Bluchip News
Kanalga Telegram’da o‘tish
For the underground by the underground Death before dishonor We tell you half the story, the rest you fill in. As long as the villain wins.
Ko'proq ko'rsatishMamlakat belgilanmaganToif belgilanmagan
Ma'lumot yo'q
Obunachilar
Ma'lumot yo'q24 soatlar
+277 kun
+64830 kun
Ma'lumotlar yuklanmoqda
O'xshash kanallar
Ma'lumot yo'q
Muammo bormi? Iltimos, sahifani yangilang yoki bizning qo'llab-quvvatlash boshqaruvchimizga murojaat qiling>.
Taglar buluti
Ma'lumot yo'q
Muammo bormi? Iltimos, sahifani yangilang yoki bizning qo'llab-quvvatlash boshqaruvchimizga murojaat qiling>.
Kirish va chiqish esdaliklari
---
---
---
---
---
---
Obunachilarni jalb qilish
Oktabr '26Okt '26
Oktabr '26
+657
5 kanalda
Sentabr '26
+1
1 kanalda
| Sana | Obunachilarni jalb qilish | Esdaliklar | Kanallar | |
| 11 Oktabr | +3 | |||
| 10 Oktabr | +5 | |||
| 09 Oktabr | +8 | |||
| 08 Oktabr | 0 | |||
| 07 Oktabr | +1 | |||
| 06 Oktabr | +2 | |||
| 05 Oktabr | +7 | |||
| 04 Oktabr | +10 | |||
| 03 Oktabr | +7 | |||
| 02 Oktabr | +13 |
Kanal postlari
☠️ Bridges of Power Part 3 of 3: The Vacuum
The largest active guarantor in the Chinese speaking underground was sanctioned in September 2026. Xinbi processed $24 billion. Tether froze $39.27 million across 10 Tron addresses. The U.S. Secret Service froze $52.8 million across 52 wallets. OFAC designated it a significant transnational criminal organization. Telegram deleted its channels.
Xinbi is not gone. But it is not the bridge anymore. The merchants are leaving. Withdrawals surged. $1.28 million moved out on September 8. $1.81 million on September 9. A rival, Fulilai, started removing money laundering merchants from its public groups before the sanctions reached it.
Nobody has taken the seat. That is the vacuum.
Dabai Guarantee is running thousands of groups. Tiancheng owns the channels it bought from Tudou. Ouyi and Timi are competing for the same vendors. But none of them has absorbed the traffic the way Tudou absorbed Huione's, or the way Xinbi absorbed Tudou's. The migration is happening in pieces. The seat is empty.
The vacuum is not new. It happened when Huione fell. It happened when Tudou wound down. Each time, the traffic moved within weeks. This time it has not. The merchants are spread across smaller names. The trust is fragmented. The bridge is not rebuilt yet.
No operator was arrested. The channels got banned. The operators walked. Huione handed the traffic to Tudou. Tudou handed it to Xinbi. Xinbi hands it to whoever takes the next deposit. The function never fell. Only the name did.
The seat is always open. The seat was never the point.
The game never stops.
Stay tuned for our next series.
Forums, Jesters and Princes.
Who fills the seat. Tell us in the chat.
☠️ 权力之桥 第三部分（共三部分）：真空
中文地下世界最大的活跃担保方在 2026 年 9 月被制裁。Xinbi 处理了 240 亿美元。Tether 冻结了 10 个 Tron 地址上的 3927 万美元。美国特勤局冻结了 52 个钱包中的 5280 万美元。OFAC 将其指定为重要的跨国犯罪组织。Telegram 删除了它的频道。
Xinbi 没有消失。但它不再是那座桥。商户正在离开。提现激增。9 月 8 日转出 128 万美元。9 月 9 日转出 181 万美元。一个竞争对手 Fulilai 开始在制裁波及之前将洗钱商户从其公共群组中移除。
没有人接过那个位置。这就是真空。
Dabai Guarantee 运营着数千个群组。Tiancheng 拥有从 Tudou 买来的频道。Ouyi 和 Timi 在争夺同样的商户。但它们中没有一个像 Tudou 吸收 Huione 那样、或像 Xinbi 吸收 Tudou 那样吸收流量。迁移正在碎片化地进行。位置是空的。
真空不是新事。Huione 倒下时发生过。Tudou 关闭时发生过。每次，流量在几周内移动。这次没有。商户分散在更小的名字之间。信任是碎片化的。桥还没有被重建。
没有运营者被逮捕。频道被封禁。运营者走了。Huione 把流量交给了 Tudou。Tudou 交给了 Xinbi。Xinbi 交给下一个接受押金的人。功能从未倒下。只有名字倒下。
位置永远是空的。位置从来不是重点。
游戏永不停止。
敬请关注我们的下一系列。
Forums, Jesters and Princes.
