RectorMalware
RansomwareFrom MISP Galaxy
Last reported 4 days ago, by Security Affairs4 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1552.004Private Keys
“…Mudhra certs: Mozilla has removed the eMuhdra root certificate from Firefox after eight of the company's intermediary certs had their private keys compromised.”
- T1553.002Code Signing
“Six of the eight are for issuing TLS certificates, while the other two are for code-signing and trusted only by Microsoft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections“NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“According to CitizenLab and the SHARE Foundation, Professor Vladan Dokic, Rector of the University of Belgrade, and prosecutor Rade Bajic were hacked with the spyware this year.”
-
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election“Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election”
-
thegentlemen lists Saga University“Rector since Oct 2025: Koichi Node (cardiologist); 2026 launches include Japan's first national-university cosmetic science program (30 students, 7x oversubscribed) and a joint teacher-training degree with Kumamoto University.”
Indicators in its reports
named in the reports above- infosec[.]exchangein 1 report
- hexane[.]ccin 1 report
- colborne.bsky[.]socialin 1 report
- saskiabricmont.bsky[.]socialin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.