BRIEFAccess salehighP65
Full database access to IRGC Ground Force Hospital (Iran) for sale
IRGC Ground Force Hospital (Iran)
Detected13 September 2026 · 04:12 UTC
A seller is offering full database access to the IRGC Ground Force Hospital, a military-affiliated medical facility in Iran. Such databases typically hold personnel records, patient identities and operational details, making it a high-value state/military target. Defenders tracking state-sponsored and healthcare-sector data theft should monitor this offer.
CategoryAccess sale
Severityhigh
Priority score65
Detected13 September 2026 · 04:12 UTC
Access sale● 42
Oferta de acceso a red o datos en DarkNetArmyA member is offering 'network access or data' on DarkNetArmy, a classic initial-access listing posted in early September. Without a named victim the impact is unclear, but such offers often precede ransomware intrusions. Worth querying the seller for sector and geography.Access sale● 40
Credenciales SSL VPN de Fortinet filtradas por fuerza brutaA collection of fresh Fortinet SSL VPN access credentials reportedly obtained via brute-force is being circulated on BreachForums. No specific victim is named and the seller frames it as 'training', but SSL VPN access to Fortinet appliances is a common entry point into government and critical-infrastructure networks. Defenders should assume these credentials may be reused for initial access.Access sale● 22
Venta de lote de 130 accesos root y admin de cPanel/WHMCSA seller lists 130 cPanel/WHMCS accounts with root, admin or user-level access, which would let buyers seize control of hosted websites and mail. This access type is a classic stepping stone to mass website compromise, credential theft and spam infrastructure. The post appears to date to 2022 and is stale, but affected hosts may still be vulnerable if credentials were never rotated.Access sale● 48
Venta de acceso web shell a servidores comprometidos (lote 10x)A seller is offering a batch of 10 freshly compromised web shells, granting remote code execution on the underlying servers without needing an exploit chain. No specific victim is named, but web shells are a common foothold used to pivot into hosting providers and their downstream customers. Defenders should hunt for unauthorized webshell artifacts and suspicious outbound callbacks.Access sale● 78
Acceso admin y defacement de la Universidad César Vallejo (Perú)Threat actor Keishell posted admin-level access to ucv.edu.pe, the Universidad César Vallejo in Peru, along with a website defacement, claiming over 200,000 students affected. This exposes student PII, staff credentials and internal systems to further intrusion or fraud. A large Latin American university is a valuable target for both data theft and reputational disruption.Access sale● 74
Venta de acceso de administrador a la infraestructura FTTH/GPON del ISP AlfatihnetA seller is offering administrative access to the FTTH/GPON infrastructure of ISP Alfatihnet, i.e. management control of a telecom operator's access network. Compromise of an ISP access layer enables traffic interception, subscriber data theft and mass service disruption across all customers. Telecom operators should verify and rotate credentials on exposed management interfaces immediately.