Weekly Darkweb in January W3
2025.01.22
☑️ Weekly Darkweb in January W3, 2025
🔍 North Korea's Secret Missile Operation Base Locations Data for Sale on Dark Web
• On January 7, a user known as ‘ssteve’ on the Dark Web forum ‘OnniForums’ uploaded a post claiming to sell data concerning 10 secret missile operation bases in North Korea.
✓ Data for Sale: Includes exact locations of missile operation bases and detailed identity information on key personnel associated with the operations. Additionally, the post claims to offer further information for a comprehensive understanding of the operation bases.
• The threat actor ‘ssteve’ was found to have created the post on the same day that they joined ‘OnniForums.’
🔍 Firewall Access to U.S. Cybersecurity Company Sold by Professional Initial Access Broker
• On January 17, a post was published on the Dark Web forum ‘BreachForums,’ offering access to the firewall hosting server of a U.S. cybersecurity company for USD 1,000.
• The threat actor ‘miyako’ claimed to be selling a root account, the highest-level of administrative access. While the victim company's name was not disclosed, it was described as a firm with a revenue of $800 million.
• According to S2W’s profiling tool, the threat actor ‘miyako’ has uploaded over 200 posts since joining the forum in August last year and has been identified as an ‘Initial Access Broker,’ specializing in selling access to internal systems of companies and organizations.
🔍 Database of Spanish Defense Ministry Official Sold on Dark Web
• The internal databases of Spanish national gendarmerie, ‘Guardia Civil,’ and the Ministry of Defense have been identified for sale on the Dark Web forum ‘BreachForums.’
• The seller ‘natohub’ claimed to be offering personal information including names, email addresses, and contact details of internal personnel from ‘Guardia Civil’ and the Ministry of Defense.
• The uploaded post was found to contain a sample of the database being offered for sale.
This newsletter is based on news derived from big data collected from over 400 million encrypted pages and channels, including those on the dark web and Telegram.
👉 Subscribe <Weekly Darkweb>: https://bit.ly/4eeDU6I
☎️ Contact us: https://s2w.inc/en/contact
* The full report is available upon request and for XARVIS subscribers.
Attachments
Threat Analysis Brief Reports
Quick Overview of Korean Ministry of Environment Source Code Breach
2025.01.17
Previous
Threat Analysis Brief Reports
Quick Overview of Babyshark Campaign disguise as Defense-themed HWP Document, involving the Kimsuky APT Group
2025.01.22
Next