BRIEFAccess salelowP38
RMM access (ScreenConnect/SimpleHelp) sold for initial access
Detected1 October 2026 · 06:47 UTC
A seller is advertising paid access to ScreenConnect, SimpleHelp and other RMM platforms, which ransomware affiliates commonly abuse for initial access and lateral movement. No specific victim is named, so this is a capability/service rather than a confirmed intrusion. Defenders should hunt for unauthorized RMM sessions and enforce MFA on remote-management tools.
CategoryAccess sale
Severitylow
Priority score38
Detected1 October 2026 · 06:47 UTC
Access sale● 55
Venta de acceso a sitio gubernamental indio (mgovcloud.in)A seller is offering access to accounts.mgovcloud.in, an Indian government portal, claiming to reveal classified documents. Sales of government access enable espionage, data theft and further intrusion into state systems. Defenders should monitor for credential abuse and unauthorized logins to that domain and treat the claim as an active access offer.Access sale● 78
Venta de acceso inicial a la india Bharti AirtelA threat actor is advertising initial access to Bharti Airtel, one of India's largest telecom operators, in a freshly posted forum thread. Telecom access is high-impact, enabling subscriber-data theft, interception and lateral movement into critical infrastructure. Although outside LATAM, a named telecom access sale warrants tracking and notification.Access sale● 60
Venta de cuentas de correo de gobiernos y policía de España y EuropaA seller is advertising access to European and Spanish government and law-enforcement email accounts, a high-value foothold for phishing, fraud or espionage against public bodies. Although Spain is outside AR-LATAM, compromised official mailboxes can be leveraged for trusted-sender attacks against regional counterparts. Public-sector defenders in Spanish-speaking regions should monitor for reuse of these accounts and leaked credentials.Access sale● 24
Venta de acceso de administrador a una escuela secundariaA forum user is offering administrative access to a high school, posted just minutes ago. The access could let an attacker pivot into student records, internal email or learning platforms. The target is unnamed and low-value, so it ranks near the bottom of the feed.Access sale● 66
Venta de acceso admin a gran empresa española con TPV y 2.000 clientesA seller advertises administrative access to a large unnamed Spanish company plus point-of-sale (TPV) access and more than 2,000 client accounts. Admin access of this type enables payment fraud, mass data theft and lateral movement into internal systems. It is a serious access sale but the victim is in Spain rather than Argentina/LATAM, so impact is regional rather than directly local.Access sale● 63
Bases de datos y acceso root de universidades libanesas (*.edu.lb)The Zelda Group is offering databases of Lebanese *.edu.lb universities together with server root access, dated 2026. Server root plus student data gives full control of academic infrastructure and a supply of personal records for fraud. It is a high-impact access sale that defenders of Lebanese education networks should investigate.