KELA

13/10/2026

Silent Ransom Group leak analysis: KELA reviewed 5,692 Rocket[.]Chat messages from the Luna Moth Files, an archive presented as SRG's internal communications. The chats describe defined roles across negotiation, recruitment and infrastructure; a step-by-step vishing script for callers posing as internal IT; a negotiation pipeline tracked from CHAT to GOLD; discussions of recruiting agents to enter law firms; and, from September 2026, a parallel extortion operation under the name Sleepless Threat. The archive's authenticity is unverified, and the report flags where the chats record claims rather than confirmed events. Appendix A lists 62 Bitcoin addresses with their first observed dates.

Read the full report: https://hubs.la/Q04B0mBG0

Short on time? Read or listen to our summary on the KELA blog: https://hubs.la/Q04B0mCw0

06/10/2026

Affected by the ASOS Breach? Get in touch.
KELA researchers are sharing as much as we know to drive awareness about this breach. If you are doing research and investigating, please reach out and we'll share what's not TLP:RED.
https://hubs.la/Q04zlzhk0
Thanks to the team at https://hubs.la/Q04zlzph0 for reaching out and the mention!

A push alert sent to ASOS customers from its own app claimed it had been "HACKED", with the company's shares falling afterwards. Catch up on what happened and advice from experts for shoppers below.

01/09/2026

ביום שני הקרוב נארח בוקר של שיתוף, למידה והשראה- הזדמנות לשמוע מחברות נוספות בתעשייה, להחליף רעיונות ותובנות, לדבר על האתגרים והכיוונים שמעסיקים את כולנו ולבסוף- נרים יחד כוסית לכבוד השנה החדשה.

📅 7 בספטמבר בשעה 9:30
📍 בניין סונול, מנחם בגין 52, תל אביב

מוזמנים להירשם כאן -
https://hubs.la/Q04w4M5b0
*בכנס נארח את לקוחותינו, בהרשמה מראש ובאישור בלבד.

27/08/2026

In March 2026, KELA's Cyber Intelligence Center briefed the AFP, the Western Australia Police Force and the FBI on TeamPCP (UNC6780): the identities behind the aliases, the infrastructure, and the victim set.
Two men have now been charged in Western Australia. One of them was named in KELA's TeamPCP Threat Actor Profile in April 2026, supplied to law enforcement at the time.

The AFP alleges the campaign potentially compromised more than 1,000 organizations globally, enabled the theft of over 500,000 credentials, and led to the exfiltration of at least 300GB of data, with global remediation costs running into the hundreds of millions.
What makes TeamPCP worth studying: it started as a Telegram stolen-data broker and ended up inside the tooling defenders use to check their own code. Between March 19 and 24, 2026, four waves reached Trivy, Checkmarx KICS and AST GitHub Actions, OpenVSX and LiteLLM (CVE-2026-33634, added to CISA's KEV catalog on March 26).

The AFP has said industry reporting was crucial to its investigators. That is the argument for CTI that names people, not just indicators.
Full release: https://hubs.la/Q04vzVXQ0

Published analysis, from Telegram brokering through to identification: https://hubs.la/Q04vzCt-0

Finished threat intelligence report: https://hubs.la/Q04vzKZJ0

And we are walking the whole arc, including how the investigation actually came together, in a webinar on Monday, August 31: https://hubs.la/Q04vzGQj0

13/07/2026

The move from Tor forums to Telegram has collapsed the time between data theft and exploitation from days to minutes. Stealer logs, session tokens, and card data now surface in real time, and most defenders never see it coming.
Read our breakdown of the top Telegram log & carding operations

https://hubs.la/Q04pj26D0

24/06/2026

Our latest blog breaks down 7 CTEM best practices that reduce risk in practice, not theory: across cloud, SaaS, and hybrid environments.
A few of them:
- Prioritize by exploitability and business impact, not CVSS volume
- Build one continuously updated asset inventory (everything else depends on it)
- Make remediation ownership explicit, or findings sit unfixed
- Track metrics tied to outcomes, not activity
The test is simple: if exposure isn't going down, the program isn't working.
Read the full breakdown: https://hubs.la/Q04msm2f0

04/06/2026

The 2026 FIFA World Cup is the biggest sporting event in history. It's also one of the biggest attack surfaces ever assembled.
16 host cities. 48 teams. 6 billion viewers. And a digital supply chain - ticketing, hospitality, transport, telecom, hundreds of vendors - that attackers have been probing months before the June 11 kickoff.
Here’s what KELA's CIC has identified:
→ 1.5M+ compromised accounts tied to FIFA-related domains
→ 7,300+ leaked credential instances (2,800 in the past year alone)
→ plaintext credentials for FIFA's own identity infrastructure
→ alleged RDP and cloud-console access to FIFA servers, listed on a cybercrime forum
Our expert threat research team has mapped the whole landscape and makes recommendations for your security team to nation-state espionage, industrial-scale fraud, and a dark web already trading the credentials that power attacks.
Get the report → https://hubs.la/Q04k1Xpm0

28/05/2026

Let’s connect at ISS World Prague!
Click below to book a meeting and secure your spot for an exclusive happy hour in downtown historical Prague before slots fill up!
Don't miss our expert sessions:
15:00 - 15:40 | Unmasking Cybercriminals: Intelligence Fusion for Modern Cybercrime Investigations
Or Lev, VP of Sales Engineering
15:45 - 16:25 | Making Threat Infrastructure Visible: The Power of NetFlow and CTI Fusion
Ron Breger, Threat Researcher
👇
https://hubs.la/Q04jbg-F0

27/05/2026

KELA's Cyber Intelligence Center (CIC) exposes the Infrastructure Destruction Squad, a threat actor blending political hacktivism with profit-driven cybercrime. The group recently launched the BLACKNET-00 ransomware builder for $300, alongside critical infrastructure (ICS/SCADA) exploits and banking malware.
Learn why this low-cost, high-impact arsenal is drastically lowering the barrier to entry for novice cybercriminals and how this hybrid threat model changes the game for enterprise defense.

https://hubs.la/Q04j6DwG0

24/05/2026

Come say hey and meet us at ISS World Europe 2026!
As every year, KELA will be on the ground in Prague- this time at our new spot, Booth #24.
Our team, alongside CEO David Carmiel, will be there to discuss how KELA supports cybercrime investigations, proactive threat visibility, and deep, actionable cyber intelligence.
To keep things interesting, we’re also hosting a secret happy hour with a password-only twist ;)
Want the password? Come meet us:
https://hubs.ly/Q04hLYfh0