BRIEFAccess salehighP65
RDP access for sale to a large Saudi medical facility
Large medical facility (Saudi Arabia)
Detected10 October 2026 · 23:21 UTC
A threat actor is selling RDP access to a large medical facility in Saudi Arabia with an estimated $70M-$100M in revenue. Such access exposes internal systems, patient records and billing platforms, and is a common precursor to ransomware. High-revenue healthcare targets carry outsized operational and regulatory risk.
CategoryAccess sale
Severityhigh
Priority score65
Detected10 October 2026 · 23:21 UTC
Access sale● 76
Venta de acceso VPN Pulse Secure a una firma legal turcaA seller on the Spear marketplace is offering Pulse Secure SSL-VPN access to a legal services company in Turkey with an estimated $1B-$5B revenue. VPN access at this scale typically enables direct entry into corporate networks, lateral movement and ransomware staging. The post is dated 08 Oct 2026, so the access is likely live and actionable for defenders to hunt and remediate.Access sale● 68
Venta de acceso a estaciones terrestres y sistemas de control satelital (2026)A seller claims full access to satellite ground station and control systems, a high-value critical-infrastructure target. If genuine, this could enable disruption or hijacking of satellite communications used by civil and military operators. Defenders in satellite and telecom should verify the claim and harden ground-segment access.Access sale● 52
Acceso de administrador a la Universidad Técnica de Cluj-Napoca en ventaA threat actor is advertising administrative access to the Romanian university utcluj.ro, a real academic institution. Admin-level access to an .edu portal enables website defacement, luring of students/staff, and potential lateral movement into internal systems. It matters because verified admin access to a named organization is directly monetizable and actionable for defenders.Access sale● 35
Venta de acceso de administrador al sitio whatsva.id (Indonesia)DarkForums user OnlineSh0p3 is offering administrative access to the Indonesian site whatsva.id. The target is a small website rather than a strategic organization, so impact is limited and it lies outside the region of interest. It is surfaced only as a low-priority access-sale datapoint.Access sale● 42
Venta de acceso interno con webshells y credenciales a entidades gubernamentalesA seller on DarkForums is advertising internal access bundles containing webshells, credentials and databases, explicitly mentioning government targets. Access of this kind gives an attacker a foothold to move laterally and exfiltrate sensitive data. The post is roughly two months old and names no specific victim or region, so it is only marginally actionable now.Access sale● 42
Venta de acceso al portal gubernamental francés economie.gouv.fr (TRACFIN)An actor on DarkForums is offering access to economie.gouv.fr, the French Ministry of Economy and Finance portal that hosts TRACFIN, the country's financial-intelligence unit handling anti-money-laundering data. Compromise of this system could expose sensitive financial-crime investigations and state financial data. The thread is dated January 2026, so it is not a fresh alert, but it remains a high-value government target worth tracking.