☑️ Weekly Darkweb – September Week 3, 2025

🔍 Personal Data of Pakistan’s National Security Adviser for Sale on Dark Web

• Personal information of Pakistan’s National Security Adviser was identified for sale on the Russian dark web hacking forum ‘Exploit’.

• On September 12, a forum user ‘xuii’ claimed to have hacked the National Security Division and Office of the National Security Adviser, requesting USD10,000 in BTC for the compromised information.

• According to S2W’s user profiling analysis, the forum user has been selling data linked to government agencies and private companies in Pakistan, Bangladesh, and Iran since March.

→ The threat actor is actively selling data related to Pakistan. On September 1 and 11, the user posted sensitive information related to counterterrorism operations and, respectively, classified materials reportedly from the Prime Minister’s Office and intelligence agencies.

🔍 Russian Telegram Channel Claimed to Hack Taiwan Smart Home Control System

• On the 13th, a message claiming the breach of Taiwanese smart home control system was posted on the Russian Telegram channel ‘🇨🇳Infrastructure Destruction Squad🇰🇵’.

• The channel operator claimed to have taken control over household functions such as multimedia equipment, temperature, lighting, and automated curtains, uploading a video as evidence of the hack.

• The operator stated in Russian and Chinese that the attack was in response to Taiwan “threatening China,” warning that such actions would not be tolerated.

• In 2021, a smart home device known as a “wallpad” was hacked in South Korea, resulting in footage of residents being leaked on the dark web. Smart home device breaches can lead to serious privacy risks and require heightened caution.

🔍 Customer Data of Major Japanese Securities Firm Leaked on Chinese Telegram Channel

• On the 17th, a message was posted on a Chinese Telegram channel claiming that 750,000 customer records from a major Japanese securities firm 'D' had been leaked.

• The channel operator uploaded sample images containing names, phone numbers, and account types, including government-managed tax benefit accounts.

• According to the operator, the data was initially leaked on the 12th. Analysis by S2W’s cybercrime solution XARVIS discovered that the data was posted on the Chinese dark web hacking forums ‘Cabyc’ and ‘DeepMix’.

• A user named ‘A***’ on Cabyc promoted exclusive access to the data obtained through direct intrusion. A user on the DeepMix forum also uploaded the same message.

*The full report is available upon request and for XARVIS subscribers.