Underground · what matters today
The underground stories that broke through this window. Gov/mil, access sales, ransomware, leaks, stealers. Screenshots and context on each.
Distribution by category · window
- Gov / Military51
- Access sale27
- Ransomware17
- Leak382
- Stealer0
- Other4
Window
Category
Severity
Filtración de 3,8 GB de drones militares de Corea del Sur
Corea del Sur (programa UAV militar)
3.8 GB of documents purportedly covering South Korea's military UAV/drone programs has surfaced on a dark forum. Exposure of drone specifications, operations or procurement data is highly sensitive for national defense and useful to adversaries for targeting and intelligence. Posted roughly an hour ago, it warrants immediate follow-up.
Filtración de documentos del Ejército de EE. UU.
US Army
A threat actor claims to have leaked US Army documents, potentially exposing internal military material. Even partial leaks of US military documents can reveal tactics, personnel or infrastructure and are attractive for follow-on targeting. Freshly posted and notable for defense-sector monitoring.
Filtración de base de datos de la Policía Municipal de Tijuana
Policía Municipal de Tijuana
A threat actor posted a leaked database of Tijuana's Municipal Police on a dark web forum minutes ago. Police data typically exposes officer identities, citizen reports, addresses and case records, enabling extortion, doxxing and targeting of security personnel in a cartel-affected border city. Mexican law-enforcement bodies should verify the leak and hunt for related compromise.
Filtración de base de datos del servicio ECU 911 de Ecuador
ECU 911 (Servicio Integrado de Seguridad)
A database attributed to ECU 911, Ecuador's integrated emergency and security service, is being offered on a dark web forum just minutes after posting. Emergency services hold caller data, incident locations, response logs and coordination details across police, fire and ambulance, so exposure risks operational disruption and citizen harm. This is critical national infrastructure and should be treated as an urgent incident.
Filtración de accesos a GitLab de gobiernos de varios países
Government GitLab instances (multiple countries)
An actor claims to have leaked administrative GitLab access tied to government organizations in several countries, which can expose source code, pipeline secrets and internal tooling. Compromise of a government GitLab enables supply-chain attacks and lateral movement into other public-sector systems. LATAM agencies should treat this as a priority credential-rotation event.
Filtración de la base de datos del Departamento de Planificación de Malaca (Malasia)
Melaka State Town and Country Planning Department
A dump advertised as data from the Melaka State Town and Country Planning Department in Malaysia appeared on a hacking forum. Exposure of a government planning body's records can reveal citizen, land-use and internal administrative data. Even if the leak is partial, it warrants monitoring for follow-on social engineering and public-sector fraud.
Filtración de base de datos de la Policía de Carreteras de Pakistán (NHMP)
National Highways and Motorway Police (Pakistan)
The 'Pretty Kitten' crew is leaking a database belonging to Pakistan's National Highways and Motorway Police (NHMP). A law-enforcement database leak can expose officers, driver records and internal data, useful for fraud or targeting. It is government data outside the region but still a sizable, claimable leak.
Brecha total en la infraestructura del Ministerio de Finanzas de Afganistán (1,4 TB)
Afghanistan Ministry of Finance
A post claims a complete infrastructure breach of Afghanistan's Ministry of Finance with 1.4 TB of leaked data. If genuine, it exposes financial and citizen records of a national ministry, a serious government compromise. Although outside Latin America, it is a notable large-scale government leak worth verifying.
Base de datos de la Armada Bolivariana de Venezuela a la venta
Armada Bolivariana de Venezuela
A forum actor (RevelationS) is offering a database taken from the Bolivarian Navy of Venezuela, a national military branch, in a fresh BreachForums post from October 2026. If authentic, it exposes military personnel and operational data with direct national-security implications. Defenders in the region should treat this as a critical government/military breach and corroborate the claim urgently.
Filtración de base de datos de la Policía Nacional del Ecuador
Policía Nacional del Ecuador
An actor on DarkForums posted a database attributed to the Policía Nacional del Ecuador roughly 11 minutes ago, indicating a fresh release. If confirmed, it exposes sensitive police personnel and operational data, a serious risk to national security. Ecuadorian authorities should verify the leak and notify affected personnel immediately.
Base de datos del DIF Oaxaca (México) con datos de menores y adultos mayores
DIF Oaxaca (México)
A forum user is leaking a database belonging to DIF Oaxaca, the Mexican state family-services agency, explicitly containing data on minors and seniors, published less than a minute ago. This is a Latin American government social-services target with highly sensitive vulnerable-population records, raising serious privacy, extortion and identity-theft concerns. Mexican authorities and defenders should verify scope and protect affected beneficiaries.
Filtración de 2.000 registros del DETRAN de Río de Janeiro
DETRAN Rio de Janeiro (detran.rj.gov.br)
A listing offers roughly 2,000 records from detran.rj.gov.br, the Rio de Janeiro state traffic department in Brazil. Although the post dates to 2024 and the volume is small, any Brazilian government data leak deserves corroboration for identity-fraud risk. Low urgency given its age.
