☑️ Weekly Darkweb – December Week 3, 2025

🔍 Databases of Three Egyptian Government Agencies Related to Information Systems and Finance for Sale on Dark Web

• On December 17, a post selling data from three Egyptian government agencies was identified on the dark web hacking forum ‘ DarkForums ’.

✓ List of government agencies: Government Agencies for General Services, Kayani(Official Youth Services Platform), Social Housing and Mortgage Finance Fund

• Forum user ‘BIGBROTHER’ claimed to have obtained 200MB, 7MB, and 200MB of data from each agency respectively, releasing five links to sample images. The price is equivalent to USD 10,000 in cryptocurrency, and the seller also posted a Monero wallet address.

• According to the S2W user profiling tool, the forum user has been selling data linked to private-sector organizations in the Middle East, including Egypt, Saudi Arabia, the United Arab Emirates, and Iran, since September.

🔍 Internal Data of Indonesian Travel Booking Platform ‘V’ Leaked on Dark Web

• On December 15, internal data from Indonesian IT company V, which operates a travel booking platform, was leaked on the Russian dark web hacking forum ‘Exploit’. (price: USD 4,500)

• Forum user ‘ zestix ’ claimed to have stolen 30GB of financial and accounting documents from company V, including financial documents related to an international airline and travel agency A, a partner of V.

• The seller posted seven sample images as proof of the leak, including invoices from company A, billing statements from international airlines, and tax invoices.

• In the case of travel platforms, data breaches may lead to the exposure of subscribers’ personal information, requiring heightened caution. Given their extensive partnerships, such incidents may also result in third-party data exposure, necessitating attention to information security.

🔍 Personal Data of Russian Oil Company Shareholders for Sale on Dark Web

• On December 16, a post offering the personal shareholder list of Russia’s second-largest oil producer, company L, was detected on the dark web hacking forum ‘ DarkForums ’.

• The seller, ‘ MonteCristo ,’ stated that the list contains personal information of over 34,000 shareholders, based on records from 2014, and is being sold for 0.04 BTC until December 25.

✓ The seller noted that access to the personal data is available for an additional 0.01 BTC.

• According to the S2W user profiling tool, the seller was also previously observed selling a list of individual shareholders of Russia’s largest oil producer ‘R’ in November, suggesting the user is engaging in persistent cyber activity targeting the same country and industry.

*The full report is available upon request and for XARVIS subscribers.