BRIEFAccess salecriticalP88
Mexico City vehicular system offered for sale
Sistema vehicular de la Ciudad de México
Detected3 November 2026 · 03:24 UTC
Threat actor 'cenfecracked' is advertising the sale of Mexico City's vehicular system on DarkForums in a post dated 2 November 2026, implying access to or data from a municipal vehicle-registration/transport platform. Such systems hold owner PII, plate and verification records and support government services, so a compromise enables identity fraud and service disruption. It directly targets Latin American public infrastructure, making it a priority for regional defenders.
CategoryAccess sale
Severitycritical
Priority score88
Detected3 November 2026 · 03:24 UTC
Access sale● 38
Acceso a sistemas Windows con datos del sector salud de IránA poster on DarkForums claims to have gained access to Windows systems containing Iranian healthcare sector data and is offering it via a dox thread. Healthcare environments hold sensitive patient records and often run legacy Windows hosts prized by ransomware crews. Any confirmed access to Iranian health infrastructure raises risk of data theft and service disruption.Access sale● 45
Venta de acceso a una empresa comercial de OmánA Tor forum post advertises initial access to an Oman-based trading company. Purchased access to a named corporate target often precedes ransomware or business email compromise. Regional firms should review remote-access controls and authentication logs.Access sale● 56
Venta de acceso de administrador a la Universidad Técnica de Cluj-NapocaA darkforums.as listing advertises administrator-level access to utcluj.ro, the Technical University of Cluj-Napoca in Romania. With admin rights an intruder could reach student and staff records, research data and internal systems, and the seller presents it as a ready-to-use compromise rather than a raw credential.Access sale● 66
Venta de 49 credenciales .env de un grupo inmobiliario del Reino UnidoA seller on NulledBB is offering 49 live .env credential sets taken from a single UK real-estate estate, claiming DNS-based attribution and same-day re-verification. Unlike combolists, .env files typically expose database, SMTP and API secrets, so this is server-side access rather than mere user passwords. If genuine, it gives a buyer a direct path into production infrastructure and customer data.Access sale● 38
Venta de 355 accesos de administrador a WordPressActor 'Hurbimor' posted a batch of roughly 355 working WordPress administrator and user credentials on DarkForums on 1 November 2026. Targets are unnamed, so value depends on which sites are compromised; admin access enables defacement, webshell deployment and data theft. Site owners running WordPress should check for rogue admin accounts.Access sale● 58
Venta de acceso a más de 1.000 redes corporativas empresarialesA BreachForums actor advertises a bulk catalogue of over 1,000 enterprise and corporate network accesses, presented as high-quality corporate footholds. Bulk access brokers of this type resell VPN, RDP and domain credentials that seed ransomware intrusions. Although no specific victim is named, organisations relying on remote-access infrastructure should assume their perimeter credentials may be listed.