BRIEFAccess salehighP58
RDP access to Iranian operator Asiatech offered for sale
Asiatech Data Transmission Co., Iran
Detected24 October 2026 · 01:14 UTC
A forum post exposes what it claims are live RDP IP addresses and usernames for Iran's Asiatech Data Transmission Co., an ISP and data carrier. Valid RDP credentials on a telecom backbone give intruders a foothold for lateral movement, traffic interception and downstream customer compromise. If any exposure is confirmed, force credential rotation and audit external RDP exposure immediately.
CategoryAccess sale
Severityhigh
Priority score58
Detected24 October 2026 · 01:14 UTC
Access sale● 55
Venta de clave empresarial de AWS Bedrock de alto rendimientoA seller is offering an AWS Bedrock enterprise key with '10k RPM' and unlocked model access, indicating stolen or abused cloud credentials. Such keys grant billable AI compute and access to internal model configurations, enabling fraud and data theft. Organizations running Bedrock should audit key issuance and anomalous usage.Access sale● 42
Venta de correos gubernamentales y ejecución de EDRA seller advertises verified government email accounts alongside 'direct EDR execution' and crypto-freezing services, signaling a broker offering initial access into government environments. No specific country is named, but compromised gov mailboxes are prime phishing and BEC vectors. Public-sector email and endpoint teams should treat this as a credential-abuse and access-brokerage risk.Access sale● 44
Venta de accesos RDP genéricos por el proveedor HHMA long-running marketplace seller (HHM) advertises cheap RDP accesses to buyers, a common entry point for ransomware affiliates. While the specific victim is unspecified, bulk RDP sales fuel server compromise and lateral movement against businesses. Defenders should enforce RDP hardening, MFA and exposure monitoring accordingly.Access sale● 46
Registros de stealer vinculados al dominio GENCAT (Generalitat)A stealer-log post referencing the GENCAT domain (the Catalan government abbreviation) appeared, potentially containing employee credentials and session data. Stealer logs for a public administration can enable account takeover, BEC and access to internal services. Scope is unconfirmed, but government-linked credentials merit verification and forced resets.Access sale● 45
Venta de acceso VPN al gobierno municipal de IndonesiaA threat actor is advertising VPN access to an Indonesian city government network on a breach forum, though the details sit behind a login wall. Government remote-access footholds are high-value because they open paths into municipal systems, citizen records and internal services. Despite being outside AR-LATAM, this is a genuine government access sale worth tracking for actor overlaps and credential reuse.Access sale● 58
Venta de acceso RCE y MySQL al sitio de City X-Ray ClinicA seller is offering full access to cityxrayclinic.com obtained via RCE plus direct MySQL database access. That level of foothold lets an attacker read patient and staff records, tamper with bookings, or pivot into internal systems. Medical sites are high-value for extortion and downstream identity theft.