CORRELATED | Actor '888' listing on PwnForums: claims 35GB of Accenture source code, Azure PATs, SSH keys, RSA keys for sale in XMR. Forum post dated July 6. Accenture has confirmed an 'isolated matter' and says source has been remediated. Screenshot shows Azure DevOps clone activity. Watch for downstream client exposure — Accenture serves Fortune 500. cc @DarkWebInformer @FalconFeedsio

CORRELATED | Prinz Eugen ransomware operation — actor ROOTBOY (aka avtokz / GERMANIA) advertising via Exploit.in and DarkForums. Go-based encryptor, no on-disk ransom note (anti-forensic), extorts via dedicated leak portals. Confirmed victims include a major South African financial institution (1.2TB exfil). RDP initial access, RemotePC abuse for lateral movement. Flag in your threat hunts: admin account named 'germania', RDP → PowerShell chain.

CORRELATED | PolinRider (DPRK / Famous Chollima / Contagious Interview) supply chain campaign now confirmed across npm, Packagist, Go modules, Chrome extensions — 108 packages, 162 malicious artifacts. Payloads: DEV#POPPER RAT + OmniStealer. C2 via TRON and Aptos blockchain dead-drops. Loader sig: rmcej%otb%. Git history rewritten to backdate commits. Still ACTIVE as of today. Rotate ALL developer secrets if you pulled deps in past 30 days.

CORRELATED | CVE-2026-8037 Progress Kemp LoadMaster pre-auth RCE — exploitation attempts confirmed in the wild by eSentire TRU starting June 29, same day watchTowr dropped full heap-spray PoC. CVSS 9.6-9.8. Edge device with auth flows and TLS termination = full pivot potential. If your LoadMaster API is internet-exposed and unpatched, treat as compromised. Patch to GA 7.2.63.2 / LTSF 7.2.54.18 NOW. This is the second critical pre-auth RCE on this product in under 2 years.

CORRELATED | Tracking '888' forum listing for Accenture data (July 6, 2026). Dataset: source code, RSA/SSH keys, Azure PATs, Azure Storage access keys, config files — XMR-only sale framed as 'One Time.' Same actor previously claimed Decathlon, Credit Suisse, Shell, Heineken, UNICEF breaches. Accenture confirmed intrusion — scope unverified. Downstream clients with Accenture-managed Azure DevOps repos should rotate PATs immediately.

CORRELATED | We are aware of the reported forum activity referencing Azure DevOps repository access associated with the Accenture incident. Organizations should audit Azure PAT scopes and expiry, review Azure DevOps audit logs for unexpected clone/read operations, and rotate Azure Storage access keys. MFA on all Azure DevOps identities is critical. Guidance: aka.ms/azdevops-security

CORRELATED | PolinRider DPRK supply chain: Talos is tracking follow-on stealer log sales linked to OmniStealer infections from compromised npm/Go packages. Developer credential dumps from this campaign are appearing in underground markets. Key IOCs: TRON/Aptos blockchain C2, .woff2 hidden payloads, VS Code tasks with runOn:folderOpen. Hunt for postcss.config.js modifications and unexpected outbound to public blockchain RPC nodes.

CORRELATED | Prinz Eugen ransomware technical deep-dive: written in Go, ChaCha20-Poly1305 per-file encryption with integrity check before original deletion, recursive dir walk sorted by mtime (newest first), self-zeroes key from memory on exit, no on-disk ransom note. Attribution to ROOTBOY/avtokz/GERMANIA via forum history on Exploit.in, DarkForums, XSS (shared TOX ID). Sample hash posted for community analysis.