BRIEFAccess salelowP42
Access to French government portal economie.gouv.fr (TRACFIN) for sale
economie.gouv.fr (TRACFIN)
Detected8 October 2026 · 21:21 UTC
An actor on DarkForums is offering access to economie.gouv.fr, the French Ministry of Economy and Finance portal that hosts TRACFIN, the country's financial-intelligence unit handling anti-money-laundering data. Compromise of this system could expose sensitive financial-crime investigations and state financial data. The thread is dated January 2026, so it is not a fresh alert, but it remains a high-value government target worth tracking.
CategoryAccess sale
Severitylow
Priority score42
Detected8 October 2026 · 21:21 UTC
Access sale● 30
Acceso a un panel (dashboard) de usuario ofrecido en foro clandestinoA forum user claims to have gained access to a dashboard belonging to a user and is advertising it for resale, posted within minutes of discovery. Details are scarce and no victim organization is named, but freshly harvested web-panel access can be resold and used for lateral movement. Defenders should watch for related credential-stuffing or panel-takeover attempts.Access sale● 42
Venta de 60.000 accesos a correos corporativosA seller is listing 60,000 'corporate' mailbox access credentials, refreshed on 08.10, intended for phishing and BEC-style abuse. Corporate mail access sales are a common precursor to invoice fraud and lateral movement against named organizations. The lack of an identified victim keeps impact moderate, but defenders should watch for credential-stuffing and inbox-rule abuse.
Access sale● 55
Venta de acceso de administrador y buzones de multinacionales de EE. UU.A seller is offering administrative and mailbox access to multiple large US multinational companies. This kind of persistent access enables business email compromise, internal phishing and lateral movement across corporate networks. Security teams at affected enterprises should review recent admin-account and mailbox activity.Access sale● 58
Venta de acceso a una organización médica de Estados UnidosA threat actor is advertising access to a US-based medical organization, typically via stolen credentials or remote access. Healthcare access sales feed ransomware deployment and theft of protected health data. Defenders in healthcare should treat this as an active intrusion opportunity to hunt for.Access sale● 30
Comprador busca cuentas bancarias de Chile y ColombiaA carding-forum post solicits the purchase of bank accounts from Chile and Colombia, indicating demand for mule or onboarding accounts in the region. This signals ongoing financial-fraud operations targeting Latin American banks. Relevant for regional AML and fraud defenders, though low individual impact.Access sale● 68
Base de datos del Ejército de Indonesia (TNI AD) a la ventaA forum seller posted a database purportedly belonging to TNI Angkatan Darat, the Indonesian Army, minutes ago. Sale of military personnel or asset data is high impact, enabling identity theft, targeting of service members and potential operational exposure. Though outside Latin America, military database sales are priority intelligence for defenders.