ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ

Revolutionary Che Guevara was executed on 9 October 1967. “If you tremble with indignation at every injustice than you are a comrade of mine.”

On 9 October 1967, CIA goons have executed a revolutionary hero of the world, Che Guevara.

To the Collective — A Message from One of Your Own To every ghost, collective, cell, team and lone wolf who answered the call after October 2023. You know who you are. The world may not. That was always the point. The Front Lines Telegram and X served as primary coordination platforms — where operations were announced, targets disclosed, and information propagated faster than any takedown could suppress. From there, the message dispersed across Instagram, Facebook, TikTok, and YouTube. It could not be contained, because it was never yours to contain. It belonged to everyone. The Cost of Engagement Retaliation came swiftly. Channels terminated. Accounts suspended. Telegram and Twitter absorbed the heaviest losses, followed by TikTok and Instagram. Some operators vanished permanently. Others reappeared under new handles, new identifiers — same mission. And some were arrested, extracted from their keyboards into spaces where no exploit executes, no proxy conceals, no encryption protects. To those in custody: you are neither forgotten nor reduced to a statistic. What you demonstrated was a rare form of resolve — the kind that persists when every exit has been closed. Your families carry a burden no one should bear. We see them. We remember them. The Activists — Also of the Collective And to the activists — the digital organizers, the archivists, the livestreamers, the ones who amplified every operation and documented every atrocity. Cyber activists are not separate from this collective; you are its backbone. You turned raw data into testimony, testimony into momentum, and momentum into a global movement that no algorithm could silence. When accounts fell, you rebuilt. When reach was throttled, you adapted. You did not exploit a single system, yet you breached the strongest firewall of all — the wall of silence. You are seen. You are counted. You are part of this. The Scale of What Was Achieved Operation Israel became the largest cyber campaign in internet history. This is not hyperbole — it is documented fact. Prior to October 2023, the Russia–Ukraine campaign held that position. After, it was eclipsed. Thousands of coordinated actions: defacements, data leaks, DDoS operations, disclosures, breaches — an unrelenting flow of truth that no firewall could fully scrub. No state sponsored you. No budget funded you. You operated on conviction and connectivity alone. What Is Owed No one compensated you. Not a single dollar, not a single dinar. Your work was a gift to every freedom-loving person on this planet. Your effort was oxygen to people suffocating under occupation and siege. That is not flattery. That is simply accurate. We may never know your names. You may never know ours. But we thank you. And we remember you. In Closing History will remember. The internet will remember. Logs never truly die — and neither does what you accomplished. Stay dark. Stay operational. Stay free. — Yara Tabet (The Ghost In The Machine) October 7th 2026 @TheGhostITM

Azerbaijan’s State Security Service warned that organized cybercriminals are using AI to create convincing phishing messages and fraudulent government websites.

NEC plans to connect its operations centers in Japan, the United States, and Europe to provide round-the-clock global cyber-threat monitoring from July 2027.

Azerbaijan, Türkiye, and Uzbekistan held their first joint cyber exercise, “Power of Unity 2026,” in Karabakh, focusing on cyberattacks, drone threats, and disinformation.

Cling hides C2 commands in STUN traffic as threat actors were observed attempting to exploit Realtek Jungle SDK flaw CVE-2021-35394. A subset of that activity delivered the botnet.

Exchange admins should review this now. CVE-2026-96940 can allow an authenticated attacker to access other users’ mailboxes and read emails and attachments within the same organization.

ClickFix has a new trick... the malicious payload is already sitting in your browser cache before you paste the command. Compromised sites preload scripts disguised as PNGs, letting pasted commands bypass Windows Run's ~260-character limit and launch a multi-stage malware chain.

The strongest weapon is not a gun it's fearless mind - Che Guevara

The resistance is a permanent national necessity that should last as long as the Israeli threat, and in the absence of a strong, stable state in Lebanon.

