What access is being sold?

The threat actor claims to be selling Outlook Web Access (OWA) credentials to an active employee mailbox within Vietnam's General Department of Taxation. The access allegedly includes the inbox with internal Vietnamese emails, contacts, calendar appointments, forwarded messages, attachments, and other government communications.

Who is selling the Vietnam tax authority access?

A threat actor using the handle 'Solonik' posted the offering on BreachForums on December 31, 2025. The seller requires credentials plus a custom exfiltration script priced at $280, with escrow mandatory and video proof available via private message.

What is the Vietnam General Department of Taxation?

The General Department of Taxation (GDT) is Vietnam's primary tax authority responsible for tax collection, enforcement, and administration across the country. It operates under the Ministry of Finance and manages all aspects of taxation for both individuals and businesses in Vietnam.

What type of data could be accessed?

The compromised mailbox potentially contains internal government communications, tax-related documents with citizen and taxpayer references or TINs, policy discussions, delivery reports, notifications, contacts of other government officials, meeting schedules with sensitive references, and forwarded threads that may contain redirect personally identifiable information or financial intelligence.

What is the intended use of this access?

The seller describes this as ideal for targeted phishing campaigns, privilege escalation within the government network, intelligence gathering operations, or identity theft operations. The access could be used to impersonate government officials, access taxpayer information, or as a foothold for deeper network penetration.

Has this been verified by Vietnamese authorities?

The authenticity of the claimed access has not been independently verified by Vietnamese government authorities, cybersecurity researchers, or third-party security firms at the time of this report.

Vietnam General Department of Taxation Employee Email Access Offered for Sale

API Access for Researchers & Security Teams

SOC teams, researchers, and security professionals can integrate Dark Web Informer's threat intelligence directly into their workflows via API. Access real-time breach data, threat feeds, and monitoring capabilities programmatically.

Learn About API Access

Disclaimer

This breach alert includes material that may contain personally identifiable information (PII) gathered strictly from publicly available sources. All information is provided solely for cybersecurity awareness and threat intelligence purposes.

Quick Facts

Date and Time of Alert

2025-12-31 08:11:43 UTC

Threat Actor

Solonik

Victim Country

Vietnam

Industry

Government Administration / Tax Authority

Victim Org.

General Department of Taxation

Victim Site

mail.gdt.gov.vn

Incident Overview

A threat actor known as "Solonik" posted an offering on BreachForums claiming to sell unauthorized access to an employee mailbox within Vietnam's General Department of Taxation. The December 31, 2025 listing advertises standard Exchange OWA interface credentials for an active inbox containing internal Vietnamese government emails, contacts, calendars, and sensitive tax-related correspondence.