Underground · what matters today

Venta de acceso de administrador a wanderlustadventure.com.in (India)

wanderlustadventure.com.in

An actor is selling admin access to wanderlustadventure.com.in, an Indian travel site, in a listing posted minutes ago. Admin-panel access enables defacement, data theft and use of the site for further abuse. It is a low-value regional target, but the freshly sold access warrants basic monitoring.

Venta de acceso de administrador al backend de hoteligy.com (España)

hoteligy.com

A seller is offering admin access to the backend of hoteligy.com, a Spanish hospitality website, posted minutes ago. Backend access lets an attacker exfiltrate customer and booking data or deface the site. Spanish-speaking defenders should validate the claim and review web-facing admin panels for compromise.

Venta de acceso de administrador a la Universidad Técnica de Cluj-Napoca

Universidad Técnica de Cluj-Napoca (utcluj.ro)

A threat actor is advertising administrative access to utcluj.ro, the Romanian Technical University of Cluj-Napoca, posted today. Selling admin access to a university enables data theft, ransomware staging and abuse of student and research systems. The institution should rotate credentials and audit for unauthorized admin sessions.

Venta de acceso SSH root vía exploit Segfault

A user is sharing a 'free root SSH shell' obtained through the Segfault exploit, indicating a live remote-access capability to an unspecified host. Without a named victim the operational value is limited, but root-level SSH access can be resold or chained. Worth a low-priority watch only.

Venta de acceso VPN OpenVPN a un SaaS de Indonesia

Indonesian SaaS company

A seller is offering OpenVPN access to an Indonesian technology/SaaS firm reported to have $1B-$5B in revenue. VPN credentials give a foothold into internal networks, enabling lateral movement and data theft. Access to a high-revenue enterprise is a classic precursor to ransomware and merits monitoring even outside the region.

Venta de acceso a la pasarela de pago Geidea

Geidea

A seller on the Spear marketplace is offering access tied to the Geidea payment gateway, a major card processor in the Middle East. Compromise of a gateway exposes merchant transactions, settlement flows and cardholder data, enabling large-scale fraud. Payments and banking defenders should treat this as a live access-sale threat and hunt for related indicators.

Venta de acceso a los laboratorios Ampath de Sudáfrica

Ampath Laboratories

A seller on the Spear forum is offering access tied to Ampath Laboratories in Zululand, South Africa, one of the country's largest private pathology networks. Selling access to a healthcare laboratory risks patient-data exposure and disruption of diagnostic services. Defenders in the diagnostic-healthcare sector should watch for credential stuffing and VPN/RDP intrusion attempts.

Acceso a GitLab de gobiernos de varios países filtrado

Múltiples gobiernos nacionales

A threat actor claims GitLab repositories belonging to multiple national governments were leaked, exposing source code, pipeline secrets and internal projects. Such access frequently yields credentials, CI/CD tokens and infrastructure details for follow-on intrusions. Any Latin American agency among the victims must be identified quickly and forced to rotate secrets.

Venta de 535 accesos a paneles cPanel (admin y usuario)

A DarkForums seller is offering 535 cPanel credentials split between admin and user accounts, posted about four hours before collection. Hosting control-panel access lets an attacker deploy webshells, deface sites and pivot to mail or databases on the same server. Any org hosted on shared cPanel infrastructure should test these credentials and rotate keys.

Venta de acceso de administrador a la Universidad Técnica de Cluj-Napoca

Technical University of Cluj-Napoca (utcluj.ro)

An actor advertises administrative access to utcluj.ro, the Technical University of Cluj-Napoca in Romania. Website admin access typically enables defacement, data theft and lateral movement into university infrastructure. It is a legitimate access-sale indicator, though the target lies outside the AR-LATAM region.

Venta de acceso al sistema de nómina de las Fuerzas Armadas de Malasia

Malaysian Armed Forces

A seller is offering access to the payroll system of the Malaysian Armed Forces, a national military target. If genuine, this exposes personnel records, salary data and internal systems, enabling fraud and further intrusion. Military payroll access is a high-value initial-access commodity that defenders should treat as a priority lead.

Acceso de administrador a servicio francés de alojamiento empresarial

A vendor is selling administrator access to a French business-accommodation service platform. Admin access exposes customer records and backend infrastructure, enabling data theft and onward intrusion. The buyer can pivot to the platform's corporate clients.