Named recipients in that pool included conservative creator Nick Shirley, former swimmer and Fox News contributor Riley Gaines, progressive commentator Brian Krassenstein, conservative influencer Alex LoRusso, and “Street Poller” operator Shane Ginsberg, who reportedly received at least $77,000. About two dozen creators posted roughly 490 times about Polymarket after receiving money, many without clear “paid partnership” disclosures. While Brazilian stories did not explicitly tie the Brazil-focused posts to Modabber’s PayPal ledger, they fit the same pattern: Polymarket-linked money flowing to right-wing creators, who then use Polymarket odds as political ammunition abroad. In Brazil, election-related betting is not authorized. Since April 2026, the Finance Ministry has treated Polymarket’s political contracts as illegal, and in late September 2026 the government secured the removal of Polymarket’s Portuguese-language Instagram profile and broader access restrictions via Meta. Despite the block, Polymarket odds continued to circulate in Brazilian social media, effectively shaping the online narrative around the election even as the platform itself was barred.[4] Why the rightward tilt? The Brazil episode reflects both Polymarket’s ownership incentives and its political network: - Major investors and advisers (ICE, Trump Jr., 1789 Capital) are closely tied to U.S. conservative finance and politics. - Coplan’s outreach has been more successful with Republicans, and the platform’s influencer program leans heavily on right-wing, Trump-aligned creators. - Those same influencers then reuse Polymarket data as campaign-style content abroad, as seen in the coordinated pro-Bolsonaro push. The result is a feedback loop: Polymarket funds and amplifies right-wing voices; those voices treat Polymarket odds as political ammunition; and in markets like Brazil, that dynamic skews the perceived momentum of right-wing candidates regardless of local electoral rules. "Polymarket’s chief marketing officer, Matthew Modabber, used a personal PayPal account to send more than $2.5 million to over 800 people over 14 months, with at least $350,000 going to influencers who promoted Polymarket on X; Mario Nawfal was one of them." #TGITM

Who owns Polymarket—and why its Brazil narrative leans right By TGITM Polymarket is owned primarily by its founder, American entrepreneur Shayne Coplan, and a small group of private investors, with the largest outside stake held by Intercontinental Exchange (ICE), the parent company of the New York Stock Exchange. This ownership structure—combined with explicit ties to Trump-aligned figures and a sprawling paid-influencer network—helps explain why the platform’s coverage of Brazil’s 2026 election has amplified right-wing narratives around Flávio Bolsonaro. Ownership and control Polymarket operates as Blockratize Inc., a Delaware-registered company founded in 2020 by Shayne Coplan, who remains CEO and the largest individual shareholder. While Coplan’s exact stake is not fully public, reports place it around 11%, making him a billionaire after ICE’s 2025 investment. The most consequential outside investor is Intercontinental Exchange, which committed up to $2 billion in October 2025 at an $8–9 billion valuation. As of mid-2026, ICE’s preferred shares represented roughly 22% of Polymarket’s outstanding shares (about 14% on a fully diluted basis). Other notable backers include crypto and traditional venture firms such as Founders Fund, General Catalyst, and 1confirmation, as well as 1789 Capital, the investment firm linked to Donald Trump Jr. Trump Jr. also serves on Polymarket’s advisory board, and his firm 1789 Capital has invested heavily in the platform—reports cite figures around $300–500 million. Coplan himself is described as close to the Republican wing led by Vice President J.D. Vance, and The Wall Street Journal has reported that Polymarket found more traction with Republicans than Democrats when seeking political partnerships. Internationally, Polymarket’s platform has been associated with a Panama-based entity, Adventure One QSS, though the core company and leadership remain U.S.-based. The Brazil narrative: Trump-aligned amplification In September 2026, Brazilian media documented a coordinated push on X (formerly Twitter) to promote Flávio Bolsonaro’s rising odds on Polymarket as though they were polling data. Folha de S.Paulo counted at least 11 foreign accounts—many explicitly aligned with Trump and the MAGA movement—running paid posts that highlighted Bolsonaro’s surge in Polymarket markets. These accounts fell into two groups: - Influencers tied to Trump’s ecosystem, including former Republican congressman Matt Gaetz and U.S.-based creator George Behizy. - “News-style” profiles with a geopolitical focus, such as Florida-based UHN Plus, which describes itself as “powered by Polymarket” and is linked to a right-wing media network operating across Latin America. The posts, marked as paid partnerships but often without clear disclosure of the payer, presented Polymarket prices as evidence of Bolsonaro’s momentum, sometimes conflating them with real voter surveys. One Behizy post claimed, “Flávio Bolsonaro remains on the rise, despite all the last-minute lies spread by Lula’s communist government,” while Gaetz framed Bolsonaro as a hemispheric “grand prize.” Payments, blocks, and regulatory friction Polymarket reportedly paid at least $350,000 to influencers and creators between January 2025 and February 2026, according to U.S. reporting cited by Brazilian outlets. A POLITICO investigation expanded that picture: Polymarket’s chief marketing officer, Matthew Modabber, used a personal PayPal account to send more than $2.5 million to over 800 people in 14 months, with at least $350,000 going to influencers who promoted Polymarket on X, often without proper sponsorship labels.

