Key Points Yurei Ransomware Check Point Research discovered a new ransomware group on September 5. The group calls themselves Yurei (a sort of spirit in Japanese folklore), and initially listed one victim, a Sri Lankan food manufacturing company, on their darknet blog. These blogs are used by ransomware groups to list their victims, show proofs […] The post Yurei & The Ghost of Open Source Ransomware appeared first on Check Point Research .
For the latest discoveries in cyber research for the week of 8th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES A supply chain breach involving Salesloft’s Drift integration to Salesforce exposed sensitive customer data from multiple organizations, including Cloudflare, Zscaler, Palo Alto Networks, and Workiva. The attackers accessed Salesforce CRM systems via […] The post 8th September – Threat Intelligence Report appeared first on Check Point Research .
Hi everyone,
I’ve been a victim of targeted cyberstalking for years and I need to share my experience to understand if what happened to me points to SS7 abuse alone, or if there had to be someone with privileged access inside Meta (WhatsApp).
Here are the facts:
• I used two numbers:
• One SIM only for data.
• A different number for WhatsApp, but the SIM itself was not in the phone (still active with the carrier, not blocked).
• I was never disconnected from my WhatsApp.
• This means my account was never fully cloned using SS7 (since that would disconnect me).
• Still, my stalkers somehow knew all the new contacts I talked to on WhatsApp, including people I met on Tinder.
• They didn’t know those numbers beforehand.
• So simple correlation at the carrier level seems impossible.
• My suspicion:
1. They were using SS7 for surveillance (location, SMS interception, monitoring my SIM’s traffic patterns).
2. At the same time, they had access to WhatsApp metadata (number A ↔ number B, timestamps).
• This would explain how they knew all my new contacts, without prior knowledge of their numbers.
• Important detail:
• I always had 2FA (PIN) enabled.
• I even tested registering my number on another phone, intercepted the SMS, but without the PIN the session never completed.
• Despite that, I once saw real messages appear on the second phone — which left me wondering about some kind of “silent pre-login” bug.
⸻
My questions for the community:
1. Is it technically possible to access WhatsApp metadata (who talks to who) without insider or official Meta access?
2. Could SS7 + carrier-level monitoring alone explain how they mapped all my new contacts?
3. Have there been documented cases of “silent pre-login” where WhatsApp sessions were duplicated without disconnecting the victim?
4. From a defense standpoint, am I correct that moving to Signal (with usernames) and Session fully mitigates this kind of metadata exposure?
⸻
I’d really appreciate insights from anyone who works with telecom security, SS7, or has deep knowledge of WhatsApp’s metadata handling.
Thanks for reading.
Cloudflare Confirms Data Breach Linked to Salesforce and Salesloft Drift
Source: https://hackread.com/cloudflare-data-breach-salesforce-and-salesloft-drift/
Palo Alto Networks, Zscaler and PagerDuty Hit in Salesforce Linked Data Breaches
Source: https://hackread.com/palo-alto-networks-zscaler-pagerduty-salesforce-data-breach/
Cache Me If You Can (Sitecore Experience Platform Cache Poisoning to RCE) - watchTowr Labs
Source: https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/
Over 28,000 Citrix devices vulnerable to new exploited RCE flaw
Source: https://www.bleepingcomputer.com/news/security/over-28-200-citrix-instances-vulnerable-to-actively-exploited-rce-bug/
Salesloft OAuth Breach via Drift AI Chat Agent Exposes Salesforce Customer Data
Source: https://thehackernews.com/2025/08/salesloft-oauth-breach-via-drift-ai.html
Farmers Insurance data breach impacts 1.1M people after Salesforce attack
Source: https://www.bleepingcomputer.com/news/security/farmers-insurance-data-breach-impacts-11m-people-after-salesforce-attack/
Guess Who Would Be Stupid Enough To Rob The Same Vault Twice? Pre-Auth RCE Chains in Commvault - watchTowr Labs
Source: https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/?123
