BRIEFAccess salehighP55
Free access to VMware ESXi at University of Düsseldorf
Heinrich Heine University Düsseldorf (hhu.de)
Detected24 October 2026 · 12:38 UTC
A forum post offers free access to a VMware ESXi host belonging to Heinrich Heine University Düsseldorf (hhu.de). ESXi access grants hypervisor-level control over hosted virtual machines, a high-impact foothold for lateral movement and ransomware. Treat the virtualization estate as potentially compromised until verified.
CategoryAccess sale
Severityhigh
Priority score55
Detected24 October 2026 · 12:38 UTC
Access sale● 45
Venta de acceso root a servidor completo cPanel/WHMAn actor is selling root-level control of a cPanel/WHM server, which typically means every hosted account, mailbox and database on that machine is exposed. The listing is roughly a month old and does not name the victim, so the value depends on whether the host serves government, telecom or financial customers. Buyers of such access usually pivot to mass defacement, spam and credential harvesting, so hosting providers in the region should audit WHM exposure.Access sale● 55
Venta de clave empresarial de AWS Bedrock de alto rendimientoA seller is offering an AWS Bedrock enterprise key with '10k RPM' and unlocked model access, indicating stolen or abused cloud credentials. Such keys grant billable AI compute and access to internal model configurations, enabling fraud and data theft. Organizations running Bedrock should audit key issuance and anomalous usage.Access sale● 58
Venta de acceso RDP a la operadora iraní AsiatechA forum post exposes what it claims are live RDP IP addresses and usernames for Iran's Asiatech Data Transmission Co., an ISP and data carrier. Valid RDP credentials on a telecom backbone give intruders a foothold for lateral movement, traffic interception and downstream customer compromise. If any exposure is confirmed, force credential rotation and audit external RDP exposure immediately.Access sale● 42
Venta de correos gubernamentales y ejecución de EDRA seller advertises verified government email accounts alongside 'direct EDR execution' and crypto-freezing services, signaling a broker offering initial access into government environments. No specific country is named, but compromised gov mailboxes are prime phishing and BEC vectors. Public-sector email and endpoint teams should treat this as a credential-abuse and access-brokerage risk.Access sale● 44
Venta de accesos RDP genéricos por el proveedor HHMA long-running marketplace seller (HHM) advertises cheap RDP accesses to buyers, a common entry point for ransomware affiliates. While the specific victim is unspecified, bulk RDP sales fuel server compromise and lateral movement against businesses. Defenders should enforce RDP hardening, MFA and exposure monitoring accordingly.Access sale● 46
Registros de stealer vinculados al dominio GENCAT (Generalitat)A stealer-log post referencing the GENCAT domain (the Catalan government abbreviation) appeared, potentially containing employee credentials and session data. Stealer logs for a public administration can enable account takeover, BEC and access to internal services. Scope is unconfirmed, but government-linked credentials merit verification and forced resets.