BRIEFAccess salecriticalP85
Email system access to a Paraguayan government agricultural authority
Autoridad agrícola del Estado paraguayo (MAG/SENAVE)
Detected20 October 2026 · 01:39 UTC
A thread on DarkForums advertises the official email system of a Paraguayan government agricultural authority, implying access to institutional mailboxes or the accounts that control them. Compromise of a ministry-level mail tenant enables business email compromise against suppliers and other state bodies, credential reuse into connected government services, and exfiltration of internal documents. Defenders in the Paraguayan public sector should verify MFA coverage, impossible-travel and mail-forwarding rules on this domain immediately.
CategoryAccess sale
Severitycritical
Priority score85
Detected20 October 2026 · 01:39 UTC
Access sale● 72
Venta de acceso y código fuente de SK TelecomA seller is advertising access to SK Telecom, one of South Korea's largest carriers, together with source code and internal data. Access plus source code is a high-value combination that enables network intrusion, subscriber-data theft, and IP exfiltration. Buyers could pivot into telecom critical infrastructure, so this warrants tracking and hunting for leaked credentials.Access sale● 48
Venta de webshell y acceso a base de datos de Malasia (0-day)A seller advertises an unauthenticated webshell with database access against a Malaysian target, framing it as a critical 0-day. Sale of ready-made webshell access is a direct precursor to data theft and ransomware deployment. Besides the direct victim, it signals an exploitable web-facing flaw that regional organizations running similar stacks should patch and hunt for.Access sale● 28
Accesos RDP con privilegios de administrador a la venta en un foro clandestinoA verified seller on the BlackBones carding forum advertises remote desktop access with administrator rights, the kind of foothold typically harvested from commodity infostealer logs and exposed RDP services. The post names no victim, country or IP range, so it cannot currently be tied to an Argentine or Latin American organisation, but admin RDP access is a standard entry point for ransomware affiliates and access brokers. Worth monitoring this seller for follow-up posts that list specific companies or geolocations.Access sale● 40
Venta de acceso cPanel a saj.org.sa de Arabia SauditaA seller offers cPanel access to saj.org.sa, a Saudi organization. Web-panel access enables site defacement, mail interception and malware hosting. It is a mid-value target outside the region but relevant for tracking access-sale activity.Access sale● 48
Venta de acceso al sistema de nóminas de las Fuerzas Armadas de MalasiaA seller advertises access (233 entries) to the Malaysian Armed Forces payroll system, a military HR and finance platform. Payroll access exposes service members' identities, bank account details and salary data, enabling fraud and intelligence collection against military staff. Although outside Latin America, a named armed-forces payroll compromise warrants tracking and cross-referencing.Access sale● 62
Base de datos completa y SQLi de Conexus Mobile a la ventaThe seller N0VEMBER is advertising a full database dump for conexusmobile.com together with a working SQL injection vulnerability, posted minutes ago. A live SQLi on a telecom/mobile-services provider means the breach is ongoing and can be re-exploited for subscriber data, SIM-related account actions and customer PII. Defenders of that platform, and peers in the MVNO/telecom space, should treat the SQLi as active, hunt for injection traffic in WAF and DB logs and patch before the dump is weaponised further.