Buyer Solicits Corporate Network Access to $350M+ Western Firms, Excluding CIS, Schools and Hospitals
A buyer posting as umbreon is advertising to purchase corporate network access on flat-rate terms, setting out unusually specific selection criteria. Targets must sit in the US, Canada, UK, Switzerland, France, Australia, or Ireland and hold verified annual revenue above $350 million, and the access must be exclusive and previously unsold. Accepted routes include VPN, RDP, Citrix, VDI, RMM, Active Directory, and Entra, AWS, Okta or Oracle identity systems. The buyer explicitly refuses CIS-region targets, schools, and hospitals, while stating that healthcare, pharmaceutical, and biotech companies are acceptable. No breach is claimed; this is a demand-side listing.
▣Listing details
!Access sought
- VPN
- RDP
- Citrix
- VDI
- RMM platforms
- Active Directory
- Microsoft Entra
- AWS
- Okta
- Oracle Identity Manager
◱Screenshot
⚠Potential impact
No organisation has been compromised here, but the criteria describe who is being hunted. A revenue floor screens for ability to pay rather than for data value, which is ransomware victim selection rather than data theft. The blanket CIS exclusion is the long-standing signature of Russian-speaking operations avoiding local prosecution. Refusing schools and hospitals while accepting pharmaceutical and biotech firms reflects reputational risk management, not restraint. The routes sought, particularly RMM and identity platforms, are chosen because they enable estate-wide deployment. Large Western firms in these sectors should read this as a statement of intent.
iStatus
AdvertisementThis is a solicitation rather than an incident, so there is nothing to verify beyond the post itself. The account was created days ago with a single post, though a purchased premium rank and the use of forum escrow convention suggest familiarity with the market. Dark Web Informer is not reproducing the contact identifier. Whether the buyer is operational or merely aspirational cannot be established.
DARK WEB INFORMER - THREAT INTELLIGENCE
