☑️ Weekly Darkweb – June Week 3, 2025

🔍 Japanese Crypto Exchange Breach Footage Circulates; Data linked to Chinese Telegram Channel

• On the 17th, data allegedly originating from “Z Corporation,” one of Japan’s early licensed cryptocurrency exchanges, was identified for sale on a Chinese Telegram channel named “乐乐～专注做海外数据”, known for trafficking in overseas data.

• The channel operator, ‘xggvm’, uploaded a video showing a direct intrusion into a Japanese website, including scenes of exfiltrating personal information belonging to approximately 4 million users, and the accompanying message indicated an intent to sell the stolen data.

• The operator had previously distributed data from various countries, including the United States, Mexico, and India, through the same channel and is believed to also provide hacking-for-hire services.

🔍 Spanish Defense Firm’s CAD Files Offered on Dark Web for $50K

• On June 13, classified data allegedly belonging to Spanish defense and aerospace software developer G Corporation was observed for sale on the Russian dark web forum XSS for USD 50,000.

• The leaked data, totaling approximately 2.71 GB, includes blueprints, contracts, CAD drawings, and other technical documents.

✓ G Corporation, a key player in the space and defense sectors, has delivered over 1,500 projects and holds assets valued at €90 million.

• The threat actor ‘_Sentap’ shared sample files within the post and claimed the leaked materials could be used as a means of reverse engineering.

• According to S2W’s user profiling tool DarkSpider, the same post was simultaneously uploaded to DarkForums and Exploit.

🔍 Ransomware Actor ‘Devman’ Tied to Global Attacks via X and Dark Web

• A threat actor known as ‘Devman’ has been observed conducting ransomware attacks against organizations in Japan, Mexico, the U.S., and others via dark web forums and the X platform.

• On X, Devman shared a screenshot allegedly showing internal data from a Japanese company, claiming access was enabled by a VPN password set to ‘12345’.

• According to S2W’s DarkSpider, Devman previously sought RaaS collaborators via a post on BreachForums in April.

*The full report is available upon request and for XARVIS subscribers.