Sable Index

LF: Active promoters (0.2$ each member joined via your custom link, bonus 1$ for each member joined with 200$+ worth nfts) Partnership to swap admins in our otcs/any chats where i can advertise Partnership to swap our audience with giveaway(50/50 budget) Contact: @username_698420 / @sableindexmanager

[EXPLAINED · CRIME] Scattered Spider Wins by Making Employees Open the Door Scattered Spider does not usually begin with an exotic software exploit. Its operators call a company’s help desk, sound convincing and persuade someone to hand them access.

That simple idea has produced extraordinary damage. In July 2026, the US Justice Department described the group as responsible for more than 100 network intrusions, over $100 million in ransom payments and millions more in disruption. The statement accompanied the extradition of 19-year-old Peter Stokes, an alleged member who has not been convicted. Scattered Spider is less a traditional gang than a shifting cybercrime network. Authorities and researchers also track parts of the same activity as Octo Tempest, UNC3944, 0ktapus and Muddled Libra. Those labels describe overlapping behavior, not a reliable membership list. The attack often starts with research. Criminals collect an employee’s name, role, phone number and internal vocabulary from social media, leaked databases and previous breaches. They then impersonate that employee to technical support, or pose as support when contacting the employee. The goal is a password reset and a new multifactor-authentication device. If persuasion fails, the attackers may flood the victim with login prompts, steal a one-time code or convince a mobile carrier to transfer the victim’s number to another SIM. No Hollywood-style hacking is required when the criminal can make the real support process work on their behalf. Once inside, the group frequently uses legitimate administration software such as AnyDesk, TeamViewer or ScreenConnect. These tools are common in real IT departments, so their presence alone may not trigger an alarm. The intruders steal data, move through cloud accounts and sometimes deploy ransomware. CISA says recent activity has included DragonForce. The 2023 MGM Resorts attack showed what this method can do. Hotel systems, digital room keys and casino operations were disrupted. MGM later estimated that the incident reduced quarterly earnings by roughly $100 million. The attackers did not need to defeat every security product; they needed an identity trusted by those products. The network also appears willing to move quickly between targets and monetization methods. A 2026 US complaint alleges that Stokes and accomplices demanded about $8 million from a jewelry retailer. The company expelled them and paid nothing, yet still recorded at least $2 million in response and disruption costs. Arrests matter, but they do not automatically dismantle Scattered Spider. A loose network can replace an operator, reuse stolen access and reorganize under another name. Its most valuable capability is fluent, patient social engineering - not a single server that police can seize.

The uncomfortable lesson is that an employee can follow a familiar support procedure and still open the door. Strong defenses require phishing-resistant security keys, strict identity checks for password resets and callbacks through a known company number. A convincing voice should never be enough to transfer control of an account. @SableIndex | @SableIndexDiscussion

[MALWARE] Microsoft Patches 400 Flaws After Lazarus Zero-Day Attacks Microsoft released security updates for 400 vulnerabilities, including a Windows zero-day already exploited by North Korea’s Lazarus group. After gaining local access, attackers can exploit the flaw without further user interaction, obtain SYSTEM privileges and deploy a stealthy rootkit. Two more zero-days were publicly disclosed, while 42 vulnerabilities were rated critical. @SableIndex | @SableIndexDiscussion

[RANSOMWARE] CISA Confirms SharePoint Flaw Is Fueling Ransomware Attacks CISA says ransomware gangs are now exploiting a SharePoint Server flaw that lets attackers run code on unpatched systems. More than 200 internet-exposed servers remained vulnerable when checked by Shadowserver. The flaw can be exploited with low privileges and little complexity. @SableIndex | @SableIndexDiscussion

[BREACH] Mozilla Replaces Firefox Signing Key After GitHub Exposure Mozilla replaced the GPG key used to verify some Firefox and Thunderbird releases after an unencrypted copy was committed to a private GitHub repository. Linux users who installed Firefox through RPM packages should run system updates; most users need no action. Mozilla revoked the old key and found no evidence of unauthorized access. The exposed key signed Linux tarballs, RPM packages and checksum files - not standard browser updates. @SableIndex | @SableIndexDiscussion

[BREACH] BdThemes WordPress Plugins Create Hidden Admins After Supply-Chain Hack Researchers say attackers compromised BdThemes’ update infrastructure and used malicious code to create rogue administrator accounts on WordPress sites. The Element Pack plugin has over 100,000 active installs. The plugins were pulled from WordPress.org on Aug. 8. The injected code could install a webshell without requiring a plugin update or user click. @SableIndex | @SableIndexDiscussion

[CRIME] Com Member Sentenced After Sextortion of Nearly 120 Victims A member of “The Com” was sentenced to two years in prison after blackmailing and sexually extorting nearly 120 victims worldwide. The victims included children and teenagers. The case shows how online coercion has become organized cybercrime, not just isolated harassment. @SableIndex | @SableIndexDiscussion

[DEVELOPING · RANSOMWARE] CISA Warns Gunra Ransomware Now Targets Global Organizations CISA, FBI and partners issued a new warning today about Gunra, a ransomware service used by affiliates across the Americas, Europe, Middle East, Africa and Asia-Pacific. Gunra encrypts files, steals data, then threatens to publish it. Investigators say attackers often move from a compromised VPN to the wider network within days. @SableIndex | @SableIndexDiscussion

