BRIEFAccess salecriticalP90
Sale of RENAPER API access and Argentine government databases
RENAPER (Registro Nacional de las Personas, Argentina)
Detected28 August 2026 · 22:15 UTC
A seller is offering access to an API service tied to RENAPER, Argentina's national identity registry, along with other government databases. This would allow doxing, identity theft, and large-scale fraud against Argentine citizens. It is a direct threat to critical government infrastructure and must be treated as a high-priority incident.
CategoryAccess sale
Severitycritical
Priority score90
Detected28 August 2026 · 22:15 UTC
Access sale● 62
Venta de acceso VPN OpenVPN a un SaaS de IndonesiaA seller is offering OpenVPN access to an Indonesian technology/SaaS firm reported to have $1B-$5B in revenue. VPN credentials give a foothold into internal networks, enabling lateral movement and data theft. Access to a high-revenue enterprise is a classic precursor to ransomware and merits monitoring even outside the region.Access sale● 68
Venta de acceso a la pasarela de pago GeideaA seller on the Spear marketplace is offering access tied to the Geidea payment gateway, a major card processor in the Middle East. Compromise of a gateway exposes merchant transactions, settlement flows and cardholder data, enabling large-scale fraud. Payments and banking defenders should treat this as a live access-sale threat and hunt for related indicators.Access sale● 52
Venta de acceso a los laboratorios Ampath de SudáfricaA seller on the Spear forum is offering access tied to Ampath Laboratories in Zululand, South Africa, one of the country's largest private pathology networks. Selling access to a healthcare laboratory risks patient-data exposure and disruption of diagnostic services. Defenders in the diagnostic-healthcare sector should watch for credential stuffing and VPN/RDP intrusion attempts.Access sale● 74
Acceso a GitLab de gobiernos de varios países filtradoA threat actor claims GitLab repositories belonging to multiple national governments were leaked, exposing source code, pipeline secrets and internal projects. Such access frequently yields credentials, CI/CD tokens and infrastructure details for follow-on intrusions. Any Latin American agency among the victims must be identified quickly and forced to rotate secrets.Access sale● 56
Venta de 535 accesos a paneles cPanel (admin y usuario)A DarkForums seller is offering 535 cPanel credentials split between admin and user accounts, posted about four hours before collection. Hosting control-panel access lets an attacker deploy webshells, deface sites and pivot to mail or databases on the same server. Any org hosted on shared cPanel infrastructure should test these credentials and rotate keys.Access sale● 42
Venta de acceso de administrador a la Universidad Técnica de Cluj-NapocaAn actor advertises administrative access to utcluj.ro, the Technical University of Cluj-Napoca in Romania. Website admin access typically enables defacement, data theft and lateral movement into university infrastructure. It is a legitimate access-sale indicator, though the target lies outside the AR-LATAM region.