☑️ Weekly Darkweb – November Week 4, 2025

🔍 Confidential Data of Saudi Arabian Airport Operator 'R' Leaked on Dark Web

• On November 25, a post selling confidential information from Saudi Arabian airport operator 'R' was detected on the dark web hacking forum 'DarkForums.'

✓ Operator 'R' is a state-owned airport operator established in 2016 that manages King Khalid International Airport, the largest airport in Riyadh, the capital of Saudi Arabia.

• Forum user 'operation_endgame' claimed to have obtained sensitive data including system access credential, schematic, IP addresses, and uploaded five images of control panel from airport management system as samples.

→ Previously, in July, a post selling employee account data of 'R' was found on ‘DarkForums.’ According to the S2W dark web monitoring tool, forum user ‘darkyData’ claimed that the personal data of more than 800 employees of operator 'R' leaked during a data breach in May 2024.

🔍 Subsidiary of Taiwan’s Largest Electronics Manufacturer 'F' Suffered from Data Breach, Attributed to INC Ransomware Gang

• On November 27, a subsidiary of Taiwan’s largest electronics manufacturer ‘F’ was found to have been attacked by the INC ransomware gang.

• INC ransomware gang posted five images on their leak site as evidence of the attack, containing domain user accounts and computer account lists from the company’s internal infrastructure.

• According to the S2W ransomware analysis tool, ransomware attacks linked to 'F' and its subsidiaries have been identified three times from 2020 to 2022.

→ Between November 1 and 27, a total of 70 companies were added to INC ransomware gang’s victim list. Among them, four were Asian companies, including an Indonesian oil manufacturer.

🔍 Japanese Prime Minister Sanae Takaichi's Emails Leaked on Dark Web Forum

• On November 23, a post claiming to leak email contents belonging to Japanese prime minister Sanae Takaichi was identified on the dark web hacking forum 'DarkForums.'

• Forum user 'Samurai' uploaded an image believed to be the prime minister's email along with a download link, and the sample email, sent in August 2023, had the sender, recipient, and subject masked, but the body contained the minister’s name.

• The forum user claimed the leaked email serves as evidence that the prime minister received bribes from foreign entities and urged her to resign.

*The full report is available upon request and for XARVIS subscribers.