🔪 That Dark Web Guy - Part 3 🔪

🚨 Initial Access Seller Advertises RDP and Fortinet VPN Access A forum actor is advertising corporate network access through RDP, FortiSSLVPN, and FortiGate. The seller says target revenue generally starts at $2 million, with some organizations reaching $30 million to $50 million, and transactions are available through escrow. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🎧 Tiësto - On My Way ft. Bright Sparks 🎧

‼️🇦🇪 Flydubai is named in a new Everest ransomware listing involving airline operational and personnel data. 🇦🇪 Flydubai - A Dubai-based airline operating passenger and cargo services across the Middle East, Africa, Asia, and Europe. The listing claims 4.36 GB across 16,517 files, including flight-operations documentation, crew training materials, personnel exports, manufacturer technical publications, electronic flight-reference packages, and Boeing engineering software. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Windows 11 Zero-Day LPE and Pre-Auth RCE Exploits Offered for Sale A forum actor is advertising an alleged Windows 11 zero-day local privilege escalation exploit claimed to work across all versions. The seller also claims to have pre-auth RCE exploits for Ivanti Connect Secure SSLVPN and Zimbra, along with an RCE exploit targeting Switchvox SMB. Pricing is negotiable, with transactions offered through escrow. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Initial Access Buyer Targets Healthcare, Logistics and Manufacturing Networks A forum actor is seeking to purchase initial access to corporate networks, specifically naming healthcare, logistics, and manufacturing as sectors of interest. The actor asks sellers to contact them before offering access elsewhere. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 PoC released for an authenticated LPAR2RRD remote code execution vulnerability; CVE-2025-54769 PoC: https://github.com/tunahantekeoglu/CVE-2025-54769 The flaw allows an authenticated read-only user to abuse the LPAR2RRD upgrade functionality to upload a crafted file and achieve remote code execution through directory traversal. CVSS: 8.8 Affected: LPAR2RRD ≤ 8.04 Fixed: LPAR2RRD ≥ 8.05 The PoC builds and uploads a minimal upgrade archive, then verifies successful code execution by retrieving the output of whoami.

🚨🇺🇸 480 GB of Metrea and Commuter Air Technology Data Allegedly Stolen An actor claims to have obtained 480 GB of data containing approximately 64,000 files from U.S. defense contractors Metrea and Commuter Air Technology. The actor claims the material includes SOCOM-related documents, military radio firmware, deployment information, contract data, employee records, cybersecurity assessments, and credentials associated with classified systems. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Watcher: Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS. https://github.com/thalesgroup-cert/Watcher

🚨🇳🇵 This is what a bad supply-chain compromise looks like. ⠀ One Nepalese technology provider. ⠀ 170+ client environments. ⠀ Government ministries. Police. Municipalities. Universities. Hospitals. ⠀ An actor claims their team compromised the provider, gained administrative access, achieved RCE, and obtained credentials for databases, APIs, SMTP services, and customer systems. ⠀ Screenshots shared in the post show client administration panels, database backups, credentials, and access to government-related systems. ⠀ Among the organizations named: ⠀ • Nepal Police Headquarters • Department of National Personnel Records • Ministry of Home Affairs and Communication • Provincial Infrastructure Development Authority • Lumbini Technological University • Office of the Chief Minister and Council of Ministers • Bhaktapur Municipality • Tokha Municipality • Ratnanagar Municipality ⠀ The actors also claim access to a Git repository and responsibility for the defacement of Lumbini Technological University. ⠀ If legitimate, the dataset is only one part of the story. ⠀ The access is the bigger problem. ⠀ Claim is currently unverified. ⠀ 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇦 Hackers hijacked the website of Ukraine’s largest grocery chain and demanded $400,000 ATB confirmed a cyberattack after its website displayed an extortion message and a two-hour countdown. ⠀ The “DataSuckers” group claimed it stole: • Data belonging to 7.9 million customers • Passport details of more than 127,000 employees • Records of 11.4 million orders • Supplier information and internal source code ⠀ The attackers demanded payment in Bitcoin or USDT and threatened to publish the purported dataset. ATB denies that any personal or confidential information was compromised, saying such data was not stored on the affected resources. ⠀ After ATB disputed the breach, the group published alleged samples and said it would sell the purported dataset instead of releasing everything publicly. The samples and claimed scale of the breach have not been independently verified.

🚨🇹🇷 Okul Güvenliği Dataset With 2 Million+ Records Offered for Sale A dataset allegedly linked to Turkish school security platform Okul Güvenliği has been offered for sale for $2,000. The actor claims the data includes more than 2.1 million ID numbers and 1.9 million phone numbers, along with student and parent names, dates of birth, schools, classes, and other personal information. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing