Underground · what matters today

Venta de acceso a estaciones terrestres y sistemas de control satelital (2026)

Satellite ground station / control systems operators

A seller claims full access to satellite ground station and control systems, a high-value critical-infrastructure target. If genuine, this could enable disruption or hijacking of satellite communications used by civil and military operators. Defenders in satellite and telecom should verify the claim and harden ground-segment access.

Acceso de administrador a la Universidad Técnica de Cluj-Napoca en venta

Technical University of Cluj-Napoca (utcluj.ro)

A threat actor is advertising administrative access to the Romanian university utcluj.ro, a real academic institution. Admin-level access to an .edu portal enables website defacement, luring of students/staff, and potential lateral movement into internal systems. It matters because verified admin access to a named organization is directly monetizable and actionable for defenders.

Venta de acceso de administrador al sitio whatsva.id (Indonesia)

whatsva.id (Indonesia)

DarkForums user OnlineSh0p3 is offering administrative access to the Indonesian site whatsva.id. The target is a small website rather than a strategic organization, so impact is limited and it lies outside the region of interest. It is surfaced only as a low-priority access-sale datapoint.

Venta de acceso interno con webshells y credenciales a entidades gubernamentales

A seller on DarkForums is advertising internal access bundles containing webshells, credentials and databases, explicitly mentioning government targets. Access of this kind gives an attacker a foothold to move laterally and exfiltrate sensitive data. The post is roughly two months old and names no specific victim or region, so it is only marginally actionable now.

Venta de acceso al portal gubernamental francés economie.gouv.fr (TRACFIN)

economie.gouv.fr (TRACFIN)

An actor on DarkForums is offering access to economie.gouv.fr, the French Ministry of Economy and Finance portal that hosts TRACFIN, the country's financial-intelligence unit handling anti-money-laundering data. Compromise of this system could expose sensitive financial-crime investigations and state financial data. The thread is dated January 2026, so it is not a fresh alert, but it remains a high-value government target worth tracking.