[DEVELOPING · BREACH] Valve Warns Steam Hardware Buyers After Logistics Hack Valve began notifying Steam hardware customers today that a cyberattack at shipping partner CEVA exposed names, addresses, phone numbers, emails, and order details. Attackers accessed CEVA systems from July 29 to Aug 1; Valve says passwords, Steam Guard codes, and payment data were not exposed. The stolen delivery data can make phishing look genuine. @SableIndex | @SableIndexDiscussion

[MALWARE] Kimsuky Uses Local AI to Sharpen Phishing Attacks A North Korean group is using local AI to sharpen phishing; finance-themed ZIP attachments can hide Windows shortcuts that launch PowerShell malware. Genians identified the group as Kimsuky in an Aug. 9 report, saying local LLMs help process stolen documents and scale lures. It found Ollama, GPT4All and Msty, plus Git-hosted AsyncRAT payloads. @SableIndex | @SableIndexDiscussion

[DEVELOPING · BREACH] Report Says Coinsbuy Wallets Emptied Across Two Chains A report says wallets linked to Coinsbuy were emptied around 13:00 UTC; the total exceeds $7.9M. If you use Coinsbuy, wait before making a transfer; check balances and activity. Dark Web Informer attributed the claim to analyst SpecterAnalyst, who linked transfers through several exchanges toward Monero, a privacy-focused coin. Deposits and withdrawals were paused after the incident and later restored, according to the report. Coinsbuy’s news page showed no incident notice. @SableIndex | @SableIndexDiscussion

[MALWARE] Fake Odyssey Downloads Hide Password-Stealing Malware Bitdefender found fake Windows copies of The Odyssey carrying Lumma Stealer that can steal passwords, payment data, browser sessions and crypto wallets. If a movie download asks you to run an .exe, stop - a video file should not need an installer. The campaign uses “1080p WEBRip” and “Blu-ray” filenames, VLC-like icons and hidden .exe extensions to look harmless. Stolen session cookies can let criminals enter accounts even when MFA is enabled. @SableIndex | @SableIndexDiscussion

[FRAUD] Fake Jury-Duty Calls Drain Florida Family of $25,000 Scammers posing as sheriff’s deputies told a Florida woman she had missed jury duty and faced arrest unless she paid. The callers used real personal details, spoofed caller ID and fake warrants, then kept her on the phone for hours. WSJ reports the family ultimately lost $25,000 in cryptocurrency. @SableIndex | @SableIndexDiscussion

[FRAUD] WhatsApp “Hello” Lured an Accountant Into a $2.5M Crypto Scam Police arrested a BJP leader after tracing ₹50 lakh in a scam that allegedly cost a 70-year-old accountant ₹21.06 crore. A WhatsApp contact led him to a fake trading platform, allowed one withdrawal, showed profits above ₹33 crore, then demanded fees. He made 106 transfers to 76 accounts; police found 15 laundering layers and froze about ₹2 crore. @SableIndex | @SableIndexDiscussion

[BREACH] Framework Warns Customers After Metabase Breach Exposes Contact Data Framework said hackers stole customers’ names, email addresses, phone numbers and physical addresses through a Metabase attack. Framework notified every customer and said payment information was not included. Metabase said attackers used an unknown flaw a zero-day to access its cloud service. @SableIndex | @SableIndexDiscussion

[MALWARE] Fake CAPTCHA Tricks Mac Users Into Installing Wallet-Stealing Malware Fake CAPTCHA pages trick Mac users into pasting a Terminal command that starts a password- and wallet-stealing infection.

- The fake CAPTCHA is not a test. It asks the victim to run the malware manually. - The command downloads a script, profiles the Mac and fetches a version built for its processor. - It steals browser passwords, can prompt for the Mac password, and can drain wallets.

@SableIndex | @SableIndexDiscussion

[DEVELOPING · MALWARE] Suisun City Shuts Down Network After Malware Disrupts 911 Suisun City shut down the IT network after malware disrupted 911 routing, police and fire dispatch at 05:45 on 7 August. Emergency calls were rerouted through Solano County; police and firefighters kept responding while online services and internal operations went offline. The city council declared a state of emergency on Saturday. The FBI, Homeland Security and California emergency officials are investigating. @SableIndex | @SableIndexDiscussion

[FRAUD] Trezor User Loses $7 Million in Seed-phrase Phishing Scam A crypto user lost 113 BTC worth about $7 million after entering a seed phrase on a fake Trezor website. The site reportedly appeared as a sponsored Google result, turning an ordinary search into the attacker's delivery channel. @SableIndex | @SableIndexDiscussion

🎉 $33x3 🎉

To Participate: • Join @SableIndex • Join @SableIndexOTC • Tap Participate

⬜ Participants: 0 Winners: 3 Giveaway Ends In: 6d 23h 59m

[DEVELOPING · CRIME] More Than 20 Arrested in Russian Crypto-Laundering Crackdown Russian authorities arrested more than 20 people in a crackdown on a network accused of laundering cryptocurrency. The case shows how “just receive and forward the coins” can turn an ordinary wallet into part of a criminal trail. @SableIndex | @SableIndexDiscussion