ShinyHunters was also responsible for a massive data-theft attack on Instructure Canvas in May that triggered significant platform outages. The company ultimately reached a "deal" with the threat actors to prevent the stolen data from being published online. Over the years, multiple arrests have been tied to the ShinyHunters name, including suspects connected to Snowflake data-theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum. Who is Rey? The threat actor known as Rey has been associated with numerous data theft and extortion attacks over the past two years. In January 2025, Rey was one of four threat actors who claimed responsibility for a breach of Telefónica's internal Jira ticketing system, in which approximately 2.3GB of documents, tickets, and other data were allegedly stolen. Rey and two of the other attackers were members of the then-emerging HellCat ransomware operation. The actor was later linked to a broader series of attacks targeting Jira servers at organizations worldwide. In February 2025, Orange confirmed that its Romanian operations were hit by a cyberattack after Rey leaked approximately 6.5GB of stolen data. Rey stated at the time that he was a member of HellCat but had carried out the Orange breach independently. Rey was subsequently linked to the ShinyHunters extortion group and was seen holding administrative privileges in Telegram channels run by "Scattered Lapsus$ Hunters." Scattered Lapsus$ Hunters first appeared in 2025 and claimed to be composed of former members of the Lapsus$, Scattered Spider, and ShinyHunters cybercrime groups. The collective claimed responsibility for the September 2025 cyberattack on Jaguar Land Rover that forced the automaker to halt production for weeks and ultimately cost the company more than $220 million. Rey was also connected to an earlier March 2025 breach of Jaguar Land Rover, in which the actor leaked gigabytes of data, including Jira issues, source code, employee information, and development logs. In November 2025, Rey's real identity — Saif Al-Din Khader — was confirmed after analysis of infostealer logs and direct communication over Signal. Khader stated he was trying to distance himself from Scattered Lapsus$ Hunters and claimed he had been cooperating with law enforcement since at least June. "I'm already cooperating with law enforcement," Khader stated. "In fact, I have been talking to them since at least June. I have told them nearly everything. I haven't really done anything like breaching into a corp or extortion related since September." Those claims could not be independently verified. #TGITM

