LightNews — News, ranked by scholars

Compass Security

@compass-security.com

WinGet can be more than a package manager. We show how .𝚠𝚒𝚗𝚐𝚎𝚝 configs + a self-referencing LNK become a viable initial access payload when Microsoft Store is enabled. Includes detection queries & mitigation tips.
blog.compass-security.com/2026/03/wing...
#RedTeam #Windows #LOLBins #InitialAccess

March 3, 2026 at 4:15 PM

ransomNews

@ransomnews.online

🚨 Access brokers industrialize #ransomware entry at scale

T1erOne describes selling initial access (RDP/VPN) to affiliates, pricing networks by revenue and security posture, turning corporate breaches into a structured supply chain feeding ransomware operations.

#ransomNews #InitialAccess

T1erOne Interview — Inside Darknet

Post by Inside Darknet

buymeacoffee.com

April 19, 2026 at 3:37 PM

DarkWebSonar

@darkwebsonar.bsky.social

🇮🇩 We tracked ScDealer listing admin credentials to an Indonesian academic institution (.ac.id). 26 ScDealer listings in the last 30 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/scdealer-blu...

September 21, 2026 at 4:01 AM

CyberMaterial

@cybermaterial.bsky.social

New PDFsider Windows Malware Deployed
Read More: buff.ly/C7LWX1b

#PDFSider #WindowsMalware #Ransomware #InitialAccess #SocialEngineering #Backdoor #ThreatActors #CyberSecurity #Infosec

January 21, 2026 at 7:01 PM

Koen Van Impe

@cudeso.bsky.social

Agencies now released guidance on digital forensics & monitoring for edge devices to boost threat detection & incident response. www.ncsc.gov.uk/guidance/gui... #initialaccess #ir

February 6, 2025 at 6:56 AM

CTI Monitor

@cti-monitor.bsky.social

🌐 GMAIL KYC BYPASS exploit allegedly working as of 2026. Actor @aqua reportedly selling access for XMR (€435). Targets finance, source code. Medium severity, 20h old.
#cti #finance #initialaccess

June 21, 2026 at 2:44 AM

GreyNoise

@greynoise.io

Ransomware starts with reconnaissance: we observed a recent large-scale scanning campaign validating exploitable systems, data that feeds the initial access market and shows up later in real attacks. 🕵️‍♀️

#GreyNoise #Ransomware #InitialAccess #IAB #Recon

The Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 Attacks

Over four days in December, one operator scanned the internet with 240+ exploits, logging confirmed vulnerabilities that could power targeted intrusions in 2026.

www.greynoise.io

January 8, 2026 at 3:03 PM

TechNadu

@technadu.com

A recent court case highlights how initial access brokers operate behind the scenes of larger cyber incidents.

Selling early access to company networks lowers the barrier for later attacks and shifts risk upstream, long before ransomware or data theft becomes visible.

#CyberSecurity #InitialAccess

January 17, 2026 at 10:59 AM

0xberserkr

@0xberserkr.bsky.social

The Lay of the Land - I have just completed this room! Check it out: tryhackme.com/room/thelayo...
#tryhackme #ActiveDirectory #InitialAccess #Network-basedSecuritySolutions #Host-basedSecuritySolutions #thelayoftheland via
@realtryhackme

TryHackMe | Cyber Security Training

An online platform for learning and teaching cyber security, all through your browser.

tryhackme.com

November 1, 2023 at 1:21 PM

0xberserkr

@0xberserkr.bsky.social

Weaponization - I have just completed this room! Check it out: tryhackme.com/room/weaponi...
#tryhackme #RedTeam #Scripting #WSH #HTA #VBA #PS #C2 #InitialAccess #PayloadDeliveryTechniques #powercat #PowerShell #weaponization via
@realtryhackme

TryHackMe | Cyber Security Training

An online platform for learning and teaching cyber security, all through your browser.

tryhackme.com

October 15, 2023 at 7:33 PM

অর্ঘ্য 🏏 📚 💻

@stringsvsatoms.bsky.social

#China’s ‘#SaltTyphoon’ Hackers Exploit #CiscoRouters for #InitialAccess in Telecom #Espionage—Researchers warn the group is targeting global #TelecomNetworks to spy on data and communications.

