BRIEFAccess salehighP78
Verified access to French government infrastructure for sale
Gobierno de Francia
Detected19 September 2026 · 16:23 UTC
A threat actor is offering verified access to one of the French government's infrastructures, a high-value initial-access sale. Such access enables lateral movement into public-sector networks, data theft or ransomware staging. A confirmed government intrusion is a strategic target demanding urgent validation and attribution.
CategoryAccess sale
Severityhigh
Priority score78
Detected19 September 2026 · 16:23 UTC
Access sale● 72
Datos de 656.000 personas y acceso al sistema de la Universidad de Hong KongA DarkForums listing claims 656,000 personal records from Hong Kong Metropolitan University plus access to its internal systems, combining a bulk data leak with a network foothold. University systems hold student, staff and research data, and access sales often precede ransomware or further intrusions against academic and public institutions in the region. The post date and proof samples were not visible, so recency and authenticity still need confirmation before escalation.Access sale● 78
Venta de acceso completo a la infraestructura del distrito municipal de Jinzhou (China)A seller on DarkNetArmy is advertising full infrastructure access to a Chinese municipal government district, including digital access to sensitive internal data. Government-grade access of this kind enables data theft, lateral movement and potential disruption of public services. It is a named, high-value government target that warrants monitoring even outside the LATAM region.Access sale● 38
Acceso a sistemas Windows con datos del sector salud de IránA poster on DarkForums claims to have gained access to Windows systems containing Iranian healthcare sector data and is offering it via a dox thread. Healthcare environments hold sensitive patient records and often run legacy Windows hosts prized by ransomware crews. Any confirmed access to Iranian health infrastructure raises risk of data theft and service disruption.Access sale● 88
Venta del sistema vehicular de la Ciudad de MéxicoThreat actor 'cenfecracked' is advertising the sale of Mexico City's vehicular system on DarkForums in a post dated 2 November 2026, implying access to or data from a municipal vehicle-registration/transport platform. Such systems hold owner PII, plate and verification records and support government services, so a compromise enables identity fraud and service disruption. It directly targets Latin American public infrastructure, making it a priority for regional defenders.Access sale● 45
Venta de acceso a una empresa comercial de OmánA Tor forum post advertises initial access to an Oman-based trading company. Purchased access to a named corporate target often precedes ransomware or business email compromise. Regional firms should review remote-access controls and authentication logs.Access sale● 56
Venta de acceso de administrador a la Universidad Técnica de Cluj-NapocaA darkforums.as listing advertises administrator-level access to utcluj.ro, the Technical University of Cluj-Napoca in Romania. With admin rights an intruder could reach student and staff records, research data and internal systems, and the seller presents it as a ready-to-use compromise rather than a raw credential.