Alleged Sale of GitLab Access to Government Entities Across Multiple Countries

⚠ Disclaimer

This report includes actual screenshots and/or text that may include unredacted personally identifiable information (PII) gathered from publicly available sources. The sensitive information presented within this report is intended solely for cybersecurity awareness and threat intelligence purposes. Dark Web Informer explicitly condemns unauthorized access, distribution, or misuse of the personal data displayed or referenced here. Users must treat exposed data responsibly and ethically.

📌 Overview

A threat actor using the alias ITSUKI has advertised access to multiple government GitLab servers spanning at least four countries, including Bolivia, Malawi, Brazil, and Indonesia. The listing was posted to DarkForums and claims each access point contains sensitive repositories, such as full source code, CI/CD secrets, private keys, internal documentation, and database backups. The actor emphasizes that no samples will be shared to maintain the integrity of the accesses being sold.

📊 Key Details