谁接过这个位置。在聊天里告诉我们。
@bluchipchat
@bluchipnews
| 2 |  ☠️ Shai-Hulud worm infects AI agent SDK, steals cloud credentials
A malicious version of the tensorlake npm package runs a preinstall hook that harvests CI, Kubernetes, and Vault credentials. The worm resolves its command and control server through an Ethereum contract, with a GitHub fallback. It self-propagates through npm and GitHub. Socket flagged the package within 11 minutes. The credentials were already gone. This is the Shai-Hulud lineage targeting AI agent infrastructure. The attacker is not in custody.
The package was live for 11 minutes. The credentials are gone.
☠️ Shai-Hulud 蠕虫感染 AI 代理 SDK，窃取云凭证
tensorlake npm 包的恶意版本运行一个预安装钩子，收集 CI、Kubernetes 和 Vault 凭证。该蠕虫通过以太坊合约解析命令与控制服务器，并以 GitHub 作为备用。它通过 npm 和 GitHub 自我传播。Socket 在 11 分钟内标记了该包。凭证已经没了。这是针对 AI 代理基础设施的 Shai-Hulud 谱系。攻击者未被抓。
包只上线了 11 分钟。凭证已经没了。
@bluchipchat
@bluchipnews | 279 |
| 3 |  ☠️ BreachFrame claims 1.2TB from Italian luxury group Brioni
A ransomware crew tracked as BreachFrame listed Italian luxury fashion group Brioni on its leak site on October 10. The group claims 1.2 TB taken, including client order histories, supplier contracts, and internal financial records. Brioni is owned by Kering, the parent company of Gucci and Balenciaga. The group set a 72-hour deadline. Kering has not commented. BreachFrame emerged in August 2026 and has claimed four victims. The attacker is not in custody.
The deadline is set. Kering is silent.
☠️ BreachFrame 声称从意大利奢侈品牌 Brioni 窃取 1.2TB
一个被追踪为 BreachFrame 的勒索软件团伙于 10 月 10 日将意大利奢侈时尚集团 Brioni 列入其泄露网站。该组织声称窃取了 1.2 TB 数据，包括客户订单历史、供应商合同和内部财务记录。Brioni 由 Kering 拥有，Kering 是 Gucci 和 Balenciaga 的母公司。该组织设定了 72 小时截止日期。Kering 尚未发表评论。BreachFrame 于 2026 年 8 月出现，已声称四个受害者。攻击者未被抓。
截止日期已设定。Kering 沉默。
@bluchipchat
@bluchipnews | 269 |
| 4 |  ☠️ Tornado Cash withdrawal opens $25M BTC short at 40x
A wallet received 263 ETH from Tornado Cash on October 9, sold it for 643,000 USDC, and deposited the proceeds into Hyperliquid. The address then opened a short position of 305.5 BTC at $83,068 with maximum leverage of 40 times. Position size is roughly $25.38 million. Liquidation price is $84,088. Current unrealized profit is about $160,000.
The source of the funds is the question. The timing is the answer.
@bluchipchat
@bluchipnews | 275 |
| 5 |  ☠️ Silent Ransom Group claims $207 million from 27 law firms in six months
Leaked internal chats from Silent Ransom Group show the crew collected roughly $207 million from 27 US law firms between April and September 2026. Median payment was $6 million. The largest claimed, $30 million from White & Case, prompted one member to celebrate in Russian: "RECORD GOLD, BROTHER!" The group does not encrypt files. No malware. Phone calls and social engineering. Impersonating IT support, convincing attorneys to grant remote access, then copying data to external drives. The attackers are not in custody.
