BRIEFAccess salelowP38
Root access to unnamed servers offered for sale
Detected21 October 2026 · 18:36 UTC
A DarkForums marketplace seller posted 'root access' to servers with an 11M figure about eight hours ago, but the listing names no victim, sector or geography. Unattributed root-access offers are usually reposts or resold access rather than fresh intrusions, so value is limited until a target appears. Monitor the thread for samples or a named organisation.
CategoryAccess sale
Severitylow
Priority score38
Detected21 October 2026 · 18:36 UTC
Access sale● 42
Venta de acceso RDP con privilegios de administradorA seller on BlackBones is advertising RDP access with administrative privileges, a common initial-access vector for network intrusion and ransomware staging. No specific victim or geolocation is named, so the direct exposure is unknown, but buyers of such access typically use it for lateral movement and data theft. Defenders should treat admin RDP as a high-value foothold and enforce MFA, restrict RDP exposure and monitor for credential reuse.Access sale● 62
Venta de acceso a la base de datos de NIO Power en ChinaA seller is offering access to NIO Power China's database containing user information such as phone numbers and addresses. NIO Power runs EV battery-swap and charging infrastructure, so customer and location records are tied to mobility operations rather than a generic webshop. The data supports phishing, physical tracking and further intrusion attempts against the operator's suppliers.Access sale● 70
Venta de acceso, código fuente y datos de SK TelecomA seller claims to hold corporate access to SK Telecom together with stolen source code and internal data, presenting it as a large-corporation intrusion. SK Telecom is South Korea's largest telecom operator, so repository and access exposure can be chained into network and customer-system compromise. The post is undated, but live access plus code for a tier-1 telco is a high-value sale worth tracking.Access sale● 72
Venta de acceso y código fuente de SK TelecomA seller is advertising access to SK Telecom, one of South Korea's largest carriers, together with source code and internal data. Access plus source code is a high-value combination that enables network intrusion, subscriber-data theft, and IP exfiltration. Buyers could pivot into telecom critical infrastructure, so this warrants tracking and hunting for leaked credentials.Access sale● 48
Venta de webshell y acceso a base de datos de Malasia (0-day)A seller advertises an unauthenticated webshell with database access against a Malaysian target, framing it as a critical 0-day. Sale of ready-made webshell access is a direct precursor to data theft and ransomware deployment. Besides the direct victim, it signals an exploitable web-facing flaw that regional organizations running similar stacks should patch and hunt for.Access sale● 28
Accesos RDP con privilegios de administrador a la venta en un foro clandestinoA verified seller on the BlackBones carding forum advertises remote desktop access with administrator rights, the kind of foothold typically harvested from commodity infostealer logs and exposed RDP services. The post names no victim, country or IP range, so it cannot currently be tied to an Argentine or Latin American organisation, but admin RDP access is a standard entry point for ransomware affiliates and access brokers. Worth monitoring this seller for follow-up posts that list specific companies or geolocations.