☑️ Weekly Darkweb – July Week 5, 2025

🔍 Iran IRGC’s Sensitive Internal Data for Sale on Dark Web Hacking Forum

• On July 30, a post offering internal data from the Aerospace Force and Air Defense Section of Iran’s Islamic Revolutionary Guard Corps (IRGC) was found on the dark web hacking forum DarkForums.

• The seller claimed to be leaking 5.5 TB of sensitive data for the first time and uploaded images of an Excel file containing personal information and a data folder list as sample data.

✓ Data for Sale: Personal records of more than 16,000 personnel including names, ranks, service regions, social security numbers, photos, and coordinates of air defense sites.

• The seller is asking USD 99,999 worth of Monero, a privacy-oriented cryptocurrency, for the data, and USD 199,999 for its permanent removal.

🔍 Tunisia Defense Ministry Credential Leak; Raises Concerns Over Further Attacks

• On July 29, a post claiming to have hacked account credentials from Tunisia’s Defense Ministry was uploaded to the dark web hacking forum BreachForums.

• The compromised accounts reportedly include access to Tunisia’s Defense Ministry email services, internal systems, video conferencing tools, and the official website. The threat actor disclosed sample data including an administrator email, a military training officer’s email, and the ministry’s main official email address and password.

• As numerous breaches stem from credential exposure, monitoring for account leaks is a valuable tool for early-stage threat prevention.

✓ Credential leak information can be detected through the ATOM (Account Take Over Monitoring) feature of QUAXAR, S2W’s cyber threat intelligence platform.

🔍 Royal Saudi Air Force Internal Documents Circulating on Dark Web

• On July 28, Royal Saudi Air Force (RSAF) internal files were found being redistributed across a dark web hacking forum.

• The RSAF was previously targeted by the ransomware gang KillSec in April, resulting in a data breach. The current post is believed to be a redistribution of the previously leaked files.

✓ Compromised Data: Quality inspection forms, technical manuals, military aircraft reports, engineering blueprints, and documents related to military software.

• Information shared on the dark web is frequently downloaded and redistributed by multiple threat actors, making it nearly impossible to remove and potentially leading to long-term security threats.

*The full report is available upon request and for XARVIS subscribers.