The phone is the weapon.
☠️ Silent Ransom Group 声称六个月内从 27 家律所勒索 2.07 亿美元
Silent Ransom Group 泄露的内部聊天记录显示，该组织在 2026 年 4 月至 9 月期间从 27 家美国律师事务所获取了约 2.07 亿美元。中位数赎金为 600 万美元。最大一笔据称来自 White & Case：3,000 万美元，一名成员用俄语庆祝："RECORD GOLD, BROTHER!" 该组织不加密任何文件。没有恶意软件。只有电话和社会工程。冒充 IT 支持，说服律师授予远程访问，然后将数据复制到外部驱动器。攻击者未被抓。
电话就是武器。
@bluchipchat
@bluchipnews | 276 |
| 6 |  ☠️ Ledger thief routes 464 ETH to Tornado Cash
Ethereum records show 23 deposits totaling 464 ETH, worth about $1.16 million, reached Tornado Cash from a wallet linked to the CryptoBilis Ledger thefts. The source address sent 468.9 ETH to an intermediary, which funded four addresses. Those addresses deposited into Tornado Cash over two and a half minutes. The original address retained about 700 ETH after the transfer. Tether previously froze $10 million in USDT linked to the thefts. Bitquery estimates total losses at $92.9 million.
The seeds are gone. The coins are mixing.
☠️ Ledger 窃贼将 464 ETH 转入 Tornado Cash
以太坊记录显示，23 笔共计 464 ETH、价值约 116 万美元的存款，从与 CryptoBilis Ledger 盗窃案相关的钱包进入 Tornado Cash。源地址向一个中间地址发送了 468.9 ETH，该中间地址又资助了四个地址。这些地址在约两分半钟内将资金存入 Tornado Cash。源地址在转账后保留了约 700 ETH。Tether 此前冻结了与该盗窃案相关的 1000 万美元 USDT。Bitquery 估计总损失为 9290 万美元。
助记词没了。币在混。
@bluchipchat
@bluchipnews | 276 |
| 7 |  ☠️ Bridges of Power Part 2 of 3: The Toll
The bridge is not free. The guarantor holds the deposits. The guarantor arbitrates disputes. The guarantor takes a cut.
That is the whole model. It repeats every time one falls. Huione was banned in May 2025. Its merchants moved to Tudou. Tudou's user base doubled in weeks. Tudou processed over $12 billion before it wound down in January 2026. Then the merchants moved again. Tiancheng bought Tudou's core channels for around $5 million. Over 570,000 members came with the purchase. The channels were renamed. The users stayed.
Tiancheng offered three months of free service to former Tudou merchants. A successful referral paid 288 to 888 USDT. The bridge had new management. The traffic was the same.
Ouyi and Timi competed for the same vendors. Each claimed to have inherited Tudou's infrastructure. Blockchain analysis showed no shared wallets. Three operations. Three separate owners. One migration.
The pattern is not one name. It is a relay. When one falls, the merchants do not scatter. They relocate. The channels change names. The deposits move. The function survives. The brand is disposable. The traffic is not.
Dabai Guarantee appeared in December 2024 and ran thousands of public and private groups by early 2026. The Insikt Group called it a major player. The category keeps adding names. The toll keeps getting collected.
The toll is not the domain. The toll is the traffic. The traffic moves. The toll follows.
Part 3 tomorrow.
Who is next in the relay. Drop your pick in the chat.
