BRIEFAccess salehighP71
Access to a Uruguayan organization offered for sale
Organización en Uruguay (no identificada)
Detected6 November 2026 · 08:43 UTC
User 'AndesCrypto' posted on DarkForums today an offer titled 'Access Uruguay', indicating network access to a Uruguayan entity is being sold. Initial-access sales at this level often precede ransomware deployment and lateral movement into regional partners. Uruguayan organizations in finance, government and critical services should assume possible exposure and review perimeter and VPN logs.
CategoryAccess sale
Severityhigh
Priority score71
Detected6 November 2026 · 08:43 UTC
Access salePriority 52
Venta de acceso admin al sitio gov.in igrodisha (India)A seller on DarkForums is advertising administrative access to igrodisha.gov.in, an Indian government portal. Administrative access to a government web property enables content tampering, data theft and hosting of phishing or malware under a trusted domain. Although outside the Latin American region, it is a concrete named government access sale relevant to public-sector defenders tracking government-targeting brokers.Access salePriority 64
Venta de acceso admin a empresa de automatización de almacenes (Nórdicos)An access broker is selling CI admin, SYSTEM and SQL-level footholds inside a Nordic warehouse-automation company with over EUR 250M in revenue, listed in the DarkForums access market. This is enterprise-grade network and database access to an industrial automation provider, a supply-chain and OT-adjacent target. Such access enables ransomware staging and data theft, and buyers should be assumed capable of moving quickly.Access salePriority 72
Venta de acceso de administrador a la tienda costarricense factoa.netSeller Halvvutir posted on DarkForums on 5 November 2026 offering administrative access to the Costa Rican online shop factoa.net. Admin panel access exposes orders, pricing and customer records and can be chained into payment-gateway or logistics abuse. Costa Rican e-commerce operators should verify whether the compromise is real and rotate panel credentials.Access salePriority 54
Venta de acceso de insider a Coinbase (octubre 2026)DarkForums user Leaksprovider is selling a purported insider lead at Coinbase, the US crypto exchange, in a thread dated October 2026. An insider foothold can expose customer data, internal systems and controls far beyond what external attackers achieve. Crypto firms face direct financial-loss and reputational risk from such offers.Access salePriority 55
Venta de acceso completo a la infraestructura de un editor de juegos móvilesA DarkForums seller is advertising full access to a mobile game publisher's infrastructure in the Access Market section, currently open on the forum. Full-infrastructure access typically means domain, cloud or CI/CD control, giving a buyer the ability to push malicious updates to end users. The victim is unnamed but the offer is time-sensitive because such listings usually sell within days.Access salePriority 66
Credenciales de usuarios de CLARU Perú publicadas en DarkForumsA DarkForums actor using the handle z4p3r0c0 posted a set of user accesses for CLARU Perú on 5 November 2026. Although the volume is not stated in the snippet, leaked account credentials for a Peruvian service let attackers attempt account takeover and credential stuffing against linked platforms. Peruvian organisations and customers of the platform should treat these credentials as compromised and rotate them.