☑️ Weekly Darkweb – November Week 2, 2025

🔍 Indonesia Sea Transport Directorate Data for Sale on Dark Web

• On November 8, internal data belonging to the Directorate General of Sea Transportation under Indonesia’s ‘Ministry of Transportation’ was observed being sold on the Darkweb hacking forum ‘DarkForums’ for USD 1,000.

• The threat actor ‘KaruHunters’ claims to have exfiltrated approximately 246GB of internal documents, releasing sample images including the 2020–2024 ‘Maritime Transport Strategic Plan’, ‘internal annual performance contracts’, and several department-level risk management reports.

• According to S2W’s investigation platform ‘XARVIS’, the ‘Ministry of Transportation’ has faced multiple cyberattacks with signs of data leakage since June 2024, but this is the first known leak involving the Directorate General of Sea Transportation.

🔍 Source Code of Japan’s Public Research Institute ‘R’ Leaked Online

• On November 9, a post distributing source code belonging to a major Japanese public research institution, referred to as ‘R’, was identified on the Darkweb hacking forum ‘DarkForums’.

• The user claimed that the source code was leaked in a recent data breach this month and uploaded a file tree, including filenames related to financial authentication data, Bitcoin-wallet executables, and application resources as evidence of the leak.

→ The victim had previously shown signs of compromise by the LockBit ransomware gang in July 2022, which resulted in the leakage of internal data such as financial statements, audit reports, and corporate governance documents (Source: S2W July 2022 Newsletter).

🔍 Taiwan Cybersecurity Dept. Documents Advertised on Dark Web

• On November 12, a sales post offering 105 internal documents belonging to Taiwan’s Executive Yuan Department of Cyber Security was uploaded to the Darkweb hacking forum ‘DarkForums’ for USD 500.

• The seller, ‘yeestge33,’ shared his/her Telegram ID and stated that sample data could be provided upon request.

• According to S2W’s user-profiling tools, the seller has been active on DarkForums since November 10 and has posted 15 consecutive listings targeting major sectors, including government agencies and the aviation industry.

*The full report is available upon request and for XARVIS subscribers.