Weapon Bot Toolkit, MadLicense Exploit Demand, and 413K Credit Cards Observed

SOCRadar’s Dark Web Team reported multiple underground posts this week, including a major auction for global credit card records, a buyer seeking a weaponized PoC for the Windows MadLicense vulnerability (CVE-2024-38077), and the sale of a new multifunctional malware framework known as Weapon Bot.

The auction purportedly contains approximately 413,000 credit card records, spanning 161 countries, with the majority of cards linked to holders in the United States and Canada and sizeable numbers from Malaysia, Singapore, and various European nations.

The MadLicense exploit refers to a remote code execution flaw affecting the Windows Remote Desktop Licensing Service, and a purchaser is seeking a weaponized version capable of compromising Windows Server 2016, 2019, and 2022, with demand for video evidence of efficacy on those operating systems. New listings include Weapon Bot, described as evolving from a standalone stealer into a multifunctional botnet, claiming a modular Rust-based stealer and MSI packaging to evade endpoint security. A separate post seeks valid KeyBank credentials, with prices ranging from $10 to over $500 per log, depending on account quality and balance.