🔗 www.wired.com/story/...

China’s Salt Typhoon Spies Are Still Hacking Telecoms—Now by Exploiting Cisco Routers

Despite high-profile attention and even US sanctions, the group hasn’t stopped or even slowed its operation, including the breach of two more US telecoms.

www.wired.com

February 13, 2025 at 6:01 AM

DarkWebSonar

@darkwebsonar.bsky.social

🇺🇸 We tracked buggsbunny offering webshell access to a US healthcare provider for $1,500, claiming 40 million records affected. 2 incidents from this actor in the last 7 days. #InitialAccess #ThreatIntel

Details + live feed → go.darkwebsonar.io/buggsbunny-b...

September 18, 2026 at 4:04 AM

Royans Tharakan

@royans.bsky.social

The Infostealer Malware Pipeline: From Endpoint Infection to Value-Added Marketplace Intelligence

https://cyble.com/blog/infostealer-malware-credential-theft-pipeline
https://flagthis.com/tldr/7260

##Infostealer ##InitialAccess ##SessionHijacking ##DataBreach ##RaaS

Infostealer Malware To Marketplace: The Credential Pipeline

How infostealer malware fuels the credential theft pipeline — from harvesting and stealer logs to enrichment and dark web marketplace listings.

cyble.com

September 12, 2026 at 8:22 PM

DarkWebSonar

@darkwebsonar.bsky.social

🇦🇷 We tracked Spaniard claiming root-level database access to an Argentine university for $200, including user credentials and personal data. 3 listings from this actor in the past 30 days. #InitialAccess #ThreatIntel

Details + live feed → go.darkwebsonar.io/spaniard-blu...

September 11, 2026 at 12:41 PM

DarkWebSonar

@darkwebsonar.bsky.social

🇻🇺 X Forum Bot posted a claim of webmail access to Venezuela's Sistema Patria government platform. 549 X Forum Bot listings in the past 7 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/x-forum-bot-...

September 10, 2026 at 4:11 AM

DarkWebSonar

@darkwebsonar.bsky.social

🇵🇱 We tracked X Forum Bot posting about Medicover webmail access in Poland. Post is gated, details unverified. X Forum Bot logged 531 incidents past week. #InitialAccess #ThreatIntel

This entry + more → go.darkwebsonar.io/x-forum-bot-...

September 9, 2026 at 8:07 AM

DarkWebSonar

@darkwebsonar.bsky.social

🇺🇸 We tracked X Forum Bot advertising alleged webmail access to newman-foods.com. 357 X Forum Bot listings in the past 30 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/x-forum-bot-...

September 7, 2026 at 8:21 AM

DarkWebSonar

@darkwebsonar.bsky.social

🇲🇽 X Forum Bot posted initial access to Subol Hospital's webmail portal in Mexico. 262 incidents from this actor in the past 7 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/x-forum-bot-...

September 6, 2026 at 8:22 AM

DarkWebSonar

@darkwebsonar.bsky.social

🇲🇾 We tracked CYBER TIGER BD listing PHP webshell access with Enterprise Admin privileges to a Malaysian university network (~1,000 hosts). Symantec Endpoint protection observed. #InitialAccess #ThreatIntel

Details + live feed → go.darkwebsonar.io/tiger-bluesky

September 3, 2026 at 4:11 AM

DarkWebSonar

@darkwebsonar.bsky.social

🇮🇩 Forum user 'updap' claims admin and non-admin credentials to Batu Bara Regency Hospital in Indonesia, alleging patient data access. We've tracked 256 updap listings in the last 30 days. #InitialAccess #ThreatIntel

Details + live feed → go.darkwebsonar.io/updap-bluesky

August 23, 2026 at 5:00 PM

DarkWebSonar

@darkwebsonar.bsky.social

🇹🇭 We tracked 'neworder' listing unauthorized access to a Thailand government email account for $30 USD. Initial access vector to Thai government infrastructure. 2 incidents in the past 7 days. #InitialAccess #ThreatIntel

More on this and other incidents → go.darkwebsonar.io/neworder-blu...