BRIEFAccess salehighP42
Admin-level RDP access offered for sale
Detected21 October 2026 · 15:00 UTC
A seller on BlackBones is advertising RDP access with administrative privileges, a common initial-access vector for network intrusion and ransomware staging. No specific victim or geolocation is named, so the direct exposure is unknown, but buyers of such access typically use it for lateral movement and data theft. Defenders should treat admin RDP as a high-value foothold and enforce MFA, restrict RDP exposure and monitor for credential reuse.
CategoryAccess sale
Severityhigh
Priority score42
Detected21 October 2026 · 15:00 UTC
Access sale● 62
Venta de acceso a la base de datos de NIO Power en ChinaA seller is offering access to NIO Power China's database containing user information such as phone numbers and addresses. NIO Power runs EV battery-swap and charging infrastructure, so customer and location records are tied to mobility operations rather than a generic webshop. The data supports phishing, physical tracking and further intrusion attempts against the operator's suppliers.Access sale● 70
Venta de acceso, código fuente y datos de SK TelecomA seller claims to hold corporate access to SK Telecom together with stolen source code and internal data, presenting it as a large-corporation intrusion. SK Telecom is South Korea's largest telecom operator, so repository and access exposure can be chained into network and customer-system compromise. The post is undated, but live access plus code for a tier-1 telco is a high-value sale worth tracking.Access sale● 72
Venta de acceso y código fuente de SK TelecomA seller is advertising access to SK Telecom, one of South Korea's largest carriers, together with source code and internal data. Access plus source code is a high-value combination that enables network intrusion, subscriber-data theft, and IP exfiltration. Buyers could pivot into telecom critical infrastructure, so this warrants tracking and hunting for leaked credentials.Access sale● 48
Venta de webshell y acceso a base de datos de Malasia (0-day)A seller advertises an unauthenticated webshell with database access against a Malaysian target, framing it as a critical 0-day. Sale of ready-made webshell access is a direct precursor to data theft and ransomware deployment. Besides the direct victim, it signals an exploitable web-facing flaw that regional organizations running similar stacks should patch and hunt for.Access sale● 28
Accesos RDP con privilegios de administrador a la venta en un foro clandestinoA verified seller on the BlackBones carding forum advertises remote desktop access with administrator rights, the kind of foothold typically harvested from commodity infostealer logs and exposed RDP services. The post names no victim, country or IP range, so it cannot currently be tied to an Argentine or Latin American organisation, but admin RDP access is a standard entry point for ransomware affiliates and access brokers. Worth monitoring this seller for follow-up posts that list specific companies or geolocations.Access sale● 40
Venta de acceso cPanel a saj.org.sa de Arabia SauditaA seller offers cPanel access to saj.org.sa, a Saudi organization. Web-panel access enables site defacement, mail interception and malware hosting. It is a mid-value target outside the region but relevant for tracking access-sale activity.