BRIEFAccess salehighP42
Sale of alleged foreign government access and EDR execution
Detected24 October 2026 · 17:56 UTC
A Spear marketplace seller advertises 'First-World Gov Access' together with EDR execution and crypto-seizure capabilities via a Telegram channel, implying network footholds in government environments. No specific victim, country or access type is named, so it is low-confidence and not clearly tied to Latin America. It is worth monitoring as a broker pitch but cannot be treated as a confirmed compromise.
CategoryAccess sale
Severityhigh
Priority score42
Detected24 October 2026 · 17:56 UTC
Access sale● 44
Venta de accesos a correos gubernamentales y ejecución EDRA seller advertises access to 'first-world' government email accounts, plus EDR execution and crypto-seizure capabilities, via a Telegram channel. The offer is vague and unverified, but public-sector mailbox access combined with endpoint/EDR execution are high-value initial-access traits typical of ransomware affiliates. Treat as a potential IAB offering with possible government targets.Access sale● 72
Acceso webshell (PHP2SHELL) a infraestructura energética de Omán a la ventaA seller is offering PHP2SHELL webshell access and an associated access database tied to Oman's energy infrastructure. Compromise of energy-sector systems can enable operational disruption and lateral movement between IT and OT networks. Defenders in regional energy operators should hunt for web-shell persistence and audit exposed PHP endpoints.Access sale● 45
Venta de acceso root a servidor completo cPanel/WHMAn actor is selling root-level control of a cPanel/WHM server, which typically means every hosted account, mailbox and database on that machine is exposed. The listing is roughly a month old and does not name the victim, so the value depends on whether the host serves government, telecom or financial customers. Buyers of such access usually pivot to mass defacement, spam and credential harvesting, so hosting providers in the region should audit WHM exposure.Access sale● 55
Acceso gratuito a VMware ESXi de la Universidad de DüsseldorfA forum post offers free access to a VMware ESXi host belonging to Heinrich Heine University Düsseldorf (hhu.de). ESXi access grants hypervisor-level control over hosted virtual machines, a high-impact foothold for lateral movement and ransomware. Treat the virtualization estate as potentially compromised until verified.Access sale● 55
Venta de clave empresarial de AWS Bedrock de alto rendimientoA seller is offering an AWS Bedrock enterprise key with '10k RPM' and unlocked model access, indicating stolen or abused cloud credentials. Such keys grant billable AI compute and access to internal model configurations, enabling fraud and data theft. Organizations running Bedrock should audit key issuance and anomalous usage.Access sale● 58
Venta de acceso RDP a la operadora iraní AsiatechA forum post exposes what it claims are live RDP IP addresses and usernames for Iran's Asiatech Data Transmission Co., an ISP and data carrier. Valid RDP credentials on a telecom backbone give intruders a foothold for lateral movement, traffic interception and downstream customer compromise. If any exposure is confirmed, force credential rotation and audit external RDP exposure immediately.