Acceso de administrador a sitio web del gobierno de Indonesia a la venta

ciptakarya.pu.go.id (Indonesia)

A seller is offering administrative access to ciptakarya.pu.go.id, an Indonesian government portal. Full admin control of a public-sector site enables defacement, data theft, and use as a pivot into internal systems. Defenders should treat it as a confirmed gov-site compromise and check for similar credentials or webshells.

Base de datos y acceso admin del sitio bppra.gob.pk a la venta

bppra.gob.pk (Pakistán)

A seller is offering a database plus administrative access for bppra.gob.pk, a Pakistani government procurement authority. Admin access to a government web platform enables data exfiltration, defacement and lateral movement into related public infrastructure. Government procurement portals hold supplier and citizen data, so this should be treated as an active breach.

Venta de 535 accesos cPanel de administrador y usuario

An actor is selling 535 cPanel credentials split between admin and standard users, giving buyers hosting-panel control over compromised websites. Such access enables website defacement, malware hosting, mail abuse and lateral movement into customer data. Hosting and web teams should hunt for unauthorized cPanel logins and rotated credentials.

Venta de acceso de administrador a tradeasia.com (Singapur)

tradeasia.com

A seller listed administrator access to tradeasia.com, a Singapore-based trading firm, on a darkweb forum. Admin access could let an attacker pivot into corporate systems, email and customer data. Any organization relying on similar platforms should review its exposure.

Posible venta de acceso o datos de la teleco KPN (Países Bajos)

KPN

A VIP seller posted 'KPN Netherlands' yesterday, indicating either network access to or data from the Dutch incumbent telecom, a national critical-infrastructure operator. Telecom compromises enable subscriber-data exposure, SIM-related fraud and lateral attacks. Dutch and EU defenders should treat this as a time-sensitive claim to validate.

Venta de acceso completo a los servidores de Goldunited

Goldunited

A threat actor using the handle Blacknet00 claims to be selling full access to the servers of a company called Goldunited. Full server access implies deep compromise that can enable data theft, lateral movement and ransomware deployment against the victim and its partners. Any organization sharing infrastructure or supply-chain ties with this entity should urgently verify exposure.

Base de datos de 838 GB y acceso FTP de dmp.com.tw a la venta

dmp.com.tw

A seller is offering an 838 GB database from the Taiwanese firm dmp.com.tw together with live FTP server access. Live FTP credentials are a direct intrusion vector enabling data theft, defacement or lateral movement. Buyers of such access should be treated as an active threat to that network.

Venta de acceso de administrador a la biblioteca vietnamita thuvienonline.com.vn

thuvienonline.com.vn

A forum user is offering administrator access to thuvienonline.com.vn, a Vietnamese online library web application. Although low-value, admin access enables data theft, defacement or use of the host as a pivot for further attacks. It is marginal for LATAM/government defenders but illustrates ongoing low-tier access sales worth monitoring.

Acceso admin de webmail de tienda italiana de alimentos a la venta

Italian food & confectionery online store (unnamed)

A seller on DarkForums is offering administrative webmail access to an Italian food and confectionery online retailer. Webmail admin control lets an attacker read all mail, trigger password resets and mount business email compromise against the company and its partners. Retailers and their supply-chain contacts should rotate mailbox credentials and monitor for suspicious logins.

Venta de acceso al panel de la tienda aavaz.biz

aavaz.biz

A seller on BreachForums is offering access to the store administrator panel of the e-commerce site aavaz.biz. Control of a store backend typically exposes customer orders, payment data and the ability to plant skimmers or fraudulent checkout logic. Site operators and payment-fraud teams should audit admin credentials and access logs.

Venta de acceso RDP a una gran instalación médica de Arabia Saudita

Large medical facility (Saudi Arabia)

A seller is advertising RDP access to a large medical facility in Saudi Arabia generating $70M-$100M in revenue, indicating a serious network foothold. Initial access like this is typically used for ransomware deployment or data theft, making it a high-value target for buyers. Healthcare defenders should treat such offers as an imminent intrusion signal.

Venta de acceso VPN Pulse Secure a una firma legal turca

Turkish legal services firm ($1B-$5B revenue)

A seller on the Spear marketplace is offering Pulse Secure SSL-VPN access to a legal services company in Turkey with an estimated $1B-$5B revenue. VPN access at this scale typically enables direct entry into corporate networks, lateral movement and ransomware staging. The post is dated 08 Oct 2026, so the access is likely live and actionable for defenders to hunt and remediate.