🇮🇳 We tracked DARK_ALPHA claiming to sell SSL VPN access to an Indian social security organization, listing 65 hosts for $2,700. We've logged 5 DARK_ALPHA listings in the past 30 days. #InitialAccess #ThreatIntel

This entry + more → go.darkwebsonar.io/dark-alpha-b...

🇨🇱 We tracked cutzinger claiming API access to Policía de Investigaciones de Chile (PDI) database for doxing services. 13 cutzinger listings in the past 30 days, mostly government targets. #InitialAccess #ThreatIntel

This entry + more → go.darkwebsonar.io/cutzinger-bl...

🇮🇳 We tracked 0x4ziz claiming access to cag.gov.in (Comptroller and Auditor General of India) and selling database access, admin credentials, and web shell for $300 via Telegram. 6 incidents linked to this actor in our tracking. #InitialAccess #ThreatIntel

This entry + more →

🇧🇩 We tracked blacknet-00 claiming full network compromise of Bangla Trac Power Plant Daudkandi via exposed SNMP on RouterOS. Alleged access to 500+ devices with potential SCADA control. 20 listings from this actor in the past week. #InitialAccess #ThreatIntel

Details + live feed →

🇩🇴 We tracked cutzinger listing API access to Dominican Republic customs database. Claim includes citizen IDs, addresses, photos, travel records. 14 cutzinger listings in past 30 days. #InitialAccess #ThreatIntel

Details + live feed → go.darkwebsonar.io/cutzinger-bl...

🇧🇩 We tracked blacknet-00 claiming unauthorized access to Bangladesh Army infrastructure at Qadirabad Cantonment, alleging 400+ compromised devices with access to credentials and network configs. #InitialAccess #ThreatIntel

This entry + more → go.darkwebsonar.io/blacknet-00-...

🇮🇩 We tracked ScDealer listing admin credentials to an Indonesian academic institution (.ac.id). 26 ScDealer listings in the last 30 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/scdealer-blu...

🇺🇸 We tracked buggsbunny offering webshell access to a US healthcare provider for $1,500, claiming 40 million records affected. 2 incidents from this actor in the last 7 days. #InitialAccess #ThreatIntel

Details + live feed → go.darkwebsonar.io/buggsbunny-b...

The Infostealer Malware Pipeline: From Endpoint Infection to Value-Added Marketplace Intelligence

https://cyble.com/blog/infostealer-malware-credential-theft-pipeline
https://flagthis.com/tldr/7260

##Infostealer ##InitialAccess ##SessionHijacking ##DataBreach ##RaaS

🇦🇷 We tracked Spaniard claiming root-level database access to an Argentine university for $200, including user credentials and personal data. 3 listings from this actor in the past 30 days. #InitialAccess #ThreatIntel

Details + live feed → go.darkwebsonar.io/spaniard-blu...

🇻🇺 X Forum Bot posted a claim of webmail access to Venezuela's Sistema Patria government platform. 549 X Forum Bot listings in the past 7 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/x-forum-bot-...

🇵🇱 We tracked X Forum Bot posting about Medicover webmail access in Poland. Post is gated, details unverified. X Forum Bot logged 531 incidents past week. #InitialAccess #ThreatIntel

This entry + more → go.darkwebsonar.io/x-forum-bot-...

🇺🇸 We tracked X Forum Bot advertising alleged webmail access to newman-foods.com. 357 X Forum Bot listings in the past 30 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/x-forum-bot-...

🇲🇽 X Forum Bot posted initial access to Subol Hospital's webmail portal in Mexico. 262 incidents from this actor in the past 7 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/x-forum-bot-...

🇲🇾 We tracked CYBER TIGER BD listing PHP webshell access with Enterprise Admin privileges to a Malaysian university network (~1,000 hosts). Symantec Endpoint protection observed. #InitialAccess #ThreatIntel

Details + live feed → go.darkwebsonar.io/tiger-bluesky