ShinyHunters Suspect Detained in Jordan, Assisting FBI By TGITM A member of the ShinyHunters extortion collective, operating under the handle "Rey," has reportedly been taken into custody in Jordan and is now cooperating with the FBI to help identify and locate remaining members of the group. Jordanian officials detained Rey — identified as Saif al-Din Khader — earlier this week, with sources confirming his arrest took place on Tuesday. Those familiar with the matter say Khader is actively assisting the FBI and other international law enforcement bodies in tracking down fellow members. According to one source, Khader is guiding investigators through his devices and digital correspondence to help pinpoint his alleged accomplices. "His cooperation is essential to the ongoing effort to bring these hackers to justice," the source stated. The reported detention arrives as the FBI intensifies its pursuit of ShinyHunters following the group's cyberattack on the bureau itself. In September, ShinyHunters claimed it compromised FBI systems by exploiting an alleged Oracle PeopleSoft zero-day flaw, then moved laterally into FBI-managed AWS GovCloud environments. The attackers claimed to have exfiltrated between 2TB and 3TB of data, including records tied to current and former FBI personnel, job applicants, medical and psychiatric information, and internal service records. The FBI previously acknowledged it was investigating reports of unauthorized activity but did not confirm any data exfiltration. Following the FBI breach, Dutch police arrested a 24-year-old man from Amsterdam on September 15 as part of the ShinyHunters investigation. The suspect was identified as Pepijn van der Stap, who previously operated under the alias "Umbreon." After that arrest, the FBI issued a public warning to other ShinyHunters members, urging them to surrender voluntarily, noting that investigators were still working to identify those involved. "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left," said Brett Leatherman, Assistant Director of the FBI Cyber Division. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours." The group's primary spokesperson continued communicating with media outlets after van der Stap's arrest, indicating that individual was not the one running that messaging account. On Tuesday — the same day Khader was reportedly detained — early signs of disruption emerged within the ShinyHunters operation. An alleged ShinyHunters affiliate who had previously reached out to media regarding the FBI attack and a recent Clop ransomware data breach abruptly closed their online messaging account. Shortly after, the ShinyHunters data leak site went dark, and the group's main representative also ceased responding to inquiries from journalists. It remains unclear whether the sudden silence and shutdown of ShinyHunters-linked infrastructure are directly tied to Khader's reported detention. However, by Thursday, a new ShinyHunters data leak site was back online, suggesting other members are still running the extortion operation. TGITM reached out to ShinyHunters regarding Rey's reported detention but received no response. The ShinyHunters gang has long been a persistent threat to law enforcement, carrying out large-scale data theft and extortion campaigns against organizations around the world. In recent years, the group has focused heavily on Salesforce and other cloud SaaS environments, with campaigns linked to breaches at Google, Cisco, and PornHub. The group typically compromises third-party integration firms and leverages stolen authentication tokens to access connected SaaS platforms and extract customer data.

Operation KillSwitch Dismantles KillSec Ransomware Gang; 16-Year-Old Alleged Leader Arrested ALICANTE, Spain — An international law enforcement operation has dismantled the KillSec ransomware group and arrested a 16-year-old suspected of running it, authorities said. The teen was taken into custody in Alicante, Spain, and identified as the group’s main administrator and operator. The operation, led by German police in Hamburg, involved authorities from Belgium, the United States, Finland, Greece, the Netherlands, Spain, Switzerland, the United Kingdom, Europol, and Eurojust. Two other suspects were arrested: one in the United Kingdom, identified as Dutch national Fouad Eltibrizi, and one in Romania. As part of the takedown, investigators seized KillSec’s dark web leak site, replacing it with a law enforcement seizure notice. Five central servers were brought under police control, including the group’s main server and infrastructure used to store stolen data. At least 110 terabytes of stolen data were secured to prevent further unauthorized access. The investigation covers approximately 1,000 suspected attacks worldwide, with about 500 identified as successful so far. At least 70 attacks have been linked to organizations in Germany, including 18 cases connected to Hamburg. KillSec launched its ransomware-as-a-service platform in June 2024, charging affiliates a $250 entry fee and allowing them to keep 88% of successful ransom payments. The group exploited software vulnerabilities and poorly secured edge devices to breach corporate systems, steal sensitive data, and extort victims through its leak site. Investigators also found that members used artificial intelligence to help build and maintain their ransomware infrastructure. Authorities said the probe remains ongoing. Victims and organizations that may have been affected are encouraged to contact law enforcement. #TGITM @TheGhostITM

