BRIEFAccess salelowP44
AWS SES CLI access with 50K/1M send limits for sale
AWS SES
Detected12 November 2026 · 12:13 UTC
A threat actor posting on DarkForums is selling CLI access to AWS Simple Email Service with quotas of 50,000 to 1 million messages. Such access lets buyers send high-volume phishing or spam from a trusted cloud domain, helping them bypass many email filters. Defenders should monitor AWS SES sending anomalies and enforce sending authorization and configuration-set controls.
CategoryAccess sale
Severitylow
Priority score44
Detected12 November 2026 · 12:13 UTC
Access salePriority 24
Venta de acceso RDP con privilegios de administrador en BlackBonesA verified seller on BlackBones has been offering remote desktop access with administrator rights since January 2025, with the thread still being bumped in November 2026. The listing is generic and does not name a victim, sector or country, so it cannot be tied to a specific organization. It is relevant only as background on the RDP brokerage market, since such access is routinely used for ransomware staging and lateral movement.Access salePriority 58
Venta de acceso a portales bancarios online de UcraniaAn actor advertising on BlackBones under 'Unverified Ads' is offering access to Ukrainian bank online portals. If genuine, such access enables account takeover, fraudulent transfers and further intrusion into banking infrastructure. Ukrainian financial institutions and their customers should treat this as a possible credential or session compromise.Access salePriority 38
Venta de acceso de administrador al sitio del servicio de ambulancias de HanóiA forum seller on DarkForums is offering administrative access to hanoiambulances.vn, the website of an emergency medical transport provider in Vietnam. Admin panels of health and emergency services allow content tampering, data theft of patient requests and abuse of the domain for phishing. Scale and access method are not disclosed, so impact is limited but worth tracking for the health sector.Access salePriority 55
Venta de acceso admin a la Universidad Técnica de Cluj-NapocaA DarkForums listing offers administrative access to utcluj.ro, the Technical University of Cluj-Napoca in Romania. Campus admin access can be leveraged to reach student records, internal systems and to pivot toward supply-chain partners. Access to a major technical university is a credible stepping stone for further intrusion.Access salePriority 62
Venta de acceso admin al portal gov.in de Odisha, IndiaThreat actor Mellirix is selling administrative access to the Indian government portal igrodisha.gov.in on DarkForums. Admin control could expose citizen registration records and allow tampering with official services. Government portal compromises are high-value for fraud and data theft.Access salePriority 66
Venta de acceso root y VPN a una pasarela corporativa de VietnamA seller on BreachForums' Access Market is offering a root shell on a Vietnamese corporate gateway together with working VPN accounts. This is a concrete initial-access sale combining privileged shell access and valid VPN credentials, which can be used for lateral movement, data theft or ransomware staging. Defenders should treat it as an active intrusion capability against exposed enterprise gateways.