bluchipnews

☠️Shadow Economy Part 2 of 3: The money that cannot move Illicit crypto activity hit $154 billion in 2026. Not a balance. A flow. Money in, money that has to go out. More than $75 billion of it is sitting on chain, trapped. Up 28 percent from a year earlier. The exits are the problem. The largest mixers combined can process at most $10 million a day. Roughly $3.65 billion a year. Against a $75 billion backlog, that is more than 20 years to clear. So the money moves sideways. More than 80 percent has already hopped one or two wallets from the original crime address. Every hop leaves a new record. Since May 2020, over $1.6 billion in mixer deposits flowed into crypto bridges. More than $900 million tied to one bridge linked to North Korean laundering. The money is not stuck because anyone stopped trying. It is stuck because the exits are closing faster than the money arrives. ☠️ 地下经济 第二部分：动不了的钱 2026年非法加密活动达1540亿美元。不是余额。是流量。钱进来，必须出去。其中超过750亿美元停留在链上，被困住。同比增长28%。问题出在出口。最大的混币平台合计每天最多处理1000万美元。一年约36.5亿美元。面对750亿美元的积压，需要20年以上才能清完。 所以钱只能横向移动。超过80%已经跳离原始犯罪地址一到两个钱包。每一次跳跃都留下新记录。自2020年5月以来，超过16亿美元的混币平台存款流入加密桥。其中超过9亿美元与一个与朝鲜洗钱相关的桥有关。钱被困住不是因为没人再试。是因为出口关闭的速度比钱进来的速度快。 @bluchipnews