☠️ 权力之桥 第二部分（共三部分）：过路费
桥不是免费的。担保方持有押金。担保方仲裁纠纷。担保方抽成。
这就是整个模式。每次一个倒下，它就重复一次。Huione 在 2025 年 5 月被封禁。它的商户迁移到 Tudou。Tudou 的用户基数在几周内翻倍。Tudou 在 2026 年 1 月关闭前处理了超过 120 亿美元。然后商户再次迁移。Tiancheng 以约 500 万美元收购了 Tudou 的核心频道。超过 57 万成员随之而来。频道被重新命名。用户留下了。
Tiancheng 向原 Tudou 商户提供三个月免费服务。成功推荐支付 288 到 888 USDT。桥有了新管理层。流量是一样的。
Ouyi 和 Timi 争夺同样的商户。各自声称继承了 Tudou 的基础设施。区块链分析显示没有共享钱包。三个运营方。三个独立所有者。一次迁移。
模式不是一个名字。是一条接力链。当一个倒下时，商户不会四散。他们搬迁。频道改名。押金移动。功能存活。品牌是一次性的。流量不是。
Dabai Guarantee 在 2024 年 12 月出现，到 2026 年初运营了数千个公共和私人群组。Insikt Group 称其为重要参与者。这个类别不断添加名字。过路费不断被收取。
过路费不是域名。过路费是流量。流量移动。过路费跟随。
明天第三部分。
谁接下一棒。在聊天里留下你的选择。
@bluchipchat
@bluchipnews | 296 |
| 8 | ☠️ AI hacking tools now sell for 10 cents on underground markets
Advertisements for AI tools on underground forums surged from fewer than 50 per month in late 2025 to more than 1,400 by February 2026 . Halcyon’s Ransomware Research Center studied nearly 4,000 posts across 77 Telegram channels, 20 dark web forums, and five specialized markets. Sellers offered access to ChatGPT Plus accounts for as little as 10 cents. Jailbreak prompts to strip safety guardrails sell for 32 cents .
The market has four product lines: jailbroken AI services, identity fraud and phishing tools, models trained on malicious data like WormGPT, and AI-augmented malware infrastructure. One system can call 120 people at once as part of a scam operation .
“It shouldn’t have been shocking to me,” said Cynthia Kaiser, head of Halcyon’s Ransomware Research Center and former deputy director of FBI Cyber. “But what we should take away from this is also how much cybercriminals have learned throughout the years about how to sell and package — and they applied this really quickly to the AI models.”
The cost of entry is now a dime. The margin is unlimited.
☠️ AI 黑客工具现在在地下市场卖 10 美分
地下论坛上的 AI 工具广告从 2025 年底的每月不到 50 条，激增到 2026 年 2 月的 1,400 多条 。Halcyon 勒索软件研究中心研究了 77 个 Telegram 频道、20 个暗网论坛和五个专业市场中的近 4,000 条帖子。卖家提供的 ChatGPT Plus 账户访问权限低至 10 美分。用于剥离安全护栏的越狱提示词售价 32 美分 。
市场有四条产品线：越狱 AI 服务、身份欺诈和钓鱼工具、在恶意数据上训练的模型（如 WormGPT），以及 AI 增强的恶意软件基础设施。一个系统可以在诈骗操作中同时呼叫 120 人 。
Halcyon 勒索软件研究中心负责人、前 FBI 网络部门副主任 Cynthia Kaiser 表示：“这不应该让我感到震惊。但我们应该从中吸取的是，网络犯罪分子多年来已经学会了如何销售和包装——他们很快就把这些应用到了 AI 模型上。”
入场成本现在是一角钱。利润是无限的。
@bluchipchat
@bluchipnews | 290 |
| 9 | ☠️ Akira lists Yarema
Akira added Yarema to its leak site on October 9, 2026. The group states 13 GB of corporate data. Employee passports, driver licenses, Social Security number scans and 45 numbers, project files, client information, NDAs. Yarema specializes in metal fabrication and assembly services. Precision metalwork for industrial clients.
Akira has operated since April 2023. Over 1,500 documented victims. The group targets manufacturing, business services, technology, and construction. The listing is live. The data is staged.
The files are named. The deadline is running.
☠️ Akira 将 Yarema 列入泄露网站
Akira 于 2026 年 10 月 9 日将 Yarema 列入其泄露网站。该组织声称窃取了 13 GB 企业数据。员工护照、驾照、社会安全号码扫描件及 45 个号码、项目文件、客户信息、保密协议。Yarema 专业从事金属制造和组装服务。为工业客户提供精密金属加工。
Akira 自 2023 年 4 月开始运作。已记录超过 1,500 个受害者。该组织针对制造业、商业服务、技术和建筑业。上架是活的。数据已打包。
文件被点名。倒计时在走。
@bluchipchat
@bluchipnews | 284 |
| 10 | ☠️ Ledger reseller tied to $86M wallet drain, Tether freezes USDT
Ledger has asked reseller CryptoBilis to pause all sales and shipments while it investigates reports of stolen funds from Southeast Asian users. On-chain investigator Specter traced inflows from hundreds of victim wallets across Bitcoin, Ethereum, and TRON, estimating losses above $86 million. Tether froze USDT across addresses linked to the theft, according to MistTrack. Ledger advised buyers from the past 90 days not to set up devices, and those who already did to move assets to a new seed.
