BRIEFAccess salehighP46
Stealer logs tied to the GENCAT (Catalan government) domain
GENCAT (Generalitat de Catalunya)
Detected23 October 2026 · 18:15 UTC
A stealer-log post referencing the GENCAT domain (the Catalan government abbreviation) appeared, potentially containing employee credentials and session data. Stealer logs for a public administration can enable account takeover, BEC and access to internal services. Scope is unconfirmed, but government-linked credentials merit verification and forced resets.
CategoryAccess sale
Severityhigh
Priority score46
Detected23 October 2026 · 18:15 UTC
Access sale● 44
Venta de accesos RDP genéricos por el proveedor HHMA long-running marketplace seller (HHM) advertises cheap RDP accesses to buyers, a common entry point for ransomware affiliates. While the specific victim is unspecified, bulk RDP sales fuel server compromise and lateral movement against businesses. Defenders should enforce RDP hardening, MFA and exposure monitoring accordingly.Access sale● 45
Venta de acceso VPN al gobierno municipal de IndonesiaA threat actor is advertising VPN access to an Indonesian city government network on a breach forum, though the details sit behind a login wall. Government remote-access footholds are high-value because they open paths into municipal systems, citizen records and internal services. Despite being outside AR-LATAM, this is a genuine government access sale worth tracking for actor overlaps and credential reuse.Access sale● 58
Venta de acceso RCE y MySQL al sitio de City X-Ray ClinicA seller is offering full access to cityxrayclinic.com obtained via RCE plus direct MySQL database access. That level of foothold lets an attacker read patient and staff records, tamper with bookings, or pivot into internal systems. Medical sites are high-value for extortion and downstream identity theft.Access sale● 63
Venta de acceso completo a servidor vía webshell WSO (Tpadmin)A seller is advertising full server access obtained through a WSO webshell, a common upload/persistence mechanism after a web compromise. Full server-level access lets a buyer deploy ransomware, harvest credentials, or pivot into internal networks, so it appeals to access brokers and ransomware affiliates. The victim identity and scope are not disclosed and the thread is behind a login wall, so authenticity is unverified.Access sale● 45
Reventa de acceso root a una gran empresa a la ventaA seller is re-selling root-level access to a large enterprise server, indicating a full-system compromise already obtained. Root access lets an intruder persist, steal data, deploy ransomware or resell further, making this a serious initial-access offering. Though the victim is unnamed and the post locked, root footholds to sizable organizations are rare and worth monitoring.Access sale● 50
Acceso SSLVPN a una gran corporación a la ventaA forum listing advertises SSL VPN access to a large corporate network, a classic initial-access vector for ransomware and espionage actors (VPN appliances are frequently the entry point in recent intrusions). While the target is unnamed and the post is login-walled, a live corporate SSLVPN foothold is high-value and time-sensitive; if the buyer is regional this could be significant. SSLVPN access combined with valid credentials quickly enables internal reconnaissance and domain compromise.