Stansberry Data Sale, Oracle 0-Day, and Salesforce Leaks Highlight Dark Web Activity

SOCRadar’s Dark Web Team observed a surge of underground activity this week, including a claim that a Stansberry Research database contains around 1.5 million records offered for $4,000, and discussions of an exploit for CVE-2025-10035 tied to GoAnywhere MFT that could enable remote command execution. The group also noted an alleged 0-day for Oracle E-Business Suite tracked as CVE-2025-61882 being sold on a dark web forum, with claims of remote unauthenticated access.

In addition, SOCRadar flagged an alleged sale of unauthorized SSH access to a Brazilian telecom company, described as eight root-level accounts on compromised servers. Meanwhile, the threat group Scattered LAPSUS$ Hunters began leaking Salesforce data after a ransom deadline passed on 10 October 2025, allegedly affecting firms including Qantas Airways, Vietnam Airlines, and Engie Resources, with attackers using social engineering and vishing to obtain persistent OAuth tokens.

The report emphasizes the varied and persistent risks across dark web forums, from data sales to exploit discussions and data leaks. according to SOCRadar’s Dark Web Team