BRIEFAccess salelowP28
Admin-level RDP accesses offered for sale on underground forum
Detected21 October 2026 · 02:39 UTC
A verified seller on the BlackBones carding forum advertises remote desktop access with administrator rights, the kind of foothold typically harvested from commodity infostealer logs and exposed RDP services. The post names no victim, country or IP range, so it cannot currently be tied to an Argentine or Latin American organisation, but admin RDP access is a standard entry point for ransomware affiliates and access brokers. Worth monitoring this seller for follow-up posts that list specific companies or geolocations.
CategoryAccess sale
Severitylow
Priority score28
Detected21 October 2026 · 02:39 UTC
Access sale● 48
Venta de webshell y acceso a base de datos de Malasia (0-day)A seller advertises an unauthenticated webshell with database access against a Malaysian target, framing it as a critical 0-day. Sale of ready-made webshell access is a direct precursor to data theft and ransomware deployment. Besides the direct victim, it signals an exploitable web-facing flaw that regional organizations running similar stacks should patch and hunt for.Access sale● 40
Venta de acceso cPanel a saj.org.sa de Arabia SauditaA seller offers cPanel access to saj.org.sa, a Saudi organization. Web-panel access enables site defacement, mail interception and malware hosting. It is a mid-value target outside the region but relevant for tracking access-sale activity.Access sale● 48
Venta de acceso al sistema de nóminas de las Fuerzas Armadas de MalasiaA seller advertises access (233 entries) to the Malaysian Armed Forces payroll system, a military HR and finance platform. Payroll access exposes service members' identities, bank account details and salary data, enabling fraud and intelligence collection against military staff. Although outside Latin America, a named armed-forces payroll compromise warrants tracking and cross-referencing.Access sale● 62
Base de datos completa y SQLi de Conexus Mobile a la ventaThe seller N0VEMBER is advertising a full database dump for conexusmobile.com together with a working SQL injection vulnerability, posted minutes ago. A live SQLi on a telecom/mobile-services provider means the breach is ongoing and can be re-exploited for subscriber data, SIM-related account actions and customer PII. Defenders of that platform, and peers in the MVNO/telecom space, should treat the SQLi as active, hunt for injection traffic in WAF and DB logs and patch before the dump is weaponised further.Access sale● 85
Acceso al correo institucional de una autoridad agrícola de ParaguayA thread on DarkForums advertises the official email system of a Paraguayan government agricultural authority, implying access to institutional mailboxes or the accounts that control them. Compromise of a ministry-level mail tenant enables business email compromise against suppliers and other state bodies, credential reuse into connected government services, and exfiltration of internal documents. Defenders in the Paraguayan public sector should verify MFA coverage, impossible-travel and mail-forwarding rules on this domain immediately.Access sale● 42
Vendedor ofrece 'cualquier acceso inicial' en foro clandestinoAn actor on a French-language underground forum advertises providing 'any initial access' for sale, signaling an on-demand intrusion/access-broker service. No specific victim, region, or access type (VPN, RDP, webshell) is disclosed in the public title, so it cannot be tied to a named target. It is worth tracking as an access-broker lead but is low-confidence without further detail.