> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Threat Actor Selling Root RCE Shell Access to Botswana Government Health Portal Firewall for $300 - URL: https://darkwebinformer.com/threat-actor-selling-root-rce-shell-access-to-botswana-government-health-portal-firewall-for-300/ - Published: 2026-04-07T17:00:33.000Z - Updated: 2026-04-07T19:27:37.000Z - Author: Dark Web Informer - Tags: Initial Access Dark Web Informer - Cyber Threat Intelligence # Threat Actor Selling Root RCE Shell Access to Botswana Government Health Portal Firewall for $300 April 7, 2026 - 4:52:21 PM UTC Botswana Government / Healthcare Standalone API Access Now Available High-volume threat-intelligence data, automated ingestion endpoints, ransomware feeds, IOC data, and more. [ View API](https://darkwebinformer.com/api-details/) Unlock Exclusive Cyber Threat Intelligence Powered by DarkWebInformer.com Stay ahead of cyber threats with real-time breach tracking, expert analysis, and high quality evidence - built for security professionals, researchers, journalists, and everyday people who take their privacy seriously. [ Subscribe Now](https://darkwebinformer.com/pricing) ## Quick Facts Date & Time 2026-04-07 16:52:21 UTC Threat Actor Florence (Nightmare) Victim Botswana Government Health Portal Industry Government / Healthcare Category Initial Access Sale Access Level Root RCE + Shell Device Type Firewall Operating System Linux Revenue Unknown Price $300 (Non-Negotiable) Severity Critical Country Botswana ## Incident Overview A threat actor going by Florence, associated with the Nightmare group, is selling root-level remote code execution and shell access to a firewall device on the Botswana Government Health Portal. The listing is brief but the access being offered is the most dangerous type available: root RCE on a network security appliance protecting government healthcare infrastructure. The listing specifies the following technical details: - **Operating System**: Linux, indicating a Linux-based firewall appliance (common in government deployments, potentially a Fortinet, Palo Alto, Sophos, or similar device running a Linux-based OS). - **Device Type**: Firewall, meaning the compromised device sits at the network perimeter and controls traffic flow into and out of the health portal's infrastructure. - **Access Level**: Root RCE + Shell, providing the highest possible privilege level on the device with the ability to execute arbitrary commands, modify firewall rules, intercept traffic, and pivot deeper into the network. - **Revenue**: Listed as unknown, which is typical for government targets where revenue isn't publicly reported. Root access to a firewall on a government health portal is particularly dangerous because it provides a position to intercept all network traffic flowing through the device, disable security controls to allow further intrusion, pivot into internal health systems that may contain patient records and sensitive health data, deploy persistent backdoors at the network perimeter level, and modify access rules to allow additional attackers in. The price is fixed at $300 and described as non-negotiable, with contact exclusively through Session messaging. ## Access & Risk Categories Root Shell Access Remote Code Execution Firewall Device Control Network Perimeter Access Traffic Interception Capability Government Health Infrastructure Lateral Movement Potential ## Image Preview [![Forum post by Florence selling root RCE shell access to Botswana Government Health Portal firewall for $300 with Nightmare group branding](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/04/37895698725697826592678359785964782.png)](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/04/37895698725697826592678359785964782.png) ## Claim URL Subscriber Access Required The original listing URL and unredacted claim images are available on the Threat Feed and Ransomware Feed for paid subscribers. [ Subscribe](https://darkwebinformer.com/pricing) Subscriber Access View the original listing URL and unredacted claim images on the feeds below. [ Threat Feed](https://darkwebinformer.com/threat-feed/) [ Ransomware Feed](https://darkwebinformer.com/ransomware-feed) ## MITRE ATT&CK Mapping [ T1190 Exploit Public-Facing Application The firewall is an internet-facing network device that was likely compromised through a known vulnerability to gain root-level remote code execution. ](https://attack.mitre.org/techniques/T1190/) [ T1059.004 Command and Scripting: Unix Shell Root shell access on the Linux-based firewall allows execution of arbitrary commands, system configuration changes, and deployment of additional tools or backdoors. ](https://attack.mitre.org/techniques/T1059/004/) [ T1040 Network Sniffing Root access on the firewall enables interception and inspection of all network traffic flowing through the device, potentially capturing credentials, health data, and internal communications. ](https://attack.mitre.org/techniques/T1040/) [ T1562.004 Impair Defenses: Disable or Modify Firewall Root access to the firewall itself allows an attacker to modify or disable security rules, open ports, whitelist attacker IPs, or completely disable filtering to allow unrestricted access to internal systems. ](https://attack.mitre.org/techniques/T1562/004/) Dark Web Informer © 2026 | Cyber Threat Intelligence [DarkWebInformer.com](https://darkwebinformer.com/)