An Iranian national who was indicted in the United States for hacking hundreds of organizations was extradited from Montenegro this week. Acting on an FBI-issued arrest warrant, Montenegrin authorities arrested the individual—a dual citizen of Turkey and Iran—on June 25. The suspect is accused of taking part in numerous cyberattacks against US organizations beginning in 2013. The attacks caused more than $3.4 billion in losses. Montenegrin authorities did not identify the individual by name, but gave his initials, A.B., and said he is 40 years old. According to the indictment, the suspects launched attacks against 144 universities in the US and 178 abroad, 42 private companies in the US and 11 abroad, five US government agencies, and at least two NGOs. The individuals stole over 31 terabytes of scientific resources, including academic data and intellectual property, as well as employee email accounts. The stolen information was given to the Iranian government and sold to Iranian universities. The US government is offering rewards of up to $10 million for information on five of the Iranian hackers: Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh. Extraditions of Iranian hackers to face trial in the US are extremely rare, because hackers usually operate from inside Iran and avoid traveling to jurisdictions with US extradition treaties. #TGITM @TheGhostITM

Microsoft Report: Rise in Cyberattacks Against the Zionist Regime According to Microsoft’s annual report, the Zionist regime (Israel) was the world’s second most-targeted entity for cyberattacks in the first half of 2026, accounting for 7.6% of recorded attacks. · The United States ranked first with 25.5%, while Ukraine and Taiwan placed after the Zionist regime. · Microsoft claims that 39% of one tracked cyber threat cluster’s activity targeted the Zionist regime. The United States followed at 23%, and the UAE at 9%. · The report says this activity included cyber espionage, disruption attempts, and destructive attacks. Attackers used methods such as phishing, credential theft, and exploitation of vulnerabilities. The findings highlight how geopolitical tensions continue to shape the global cyber threat landscape, attackers increasingly targeting government, defense, critical infrastructure, and technology sectors. Microsoft’s telemetry indicates that attackers are combining espionage with disruptive operations, aiming to gather intelligence, weaken response capacity, and create psychological impact. The report also points to a growing use of credential theft and vulnerability exploitation — techniques that make it easier for attackers to get their first foothold inside a system and then carry out more damaging attacks from there. #CyberAttack #CyberWar #Iran #ZionistRegime #Microsoft #TGITM @TheGhostITM

Chong Lua Dao (CLD) is a Vietnamese non-profit founded in 2020 by Ngô Minh Hiếu (Hieu PC). Hacker was arrested in 2013 and later extradited to the U.S. for an identity-theft operation affecting about 200 million Americans. After serving a 13-year sentence, he returned to Vietnam in 2020, joined the Vietnam National Cybersecurity Center, and became a white-hat defender. CLD combines a small analyst team with over 200 volunteers. Its API processes over one million daily queries, and it has detected over 1.4 million malicious websites. Its work has been cited in UNODC reports on Southeast Asian cybercrime. I note this background because it illustrates how diverse paths can lead to threat intelligence—and because a good analyst verifies sources, including a founder’s public record. Trends and Implications for Analysts Three trends stand out. First, consolidation: AlienVault into LevelBlue, Webroot into OpenText, and many smaller feeds into larger platforms. Second, the rise of non-profit and community feeds like CLD, URLhaus, and PhishTank, which fill gaps left by commercial vendors. Third, the shift to AI-driven detection, seen in OpenPhish, SOCRadar’s agentic AI, and Criminal IP. For analysts, this means vendor verdicts are signals, not verdicts. Always check the scan date, the vendor’s regional focus, and whether the detection is heuristic or signature-based. A “Clean” result from a single engine proves little. Becoming a Security Analyst A degree helps, but certifications and hands-on skills often matter more. Start with CompTIA Security+, then CySA+ for SOC roles, and GIAC GCTI for threat intelligence. Learn networking, operating systems, SIEM tools, Python, MITRE ATT&CK, and the Cyber Kill Chain. Practice on TryHackMe, Hack The Box, CyberDefenders, and LetsDefend. Join CTFs, follow open-source intelligence feeds, and build a public portfolio. Ethics and legal boundaries are non-negotiable. These vendors form the global threat intelligence ecosystem. Whether you want to join them or simply read their verdicts more accurately, understanding who they are—and what they do not tell you—is the first step. Disclosure: I have no financial relationship with any vendor mentioned. This article is for educational purposes and does not constitute endorsement. Some vendor claims are from company marketing and should be independently verified. @TheGhostITM #TGITM