Former Mt. Gox CEO Mark Karpelès is examining whether hardware implants inside the devices recorded seed phrases. His theory: a chip hidden under the screen reads the seed when displayed and transmits it over a hidden SIM card. The device passes Ledger’s genuine check. Binance founder CZ said the evidence points to a supply chain attack at one vendor. The attacker walked with the seeds. Ledger is telling customers to start over.
☠️ Ledger 经销商涉嫌 8600 万美元钱包被盗，Tether 冻结相关 USDT
Ledger 已要求经销商 CryptoBilis 暂停所有销售和发货，同时调查东南亚用户资金被盗的报告。链上调查员 Specter 追踪了比特币、以太坊和波场网络上数百个受害钱包的资金流入，估计损失超过 8600 万美元。据 MistTrack 监测，Tether 冻结了与该盗窃事件相关地址上的 USDT。Ledger 建议过去 90 天内购买设备的用户不要初始化，已初始化的应将资产转移到新助记词的新设备。
前 Mt. Gox CEO Mark Karpelès 正在检查设备内部的硬件植入物是否记录了助记词。他的理论是：屏幕下方隐藏的芯片在助记词显示时读取它，并通过隐藏的 SIM 卡传输出去。设备能通过 Ledger 的正品验证。币安创始人 CZ 表示，证据指向单一供应商的供应链攻击。攻击者带走了助记词。Ledger 在告诉客户从头开始。
@bluchipchat
@bluchipnews | 223 |
| 11 |  ☠️ Bridges of Power Part 1 of 3: The Bridge
A bridge is not a market. It is a crossing. Whoever owns it decides who crosses, who pays, and who is cut off. That is the oldest power there is.
Rome built the Pons Sublicius, the first bridge across the Tiber. It was wooden. When an enemy approached, the Romans tore it down to deny them passage. The bridge was not infrastructure. It was a weapon. Every river the empire took got a bridge. Every bridge got a garrison.
The Ottomans built the Mostar Bridge in 1566. It joined two halves of a city that had never been joined. It stood for four centuries. When it fell in 1993, the two sides were severed again. The bridge had been the only thing holding them together. It did not just carry traffic. It carried the relationship between two sides that could not otherwise reach each other.
The Chinese built the Zhaozhou Bridge in 605 AD. It was the first segmental arch bridge in the world. The Romans built semicircular arches. The Chinese realized a flatter arch could span wider with less material. It still stands. Fourteen hundred years. The crossing outlived every dynasty that built it.
The guarantor platforms built the same thing. Not a bridge across a river. A bridge across trust. Two criminals who cannot trust each other need a third party to hold the money. That third party is the bridge.
The Chinese language underground built that bridge at scale. Huione Guarantee processed roughly $27 billion before it was banned. Tudou took the traffic, processed $12 billion, then wound down. Xinbi absorbed the migration, processed $24 billion, then got sanctioned. A category, not one name. Escrow, arbitration, deposit. Trust as a service.
The English language underground built the same thing. It is newer. It is younger. It lives inside forums. XSS ran a forum appointed escrow service. BreachForums announced a Monero only multisig escrow in 2026. The function exists. It has not had time to become the business yet.
Those are the numbers that show up on chain.
The rest moves in private networks. Off chain. Through brokers who never touch a digital wallet. Through private groups where the trade is agreed. Through hawala networks that move money across borders without a single euro crossing a bank server, using trust and a code word. Through the largest unidentified share of USDT flows on Tron, the part that is not flashloans, not DeFi, not exchange traffic, just money moving for reasons nobody has labeled.
