BRIEFAccess salehighP52
RDP IPs and usernames of Iran's Asiatech exposed
Asiatech Data Transmission Co.
Detected25 October 2026 · 15:41 UTC
A Cracked.st post exposes RDP IP addresses and usernames belonging to Asiatech Data Transmission Co., an Iranian internet and data-services provider. No passwords are included, but the list hands attackers validated targets and login names for a telecom provider, accelerating RDP brute-force and credential-stuffing. The post date is unclear, yet the entity is critical infrastructure and the exposure should be treated as active.
CategoryAccess sale
Severityhigh
Priority score52
Detected25 October 2026 · 15:41 UTC
Access sale● 48
Venta de datos confidenciales de la Policía de Rajastán (eKYC, FIRs)A seller is offering confidential data from Rajasthan Police (police.rajasthan.gov.in), including eKYC records, attachments and FIRs. Stolen police and citizen data enables identity fraud and targeted attacks, and signals a breach of a government law-enforcement system. Though outside the region, it belongs on the access/data-sale watchlist.Access sale● 68
Acceso de administrador y defacement del portal de telecomunicaciones de Costa de Marfil (gouv.ci)An actor claims administrative access to and defacement of telecom.gouv.ci, a Côte d'Ivoire government telecom portal. Verified admin access to a government telecom can enable data theft, lateral movement and service disruption, and is being actively marketed. While outside Latin America, it fits the access-sale threat class defenders should track.Access sale● 58
Venta de acceso de administrador a la tienda costarricense factoa.netA DarkForums seller is offering administrator access to factoa.net, a Costa Rican online shop, together with source code. Admin access lets an attacker read customer data, tamper with orders and payments, and pivot toward the shop's hosting or payment integrations. It is a recent LATAM access-sale worth monitoring for fraud and data-leak impact.Access sale● 76
Venta de acceso a gobiernos de primer nivel y ejecución EDRA seller is advertising first-world government network access bundled with EDR execution capability and crypto-seizure services via a dedicated Telegram channel. This signals brokered initial access into public-sector environments, a targeted supply-chain and insider risk for government and critical-infrastructure defenders. Such access typically precedes ransomware or espionage deployment.Access sale● 42
Venta de supuestos accesos a gobiernos extranjeros y ejecución EDRA Spear marketplace seller advertises 'First-World Gov Access' together with EDR execution and crypto-seizure capabilities via a Telegram channel, implying network footholds in government environments. No specific victim, country or access type is named, so it is low-confidence and not clearly tied to Latin America. It is worth monitoring as a broker pitch but cannot be treated as a confirmed compromise.Access sale● 72
Acceso webshell (PHP2SHELL) a infraestructura energética de Omán a la ventaA seller is offering PHP2SHELL webshell access and an associated access database tied to Oman's energy infrastructure. Compromise of energy-sector systems can enable operational disruption and lateral movement between IT and OT networks. Defenders in regional energy operators should hunt for web-shell persistence and audit exposed PHP endpoints.