Reports

incidentS4TLP:CLEAR28 Sept 2026

Threat intelligence analysis of the September 2026 MedusaLocker ransomware attack on Bangladesh's PKSF, covering the breach timeline and DFIR takeaways.

incidentS4TLP:CLEAR13 Sept 2026

The Krybit ransomware group has listed IBN Sina Trust on its dark web leak site, threatening to expose 116GB of sensitive patient and medical data.

monthlyS4TLP:CLEAR9 Sept 2026· covers 1 Aug 2026 – 31 Aug 2026

The August 2026 Bangladesh Cyber Threat Intelligence Report examines recent infostealer compromises across 14 domestic organizations and their alignment with Ransomware-as-a-Service (RaaS) operations. This brief analyzes recent CIRT advisories—including state-aligned espionage by APT-C-35—and provides strategic recommendations to mitigate infrastructure vulnerabilities against advanced cyberattacks.

flashS1TLP:CLEAR27 Aug 2026

Australian authorities have arrested the alleged operators of the TeamPCP hacking group, including suspected leader Ruben Thomson (aka DeadCatx3). The group is responsible for the Shai-Hulud malware campaigns, which targeted development environments in widespread software supply chain attacks. Discover how security researchers used open-source intelligence (OSINT) to unmask these cybercriminals, and learn key strategies to protect your organization's software development pipeline from ongoing threats.

monthlyS4TLP:CLEAR2 Aug 2026· covers 1 Jul 2026 – 31 Jul 2026

ThreatIntel BD's second monthly assessment, and the first built on a clean collection baseline. On 16 July the ransomware group The Gentlemen listed BRAC — the world's largest NGO, headquartered in Dhaka — on its extortion site. Beneath it, credential counters across the eight organisations tracked since June grew by 16,972 records in four weeks, and six organisations recorded fresh workforce compromise during July, four of them banks; the Bangladesh Police counter reached 291 staff accounts with its most recent compromise dated 30 July. The period also brought a pre-authentication RCE chain in WordPress core, FortiBleed converting cracked VPN hashes into ransomware access, MFA-bypass phishing kits sold as a service, and eighteen unauthenticated Ollama servers exposed on Bangladeshi networks.

flashS4TLP:CLEAR20 Jul 2026· covers 17 Jul 2026 – 20 Jul 2026

Flash alert on wp2shell a pre-authentication RCE chain in WordPress Core (CVE-2026-63030 + CVE-2026-60137) disclosed 17 July 2026. An anonymous attacker can run code on a default WordPress install with no login, no plugins, and no special configuration. Published CVSS v3.1: 9.1 Critical (CVE-2026-60137, SQLi) and 7.5 High (CVE-2026-63030, batch-route confusion); chained impact is pre-auth RCE. Public PoCs are circulating and early in-the-wild exploitation is reported. Patch to 7.0.2 / 6.9.5 / 6.8.6 immediately; WordPress has forced auto-updates. High relevance to Bangladesh's WordPress-heavy web estate.

monthlyS4TLP:CLEAR7 Jul 2026· covers 7 Jun 2026 – 7 Jul 2026

ThreatIntel BD's inaugural monthly assessment. Between 7 June and 7 July 2026, automated collection surfaced 1,077 Bangladesh-nexus security events. Two themes define the period: large-scale exposure of citizen and workforce credentials through infostealers, and active ransomware targeting, with two Bangladesh-based IT firms listed on an extortion leak site within a single week and a Havoc C2 node active on domestic infrastructure.