☑️ Weekly Darkweb: November 2026, Week 1

🔍 Root Access to Indonesian Tax Authority Network Offered for Sale

• On October 31, a post offering administrator access to the internal network of Indonesia’s Directorate General of Taxes (DJP) appeared on the dark web hacking forum ‘DarkForums.’

• The threat actor ‘marlanwg’ claimed to have gained root access to DJP servers and its internal network, reportedly including unauthorized access to the civil registry system.

• The actor also claimed to have stolen some 10.49 million tax returns from seven e-Form servers and 23,000 VAT refund records with passport numbers, names, and bank details.

• Priced at USD 3,500, the listing promises the access, a live demonstration, and the original leaked data upon payment confirmation.

• According to S2W’s user profiling tool, the actor has posted listings for 26 organizations since August, including Indonesia’s Ministry of Home Affairs, Army, and Supreme Court.

🔍 3.6 GB of Philippine DICT Internal Documents Leaked on Dark Web

• On November 5, 3.6 GB of internal documents from the Philippine Department of Information and Communications Technology were leaked on the dark web forum ‘PwnForums.’

✓ Department of Information and Communications Technology (DICT): Established in 2016, the government department oversees national ICT policy, digital government services, and cybersecurity, including the CICC cybercrime center.

• The threat actor ‘core849’ released about 3,200 files, mostly PDFs, which the actor claimed include internal records on DICT budgets, approvals, and procurement.

• Instead of selling the data, the actor shared it for free, claiming it “can be used to inspect and analyze corruption involving the agency.” The post also exposed the name, address, and phone number of a person believed to head the CICC.

🔍 Internal Data of Turkish Airline ‘P’ Offered for Sale on Dark Web

• On November 4, a post offering internal data from Turkish airline ‘P’ appeared on the dark web hacking forum ‘PwnForums.’

✓ ‘P’: A Turkish low-cost carrier founded in 1991, with 2025 revenue of about EUR 3.41 billion and 175+ aircraft serving 161 destinations in 57 countries.

• The threat actor ‘AckLine’ claimed to have breached the airline’s internal systems, stealing passenger data (including passport and ID numbers), employee records, and internal documents, and gaining cloud server access. As proof, the actor shared seven screenshots, cloud account identifiers, and sample data.

• The actor said the data was put up for sale after ‘P’ detected the breach and cut off access, accepting payment in Monero (XMR) and Bitcoin (BTC) via Tox and Session.