Daily Dose of Dark Web Informer - May 21st, 2026

Summary

The Dark Web Informer's daily digest highlights several security incidents, including alleged data exposures from Happipad, Kuwait Central Statistical Bureau, and Almerys. It also notes new victims claimed by BrainCipher, Payload, Qilin, and The Gentlemen ransomware groups. The FBI issued warnings about First VPN Service being used by ransomware groups and the emergence of the Kali365 Phishing-as-a-Service platform.

Full text

Dark Web Informer — Daily Threat Intelligence Digest 🔑 API Access Available High-volume threat intelligence, ransomware data, IOC exports, and comprehensive feed access for security teams and researchers. Explore API → 🔁 Follow across all official platforms — darkwebinformer.com/socials 🔥 Advertising Opportunities Reach a highly engaged audience. View details 56.2k Unique Visitors 122.1k Pageviews Last 30 days as of May 11, 2026. Next update June 11th. 🔒 Unlock Premium Intelligence Real-time breach tracking, expert analysis, high-resolution evidence, unredacted feeds, and 5,100+ blog posts. View all plans and features on the pricing page. View Plans & Subscribe → 📌 Legend 📰Law Enforcement — LEA updates, investigations ⚠️Dark Web Notices — forums, markets, announcements ❗️Urgent Threats — breaches, ransomware, vulnerabilities 💡Insights & Tools — guides, OSINT, learning resources 🧾 Today's Intelligence Threat Intelligence ❗️ Mexican Citizenship Document Service Advertised on Underground Forum FREE ❗️ ATOA Allegedly Exposed: 23,685 Fintech Records and 326 KYC Document Archives FREE X/Twitter Updates ❗️ 🇨🇦 Happipad | Alleged Customer Database Exposure ❗️ Yikes 💡 CVE Lite CLI: Vulnerability scanning that belongs in your terminal, not your CI pipeline. Scan your lockfile, get copy-and-run fix commands, and ship clean code. ❗️ 🇰🇼 Kuwait Central Statistical Bureau | Alleged Citizen Database Leak ❗️ CVE-2026-0300: PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID Authentication Portal ❗️ 🇦🇺 The Shepparton Adviser, the largest circulating and privately-owned free newspaper in the Goulburn and Murray Valley regions of Victoria, Australia has been claimed a victim to BrainCipher Ransomware ❗️ The Gentlemen Ransomware Claims 3 New Victims ❗️ Payload Ransomware Claims 4 New Victims ❗️ The FBI has issued a FLASH advisory warning that ransomware groups are using First VPN Service to conduct network reconnaissance and carry out computer intrusions. Promoted on criminal forums, First VPN is reportedly leveraged to support botnets, DDoS attacks, hacking operations, ❗️ Qilin Ransomware Claims 2 New Victims ❗️ Multiple users are reporting that Kash Patel’s apparel site is serving a ClickFix-style malware lure. ❗️ 🇫🇷 Almerys | Alleged Dataset Exposure ❗️ The FBI has issued a Public Service Announcement warning about Kali365, an emerging Phishing-as-a-Service platform first observed in April 2026.

Indicators of Compromise

• cve — CVE-2026-0300
• malware — BrainCipher Ransomware
• malware — Payload Ransomware
• malware — Qilin Ransomware
• malware — The Gentlemen Ransomware
• malware — Kali365

Entities