The visible billions are the door. The private networks are the house.
Will the English speaking underground build this at scale.
Part 2 tomorrow.
What do you think. Tell us in the chat.
☠️ 权力之桥 第一部分（共三部分）：桥
桥不是市场。是渡口。谁拥有它，谁就决定谁过桥、谁付钱、谁被切断。这是最古老的权力。
罗马人建了 Pons Sublicius，第一座横跨台伯河的桥。它是木制的。当敌人逼近时，罗马人拆掉它以阻止通行。桥不是基础设施。是武器。帝国拿下的每一条河都得到一座桥。每一座桥都得到一支驻军。
奥斯曼人在 1566 年建造了莫斯塔尔桥。它连接了一座从未被连接过的城市的两半。它屹立了四个世纪。当它在 1993 年倒塌时，两边再次被切断。桥曾是唯一把它们连在一起的东西。它不只是承载交通。它承载着两边无法以其他方式相互触及的关系。
中国人在公元 605 年建造了赵州桥。它是世界上第一座敞肩拱桥。罗马人建半圆拱。中国人意识到更扁的拱可以用更少的材料跨越更宽的距离。它至今仍屹立不倒。一千四百年。渡口比建造它的每一个王朝都活得久。
担保平台建了同样的东西。不是横跨河流的桥。是横跨信任的桥。两个无法互相信任的罪犯需要一个第三方来持有资金。那个第三方就是桥。
中文地下世界大规模地建起了那座桥。Huione Guarantee 在被封禁前处理了约 270 亿美元。Tudou 接手了流量，处理了 120 亿美元，然后关闭。Xinbi 吸收了迁移，处理了 240 亿美元，然后被制裁。这是一个类别，不是一个名字。托管，仲裁，押金。信任即服务。
英语地下世界建了同样的东西。它更新。它更年轻。它活在论坛里。XSS 运营了一个论坛指定的托管服务。BreachForums 在 2026 年宣布了一个仅限门罗币的多签托管。功能存在。它还没有时间成为生意。
这些是链上能看到的数字。
剩下的在私人网络中流动。链下。通过从不触碰数字钱包的经纪人。通过私人群组，交易在那里达成。通过哈瓦拉网络，资金跨越边境，没有一欧元经过银行服务器，靠的是信任和一个密码。通过 Tron 上最大的未识别 USDT 流量份额，那部分不是闪电贷，不是 DeFi，不是交易所流量，只是钱在流动，原因没人标注。
可见的数十亿是门。私人网络是房子。
英语地下世界会大规模地建起这个吗。
明天第二部分。
你怎么看。在聊天里告诉我们。
@bluchipchat
@bluchipnews | 302 |
| 12 | Remember to join
@bluchipchat | 305 |
| 13 | ☠️ SoftBank subsidiary IDC Frontier hit by ransomware, 495 clients down
IDC Frontier, a SoftBank subsidiary, confirmed a ransomware attack on its IDCF Cloud service on October 7. The failure began around 3:40 AM at a data center in Shirakawa, Fukushima . An automatic shutdown system was triggered after the unauthorized access. The service network was blocked to prevent secondary damage and data leaks .
495 corporate and municipal clients are affected . Ibaraki Prefecture and its police website went down . Nissui Corp. said 17 temperature-controlled warehouses have halted inbound and outbound shipments . Jiji Press, Tobu Zoo, and the Tokyo city of Kodaira also reported inaccessible sites . Social media posts purporting to be from the attacker have circulated. IDC Frontier said it is investigating their authenticity . The intrusion path has not been identified. No arrests .
The system is down. The attacker is not.
