BRIEFAccess salehighP78
Active Directory Domain Admin access to Indonesian firm for sale
Indonesian food & beverage company ($5B+ revenue)
Detected18 September 2026 · 23:12 UTC
A seller is offering Active Directory Domain Admin access to an Indonesian food & beverage company with over $5B in revenue. Domain Admin grants full control of the corporate network, enabling ransomware staging, lateral movement and mass data exfiltration. This is a high-value access listing that defenders at large enterprises should treat as a priority and monitor for related IOCs.
CategoryAccess sale
Severityhigh
Priority score78
Detected18 September 2026 · 23:12 UTC
Access sale● 45
Venta de acceso a una empresa comercial de OmánA Tor forum post advertises initial access to an Oman-based trading company. Purchased access to a named corporate target often precedes ransomware or business email compromise. Regional firms should review remote-access controls and authentication logs.Access sale● 56
Venta de acceso de administrador a la Universidad Técnica de Cluj-NapocaA darkforums.as listing advertises administrator-level access to utcluj.ro, the Technical University of Cluj-Napoca in Romania. With admin rights an intruder could reach student and staff records, research data and internal systems, and the seller presents it as a ready-to-use compromise rather than a raw credential.Access sale● 66
Venta de 49 credenciales .env de un grupo inmobiliario del Reino UnidoA seller on NulledBB is offering 49 live .env credential sets taken from a single UK real-estate estate, claiming DNS-based attribution and same-day re-verification. Unlike combolists, .env files typically expose database, SMTP and API secrets, so this is server-side access rather than mere user passwords. If genuine, it gives a buyer a direct path into production infrastructure and customer data.Access sale● 38
Venta de 355 accesos de administrador a WordPressActor 'Hurbimor' posted a batch of roughly 355 working WordPress administrator and user credentials on DarkForums on 1 November 2026. Targets are unnamed, so value depends on which sites are compromised; admin access enables defacement, webshell deployment and data theft. Site owners running WordPress should check for rogue admin accounts.Access sale● 58
Venta de acceso a más de 1.000 redes corporativas empresarialesA BreachForums actor advertises a bulk catalogue of over 1,000 enterprise and corporate network accesses, presented as high-quality corporate footholds. Bulk access brokers of this type resell VPN, RDP and domain credentials that seed ransomware intrusions. Although no specific victim is named, organisations relying on remote-access infrastructure should assume their perimeter credentials may be listed.Access sale● 33
Panel de administración del sitio brasileño ifut.com.br a la ventaA DarkForums actor (jackivaki2) is advertising administrative access to the Brazilian site ifut.com.br. If genuine, it grants full control over the site's content and backend, which can be leveraged for defacement, data theft or hosting malware. The target appears to be a small commercial site rather than critical infrastructure, so impact is limited but it is a live access offer dated today.