BRIEFAccess salehighP63
Lebanese university databases and server root access leaked
Universidades libanesas (*.edu.lb)
Detected28 September 2026 · 22:07 UTC
The Zelda Group is offering databases of Lebanese *.edu.lb universities together with server root access, dated 2026. Server root plus student data gives full control of academic infrastructure and a supply of personal records for fraud. It is a high-impact access sale that defenders of Lebanese education networks should investigate.
CategoryAccess sale
Severityhigh
Priority score63
Detected28 September 2026 · 22:07 UTC
Access salePriority 62
Venta de acceso de administrador al sitio brasileño MontinkAn actor posting as blackhunter1 on the DarkForums marketplace is advertising administrative access to montink.com, a Brazilian print-on-demand e-commerce platform. Admin takeover could expose customer accounts, order and payment data, and allow defacement or malicious script injection on the storefront. This is a live initial-access offer against a real Latin American company and warrants timely verification.Access salePriority 60
Venta de acceso a 7 servidores de ISP en ArgeliaA seller on BreachForums' Access Market is advertising seven compromised ISP provider servers in Algeria, offering buyers a foothold inside telecommunications infrastructure. ISP-level access enables traffic interception, subscriber data theft and malware distribution to downstream customers. Telecom operators in Algeria and the wider region should hunt for intrusions and rotate privileged credentials.Access salePriority 78
Venta de acceso SSH/root a 11 organizaciones en varios paísesA seller on PwsForums is advertising critical SSH/root-level access to 11 separate organizations across various countries, implying full administrative control of compromised servers. Root/SSH access is the highest tier of initial access and enables ransomware deployment, data theft and lateral movement. Organizations exposing SSH services should audit accounts, keys and login telemetry immediately.Access salePriority 44
Venta de acceso a AWS SES con envío masivo de correosA threat actor posting on DarkForums is selling CLI access to AWS Simple Email Service with quotas of 50,000 to 1 million messages. Such access lets buyers send high-volume phishing or spam from a trusted cloud domain, helping them bypass many email filters. Defenders should monitor AWS SES sending anomalies and enforce sending authorization and configuration-set controls.Access salePriority 24
Venta de acceso RDP con privilegios de administrador en BlackBonesA verified seller on BlackBones has been offering remote desktop access with administrator rights since January 2025, with the thread still being bumped in November 2026. The listing is generic and does not name a victim, sector or country, so it cannot be tied to a specific organization. It is relevant only as background on the RDP brokerage market, since such access is routinely used for ransomware staging and lateral movement.Access salePriority 58
Venta de acceso a portales bancarios online de UcraniaAn actor advertising on BlackBones under 'Unverified Ads' is offering access to Ukrainian bank online portals. If genuine, such access enables account takeover, fraudulent transfers and further intrusion into banking infrastructure. Ukrainian financial institutions and their customers should treat this as a possible credential or session compromise.