The Week in Dark Web – 12 October 2022 – Access and Database Sales

Powered by DarkMirror™

Threat actors continued to sell databases and access to organizations’ systems on hacker forums last week. The dark web summary is full this week, as always.

Find out if your data has been exposed on the deep web.

Receive a Free Deep Web Report for Your Organization

VPN-RDweb Access Sale for an Irish Company Detected

SOCRadar detected an unauthorized access sale of an Irish telecommunication company on the hacker forum on 11 October 2022. The victim company is believed to have $25 million in revenue. The vendor states the offered access type is VPN-RDP, and admin privileges are included. Lastly, auction values are included.

Source Code & Database of a Gambling Website is Leaked

On 10 October, a hacker forum monitored by SOCRadar Analysts shared a sale. The victim is an Indian gambling website. The sale includes the website’s source code, backups, and account data. Interestingly, the vendor wants $5000, which is higher than the usual amount for typical leaks like this.

Critical Data of Iranian Intelligence is Leaked

On 10 October 2022, a leak was posted in a hacker forum that the SOCRadar regularly monitors. The post is about Iranian Intelligence. The threat actor directly shared a link to the file along with a list of the information the leak covers. Shortly, the leak contains information about

High-level officers, presidents, elites, and both IAF & IRGC commanders
Operational databases
Financial logs, including supported abroad organizations
Logs about the political prisoners and protesters; names and addresses of high-level scientists
Exact location information of nuclear facilities
Safehouses and operatives working for Iranian Intelligence

Russian Immigration Agency Database is Leaked

SOCRadar Analysts have found a post on a dark web forum that shares 5+ GB of stolen data from the immigration agency of Russia. The attacker claims the leak includes information about the Moskow Electoral observer corps.

Unauthorized Access Sale for Multiple Companies Detected

On 12 October 2022, a hacker forum monitored by SOCRadar Analysts posted a sale. The sale is claimed to be full access to the 13 largest companies operating in the East Europe region with $25M+ revenue annually. The vendor explains leak includes manuals about utilizing these accesses, 2500 lines of user credentials, discovered cyber security in the systems, databases, hostnames, Ip info, and more. Surprisingly, the price for the leak is $1.5 million.

Database of an Italian Company is Leaked

On 6 October, a hacker forum monitored by SOCRadar Analysts shared a 7GB database. The victim is an Italian Company that manufactures and sells sports cars. The database includes critical information about confidential documents. The vendor also claims the data is stolen by the group Ransom EXX.

Powered by DarkMirror™

Gaining visibility into deep and dark web threats can be extremely useful from an actionable threat intelligence and digital risk protection perspective. However, monitoring all sources is simply not feasible, which can be time-consuming and challenging. One click-by-mistake can result in malware bot infection. To tackle these challenges, SOCRadar’s DarkMirror™ screen empowers your SOC team to follow up with the latest posts of threat actors and groups filtered by the targeted country or industry.