☠️ SoftBank 子公司 IDC Frontier 遭勒索软件攻击，495 家客户瘫痪
SoftBank 子公司 IDC Frontier 于 10 月 7 日确认其 IDCF Cloud 服务遭到勒索软件攻击。故障于凌晨 3:40 左右在福岛县白河市的数据中心开始 。未经授权的访问触发自动关机系统。服务网络已被切断以防止二次损害和数据泄露 。
495 家企业及地方政府客户受影响 。茨城县及其警方网站无法访问 。日水公司表示 17 个温控仓库已停止进出货 。时事通信社、东武动物园和小平市也报告网站无法访问 。社交媒体上流传着自称攻击者的声明。IDC Frontier 表示正在调查其真实性 。入侵路径尚未确认。无逮捕 。
系统停了。攻击者没有。
@bluchipnews | 302 |
| 14 | ☠️ CrowdStrike says suspect in Korean bank hacks is 26, lives in Guangdong
CrowdStrike published an analysis on October 7 pointing to a 26 year old living in Maoming, Guangdong, as the suspect in the recent attacks on seven South Korean financial firms. The lead came from the attacker's own use of Claude Code. He used the AI coding tool to write a resume showcasing his penetration testing work and entered his initials, Telegram handle, education, and residence.
The attacks used ARTEX, a Chinese developed open source AI penetration testing system, and large language models. The Financial Supervisory Service found 19 source IPs across the US, Japan, Hong Kong, Singapore, Vietnam, Thailand, Malaysia, Spain, Latvia, Sweden, and Germany. The attacker routed through multiple countries to bypass access restrictions.
Seven banks. One suspect. He is not in custody.
☠️ CrowdStrike 称韩国银行黑客案嫌疑人 26 岁，居住在中国广东
CrowdStrike 于 10 月 7 日发布分析，指认一名居住在中国广东茂名的 26 岁人员为近期七家韩国金融机构遭攻击案的嫌疑人。线索来自攻击者自己对 Claude Code 的使用。他用这款 AI 编码工具制作了一份展示渗透测试成果的简历，并输入了自己的名字首字母、Telegram 账号、学历和居住地。
攻击使用了中国开发的开源 AI 渗透测试系统 ARTEX 和大语言模型。金融监督院发现 19 个攻击源头 IP，分布在美国、日本、中国香港、新加坡、越南、泰国、马来西亚、西班牙、拉脱维亚、瑞典和德国。攻击者通过多国路由绕过访问限制。
七家银行。一个嫌疑人。他未被拘留。
@bluchipnews | 297 |
| 15 | ☠️ Xuanye Group pushed the ransom note into ASOS customers' phones
Xuanye Group took over ASOS's push notification channel on October 6. A notification titled "ASOS HACKED" landed on app users' phones in the UK, Australia, Ireland, and France. It was addressed to ASOS's data protection officer and IT team: "We have fully compromised the Snowflake instance. Engage with us, or we will leak it."
ASOS shares fell more than 10 percent on the London Stock Exchange. The company acknowledged unauthorised activity on third party communication platforms. Names and contact details may have been accessed. Snowflake said its own platform was not compromised.
Xuanye Group posted on Telegram: "Payment information is not affected. The incident involves customer information, it is safe on our server, and it will not be touched for a designated period."
The notification is out. ASOS customers now know whose hands their data is in.
☠️ Xuanye Group 将勒索信推送进 ASOS 客户的手机
Xuanye Group 于 10 月 6 日接管了 ASOS 的推送通知通道。一条标题为“ASOS HACKED”的通知发送到了英国、澳大利亚、爱尔兰和法国的 App 用户手机上。通知写给 ASOS 的数据保护官和 IT 团队：“我们已完全攻破你们的 Snowflake 实例。联系我们，否则我们将泄露。”
ASOS 股价在伦敦证券交易所下跌超过 10%。公司承认第三方通信平台存在未授权活动。姓名和联系方式可能已被访问。Snowflake 表示其自身平台未被攻破。
Xuanye Group 在 Telegram 上发文：“支付信息未受影响。事件涉及客户信息，数据安全保存在我们的服务器上，在指定期限内不会被动。”
通知已经发出。ASOS 客户现在知道自己的数据在谁手里了。
@bluchipnews | 300 |
| 16 | ☠️ MuddyWater poses as Chaos ransomware to mask espionage
Rapid7 identified an intrusion in early 2026 that appeared to be a typical Chaos ransomware attack. Chaos has claimed 49 victims since emerging in 2025. The victimology shifted from Europe and the UK to the Middle East, North Africa, and Southeast Asia. Australia was hit.
The tell was the absence of ransomware. No file encryption. No ransom note. No negotiation portal. A threat hunt found no artifacts matching the actor's claims. The victim confirmed no such files existed.
