Weekly Darkweb in April W4
2025.04.30
☑️ Weekly Darkweb – April Week 4, 2025
🔍 Personal Information of Chinese Streaming Platform Users Sold on Dark Web
• Personal information of users from a Chinese video production and streaming platform (“Company T”) is reportedly being sold on the dark web forum "BHF."
• According to the forum post, the threat actor "danielproduct1k" attempted to extort Company T by threatening to leak the stolen data. However, the company did not comply with the demands.
• In retaliation, the threat actor posted the stolen data for sale and released a sample dataset that is accessible to the public.
✓ The threat actor is believed to be a member of “R00TK1T,” a group known for targeting government and corporate entities in Asia and the Middle East.
🔍 Multiple Governments and Military Entities Targeted by Threat Actor ‘Dedale’; Sensitive Data Offered for Sale
• The threat actor "Dedale," active on the dark web forum “DarkForums,” has recently posted multiple listings offering confidential government data for sale.
• According to S2W’s user profiling tool “DarkSpider,” Dedale uploaded seven posts between April 18 and 24.
✓ Sample listings include: “Indian Military Operation Documents,” “Turkish Military Classified Files,” “Hellenic Air Force Data,” and “Iraqi Ministry of Industry and Trade.”
• Analysis suggests that the threat actor primarily exploits leaked employee credentials to infiltrate internal networks and exfiltrate data, which is then monetized.
🔍 Major Mexican Telecom Provider Suffers Mass Data Leak Due to Unpatched Vulnerability
• Sensitive personal information—names, contact numbers, IP addresses, and email addresses—of customers from Mexico’s largest telecom company (“Company T”) has surfaced for sale on the dark web forum "leakbase."
• The threat actor “elprofessor” claims to have repeatedly warned Company T executives about the vulnerability, but no corrective action was taken.
• Despite the company’s public notice urging users to change their passwords, the threat actor asserts that the core security flaw remains unresolved, enabling continued data exfiltration.
This newsletter is based on news derived from big data collected from over 400 million encrypted pages and channels, including those on the dark web and Telegram.
👉 Subscribe <Weekly Darkweb>: https://bit.ly/4eeDU6I
☎️ Contact us: https://s2w.inc/en/contact
*The full report is available upon request and for XARVIS subscribers.
Attachments
Threat Intelligence Reports
Threat Group Profiling: Lazarus
2025.04.29
Previous
Threat Intelligence Reports
Analysis of BPFDoor Malware Targeting Korean Enterprises
2025.04.30
Next