Initial Access Listings: Alleged Compromises in Taiwan, U.S., and Paraguay

Posted on a well-known hacking forum, a threat actor using the alias "Saturned33" has listed alleged access for sale to multiple corporate and government networks across three countries. The listings include domain and local admin access to organizations in the electronics, automotive, and transportation sectors.

🧾 Key Details

Country	Sector	Access Type	Privileges	Hosts	Revenue	Price
🇹🇼 Taiwan	Electronics	RDP	Domain Admin	80+	$18M+	$1300
🇺🇸 USA	Manufacturing (car components)	SHELL	Local Admin	50+	$17.5M+	$1200
🇵🇾 Paraguay	Government (Transport)	SHELL	Local Admin	–	$13M+	$500

📌 Notable Claims from the Listings

🇹🇼 Taiwan – Electronics Firm

Revenue: $18M+
Access: RDP with Domain Admin privileges
Hosts: 80+
AV: HUORONG (manually deactivatable)
Tags: Public client download page for software, drivers, and firmware—may allow malicious file binding

🇺🇸 USA – Automotive Manufacturing

Revenue: $17.5M+
Access: Shell access with Local Admin privileges
Hosts: 50+
Language of host system: Chinese
Note: Seller mentions this business is in the U.S. but hosted in China

🇵🇾 Paraguay – Government Transport Sector

Revenue: $13M+
Access: Shell with Local Admin privileges
Note: Labeled under the government sector

🕵️ Threat Actor Profile

Alias: Saturned33
Forum Activity: Recently registered (1 post, 0 reputation)
Deposit: 0.002434 BTC
Autogarant: 0 (none used in this listing)
Language Tags: Russian ("хакинг / hacking")

🔐 Claim URLs

📸 Note: Select screenshots are shown in this post. Full claim URLs and high-resolution, unredacted screenshots are available exclusively via the private threat feeds for paid subscribers.

🧠 Stay informed with verified threat intelligence:
👉 darkwebinformer.com/tag/subscribers

💭 Final Thoughts

Access listings like these highlight persistent risks across critical sectors, including manufacturing and government. The use of public-facing download pages, misconfigured permissions, and compromised admin accounts represent substantial footholds for attackers seeking to exfiltrate data or launch ransomware attacks.

Organizations must continue to monitor for unauthorized remote access points, especially where operations intersect across international infrastructure or cloud providers.