BRIEFOtherlowP45
Buyer seeks defense and military data on DarkForums
Detected13 November 2026 · 14:13 UTC
On 9 Nov 2026 a DarkForums user ('TheLi0nKing') posted a 'Buyers Place' request actively looking to purchase defense and military data. While it names no specific target or confirmed compromise, it signals live demand for sensitive armed-forces information on the forum. Defense and government security teams should note the interest and watch for related solicitations targeting their sector.
CategoryOther
Severitylow
Priority score45
Detected13 November 2026 · 14:13 UTC
OtherPriority 36
Operador afirma ejecutar el troyano bancario BTMOB en un VPSOn the Brazilian forum Exilio404 an operator claims to have a BTMOB 'KL' banking-trojan build running on a VPS server. BTMOB is a mobile banking trojan family heavily used against Brazilian financial institutions, so active infrastructure discussion signals ongoing LATAM banking-fraud operations. It is operational chatter without a named victim, but relevant for tracking regional banking-malware activity.OtherPriority 56
Exploit RCE pre-autenticación para F5 BIG-IP APM publicadoA working pre-auth RCE exploit for F5 BIG-IP APM, claiming root on the appliance, was published on Cracked.st in 2026. As BIG-IP APM fronts VPN and remote access for many government and banking networks, a public PoC invites mass exploitation. Critical-infrastructure defenders should verify exposure and patch status immediately.OtherPriority 68
Doxeo del secretario de Seguridad de la CDMX Omar García HarfuchA user 'GhostVibe' posted on DarkForums a dox targeting Omar García Harfuch, Mexico City's Secretary of Citizen Security, on 10 November 2026. Publishing personal data of a senior law-enforcement/security official exposes targeting, harassment and physical-security risks. Such doxes against high-profile government figures are operationally sensitive and often precede escalation against institutions.OtherPriority 45
Código del botnet bancario Ermac v3.0 filtrado en DarkForumsA DarkForums actor (Bryxhokal) shares a 'cracked tools' release of the Ermac banking botnet, version 3.0, an Android malware family historically used against Latin American and European banks. Wider availability of the builder lowers the barrier for new fraud crews targeting mobile banking customers, especially in Brazil, Mexico and Spain. Defenders in retail banking should anticipate new Ermac-derived overlays and SMS-stealing campaigns.OtherPriority 45
Filtración de logs de chat del grupo de ransomware BlackBastaUser 'Markelok' posted 'BlackBasta Chat logs Leaked' on DarkForums. Internal chat logs of a major ransomware-as-a-service group can reveal victim lists, negotiation tactics, tooling and affiliate identities of high CTI value. This helps defenders anticipate BlackBasta TTPs and identify prior or planned intrusions.OtherPriority 74
Config de credential stuffing dirigido a la teleco chilena VTRA credential-stuffing/cracking configuration aimed at the login of VTR, one of Chile's largest telecom and ISP operators, was posted in DarkForums' Configs section by user 'Mekdural'. Such configs enable automated password-guessing against subscriber and staff accounts, risking account takeover of critical telecommunications infrastructure. This is directly relevant to Latin American critical-infrastructure defenders.