BRIEFAccess salehighP44
Zero-day RCE and local privilege-escalation exploit for sale
Detected24 September 2026 · 00:51 UTC
A seller on a Tor marketplace is offering a zero-day remote code execution chain plus local privilege-escalation and information-leak exploits, posted on 2026-09-21. No specific victim is named, so the risk is sector-agnostic, but unpatched RCE is a common entry point for enterprise and government intrusion. Defenders should track this actor and hunt for exploitation attempts.
CategoryAccess sale
Severityhigh
Priority score44
Detected24 September 2026 · 00:51 UTC
Access salePriority 80
Acceso admin completo a BigCommerce y fuga de 892 mil registrosA DarkForums actor is advertising full administrative access to bigcommerce.com plus a database of roughly 892,000 records. As a major US e-commerce platform hosting thousands of merchants, such access risks supply-chain compromise and theft of customer data across many stores. BigCommerce and its merchants should verify admin credentials and monitor for use of the leaked records.Access salePriority 62
Venta de acceso de administrador al portal gubernamental indio igrodisha.gov.inA DarkForums seller (Amirxx60) is advertising administrator-level access to igrodisha.gov.in, an Indian government portal, on November 7, 2026. Admin access to a government web system allows defacement, data theft or planting of malicious content and can serve as a foothold into broader government infrastructure. Buyers of such access typically move quickly, so the window to detect abuse is short.Access salePriority 66
Venta de 19.320 accesos al gobierno de MalasiaSeller RAZOR666 offered 19,320 access credentials allegedly tied to Malaysian government systems on DarkForums. Bulk government credentials are used for initial access, account takeover and lateral movement into public-sector networks. Government portals are high-value for espionage and fraud.Access salePriority 58
Venta de acceso de administrador de reventa de U.S. Heritage Telecom (Netsapiens)A seller on DarkNetArmy is offering reseller-level administrative access to U.S. Heritage Telecom's Netsapiens platform. This grants control over telecom routing and customer accounts, a valuable foothold for toll fraud, interception and lateral movement into telecom infrastructure. Access to a carrier's reseller portal is a high-value initial-access asset that defenders in telecom should track closely.Access salePriority 57
Venta de 666 accesos a paneles cPanel con supuesta validez del 90%A DarkForums seller (Ilkrovek, 1 November 2026) is offering 666 cPanel hosting control-panel credentials with an advertised 90% validity rate. Such accesses allow site defacement, hosting of phishing kits or malware on legitimate domains, and often pivot to mail accounts and customer data. No specific victims are named, so the exposure is sector-wide for hosting providers and website owners in the region.Access salePriority 70
Venta de acceso al servidor del banco malasio Bank RakyatA seller on DarkForums is advertising access to a server at bankrakyat.com.my, the domain of Malaysia's Bank Rakyat, offering it as a database/access sale. Access to a banking back-end can enable data theft, fraudulent transactions and lateral movement into payment systems. Financial institutions in the region should treat this as a potential intrusion indicator and check for unauthorized access paths.