The activity matched MuddyWater, an Iranian APT linked to the Ministry of Intelligence and Security. Initial access came through Microsoft Teams social engineering. The attackers impersonated IT support, used QuickAssist and AnyDesk screen-sharing to harvest credentials and manipulate MFA. Persistence was maintained through DWAgent, a legitimate remote management tool. Data was exfiltrated and published on Chaos's leak site to maintain the fiction.
The certificates and infrastructure matched MuddyWater's prior operations.
The ransomware is the cover. The intelligence gathering is the mission.
☠️ MuddyWater 伪装成 Chaos 勒索软件以掩盖间谍活动
Rapid7 在 2026 年初发现了一起入侵事件，表面上是典型的 Chaos 勒索软件攻击。Chaos 自 2025 年出现以来已声称 49 个受害者。受害者画像从欧洲和英国转移到中东、北非和东南亚。澳大利亚也遭到攻击。
破绽在于没有勒索软件。没有文件加密。没有勒索信。没有谈判门户。威胁搜寻未发现任何与该行为者声称相符的痕迹。受害者确认不存在此类文件。
活动与 MuddyWater 相符，这是一个与情报与安全部有关联的伊朗 APT。初始访问通过 Microsoft Teams 社会工程进行。攻击者冒充 IT 支持，使用 QuickAssist 和 AnyDesk 屏幕共享来窃取凭证并操纵 MFA。通过 DWAgent 这一合法远程管理工具维持持久性。数据被窃取并发布在 Chaos 的泄露网站上以维持伪装。
证书和基础设施与 MuddyWater 此前的操作相符。
勒索软件是掩护。情报收集是任务。
@bluchipnews | 288 |
| 17 | ☠️ Predatory Sparrow wipes $90M from Iran’s largest exchange
Predatory Sparrow, a group linked to Israel, drained more than $90 million from Nobitex, Iran’s largest cryptocurrency exchange. The stolen funds were sent to addresses carrying messages against Iran’s Revolutionary Guard. Elliptic assessed the wallets effectively burned the funds to send a political message, not for profit. The group leaked what it says is the exchange’s full source code.
Nobitex confirmed unauthorized access. Its app and website went down. The exchange is now restoring wallet access in phases, starting with verified users and spot wallets.
The money is gone. The source code is public. The group walked.
☠️ Predatory Sparrow 从伊朗最大交易所清空 9000 万美元
与以色列有关联的组织 Predatory Sparrow 从伊朗最大加密货币交易所 Nobitex 盗走超过 9000 万美元。被盗资金被发送到带有反对伊朗革命卫队信息的地址。Elliptic 评估认为，这些钱包实际上是在销毁资金以传递政治信息，而非为了盈利。该组织泄露了所称的交易所完整源代码。
Nobitex 确认了未授权访问。其应用和网站下线。交易所正在分阶段恢复钱包访问，先从已验证用户和现货钱包开始。
钱没了。源代码公开了。组织走了。
@bluchipnews | 292 |
| 18 |  Bridges of power
3 part series drop Friday. | 484 |
| 19 |  Join the discussion !
@bluchipchat | 295 |
| 20 | ☠️ N0n lists Company #3
N0n listed Company #3 on October 5 at 09:54 UTC. No identifying information. No clearnet site. The leak post says: IT managed services, United States. Data publishes October 7 at 00:46 UTC if no settlement. N0n first observed September 18, 2026. 14 victims tracked. Vietnam, US, Luxembourg, Brazil, Argentina. The countdown is running.
The company has no name. The deadline does.
☠️ N0n 将 Company #3 列入泄露网站
N0n 于 10 月 5 日 09:54 UTC 将 Company #3 列入泄露网站。无识别信息。无明网网站。泄露帖子称：IT 管理服务，美国。若未达成和解，数据将于 10 月 7 日 00:46 UTC 发布。N0n 于 2026 年 9 月 18 日首次被观察到。追踪到 14 个受害者。越南、美国、卢森堡、巴西、阿根廷。倒计时在走。
公司没有名字。截止日期有。
@bluchipnews | 297 |
