☑️ Weekly Darkweb – April Week 1, 2026
🔍 NATO & Global Military Intelligence Reports Surface on Dark Web
• On April 27, Military equipment inventories, defense budget data, and strategic analysis reports from NATO member states, the U.S., Ukraine, and Japan were listed for sale at $1,000 on ‘Exploit’, a Russian dark web forum.
• Threat actor "DataHouse" cited Japan's defense technology assessments, multi-nation air and naval equipment inventories, and UAV analysis documents among the offered materials.
• The leaked data's inclusion of geopolitical risk analysis raises concerns it could be exploited by hostile actors for strategic planning, beyond simply exposing military capabilities and budget structures.
🔍 French National Police Internal Infrastructure Schematics and API Permissions Leaked
• On March 28, internal GitLab infrastructure schematics of France's National Police (Police Nationale) were detected for sale on dark web hacking forum ‘DarkForums’.
• The leaked data includes API query definitions, vulnerability structures, user permissions, and deployment keys.
• The exposure is effectively equivalent to a full blueprint of the system's architecture and access control structure, raising concerns that threat actors could leverage it to craft targeted exploits or establish a foothold into police internal networks.
🔍 Japanese Automaker 'N' Suffers Additional Data Leak by Everest
• On April 1, additional data from Japanese automaker N was detected posted on the Everest ransomware gang's leak site.
• The gang initially compromised ‘N’ in January 10, successfully exfiltrating 900GB of data, and has since published an additional 10GB on its active leak site.
• The gang attributed the successful attack to poor credential management.
→ Infiltration was traced to server credentials exposed across 30+ leak databases since September 2023, with three systemic failures identified: ① passwords unchanged for 3+ years, ② no MFA enforcement ③ shared accounts with external partners left unmanaged.
*The full report is available upon request and for XARVIS subscribers.