BRIEFAccess salehighP48
Live citizenship database access for a CIS .gov country for sale
Detected23 September 2026 · 04:29 UTC
A seller is offering live access to a government citizenship database belonging to an ex-Soviet/CIS country on a .gov domain. Live database access lets buyers query and exfiltrate citizen records on demand, a serious state-grade exposure. It is outside Latin America but shows an active market for direct government database access.
CategoryAccess sale
Severityhigh
Priority score48
Detected23 September 2026 · 04:29 UTC
Access sale● 52
Exploit de día cero de WordPress con webshell automáticaA seller is advertising a private WordPress zero-day brute-force exploit bundled with automatic webshell upload, posted as recently as late September 2026. Such a tool enables mass compromise of vulnerable WordPress sites, granting attackers persistent remote access. Defenders hosting WordPress should prioritize patching and monitor for unexpected PHP files and webshells.Access sale● 55
Venta de RCE y 0days de escalada local (ROTR)A seller is advertising RCE exploits, an information leak, and local privilege-escalation 0-days under the 'ROTR' label, posted 2026-09-21. Fresh, working exploits of this type enable rapid intrusion into unpatched systems. Although no specific victim is named, defenders should track it for imminent exploitation activity.Access sale● 38
Venta de acceso admin al portal educativo australiano eit.edu.net.auA forum user is advertising administrator-level access to eit.edu.net.au, an Australian education site, dated March 2026. Admin access to an academic portal can enable data theft, defacement or lateral movement into connected systems. The listing is already months old, so it is a stale access offer rather than a live incident.Access sale● 62
Venta de acceso a un centro de mando de tráfico gubernamental en IránA seller on DarkForums is advertising access to the Iranian Smart Traffic Control Command Center of the Tehran Traffic Police, a government-operated transport/critical-infrastructure system. If genuine, control-plane access to traffic signalling and monitoring could enable physical disruption and safety incidents, not just data theft. It shows access brokers pursuing government OT/ICS targets and is worth tracking for TTPs even though the region is outside LATAM.Access sale● 55
Venta de acceso a cuenta corporativa de una empresa de TIA threat actor is selling access to a corporate Microsoft account along with Tally Prime accounting software tied to an IT company. This kind of access enables business email compromise, invoice fraud and lateral movement into the victim's finance systems. Buyers typically use such credentials for wire fraud and data theft.Access sale● 52
Venta de acceso de administrador a la web paquistaní Pomilights.pkA threat actor is selling administrator-level access to Pomilights.pk, a Pakistani online retailer, in a DarkForums thread dated 24-08-2026. Admin access to a live storefront enables customer-data theft, web-skimming injection and defacement, and is a concrete initial-access sale rather than generic chatter. It is worth surfacing as a real access offer even though the victim is outside LATAM.