Filtración de base de datos del gobierno mexicano Sedesol
Sedesol (Secretaría de Desarrollo Social, México)
A freebie dump advertising a database tied to Sedesol, Mexico's former Social Development ministry, was posted minutes ago in a premium forum section. Government social-program data typically contains beneficiary names, addresses and CURP/national IDs, enabling identity fraud and targeting of vulnerable citizens. Any Mexican government body handling citizen data should verify exposure and monitor for abuse of the leaked records.
Presunta brecha de seguridad nacional del INSS de Israel (15 TB)
Israel Institute for National Security Studies (INSS)
A cyber-actor claims to have exfiltrated roughly 15 TB of classified documents linked to Israel's national security establishment, posted this month. If authentic, the scale and government/military sensitivity make it strategically significant, though bold claims of this size are frequently inflated or recycled. Outside the AR-LATAM region, its main value is as an indicator of actor capability and potential document reuse in future campaigns.
Brecha en el INSS de Israel expone 15 TB de documentos clasificados
Israel INSS (Institute for National Security Studies)
A threat actor claims a 15 TB leak of classified documents from Israel's INSS national-security think tank, covering policy, strategic and military material. If authentic, the volume and sensitivity could fuel espionage, influence operations and targeting of officials. Analysts should track re-use of this corpus by state-linked actors.
Código fuente y 5,7M accesos del Kemendikbud de Indonesia
Kemendikbud (Indonesia)
The thread offers source code and about 5.7 million access records tied to Indonesia's Ministry of Education (Kemendikbud). It is a genuine government target, but the post dates to December 2024, so it is not a fresh alert and only offers background context on a state-education breach.
Brecha del ERP completo de los Puertos de Libia
Libya Ports Company (lpma.gov.ly)
A full ERP breach of the Libya Ports Company is being sold, tied to the government domains lpma.gov.ly and lpclibya.com. A complete ERP compromise of a national port authority can expose operational, financial, employee and logistics data and enable further intrusion. Critical-infrastructure and maritime defenders should treat it as high risk.
Filtración de datos del Ministerio de Exteriores de Nepal
Nepal Ministry of Foreign Affairs
Sensitive data attributed to Nepal's Ministry of Foreign Affairs is being offered on a darkweb forum, reportedly within the last day. Diplomatic government records can expose officials, internal communications and visa or passport-holder data. Regional government and CERT teams should assess authenticity and scope urgently.
Ciberataque reivindicado contra la autoridad portuaria y marítima de Irán (PGSA)
Ports and Maritime Organization of Iran (PGSA)
An actor on DarkForums (posted fresh, '1 minute ago') claims to have hacked Iran's Ports and Maritime Organization, a national government body overseeing ports and shipping. If genuine, it could expose maritime/operational systems and government data, but the claim is unverified and falls outside the AR-LATAM scope. Worth tracking only for corroboration, not as a regional alert.
Filtración de datos del Ministerio de Exteriores de Nepal
Nepal Ministry of Foreign Affairs
A poster is leaking data attributed to Nepal's Ministry of Foreign Affairs, a government body, with a thread dated October 9. Exposed government records can reveal internal contacts, credentials and operational details useful for follow-on intrusion or espionage. Even outside Latin America, a fresh ministry leak warrants monitoring and credential watch.
Filtración de 1,9 GB de datos de la Corte Superior de Justicia de Lima Norte (Perú)
Corte Superior de Justicia de Lima Norte
A 1.9 GB archive attributed to Peru's Superior Court of Justice of Lima Norte was posted for download, exposing judicial/government data. A leak of a national judicial body can reveal case files, personal data of parties and internal documents, with legal and privacy consequences. However, the post dates from October 2025, so it is a stale exposure rather than a fresh alert.
Venta de bases de datos del Ejército de Libia (gov.ly)
Libyan Army / Reconstruction Fund
A seller is offering databases belonging to the Libyan Army and the national Reconstruction Fund on gov.ly domains, indicating compromise of government and military systems. Such records can expose personnel, operational and institutional data. It is a high-impact state-target leak worth tracking even though it sits outside the LATAM region.
Filtración de datos del Ministerio de Asuntos Islámicos de Marruecos
Ministry of Islamic Affairs & Awqaf (Morocco)
A database attributed to Morocco's Ministry of Islamic Affairs & Awqaf, reportedly around 109,000 records, is being distributed via DarkForums. Leak of a government ministry's records exposes citizens and staff to identity theft, targeted phishing and extortion. It sits outside the AR-LATAM region, but confirms ongoing theft of MENA government data worth tracking.
Base de datos militar del IRGC de Irán publicada en foro clandestino
IRGC (Irán)
A database labeled as belonging to Iran's IRGC military was posted on a leak forum, dated around May 2026. If genuine it could expose sensitive military/government personal data of a nation-state, potentially fueling targeting or disinformation against Iranian officials. It is old and outside the AR-LATAM region, so it is low priority for a regional feed.