It is alleged that the corporate infrastructure of a telecommunications company operating in Turkey was infiltrated and the obtained system access privileges were put up for sale on a cybercrime forum. According to details shared by Dark Web intelligence sources, payment is requested in Bitcoin for the access privileges in question.

Offered for Sale on the Dark Web Market

According to information shared by Dark Web Informer, which monitors cybersecurity threats, server and authentication privileges related to a Turkey-based telecommunications provider were listed for sale on an underground forum. The announcement claims that the seller infiltrated the target company’s Azure Active Directory environment and obtained full database administrator (SA) privileges throughout the system.

The technical details shared by the cyber attacker reveal the extent of the threat. According to the information in the announcement, the accessed network includes approximately 100 different servers and workstations. However, it is claimed that no antivirus or EDR (Endpoint Threat Detection and Response) security software is actively running on the target systems. The vendor states that the target organization’s annual revenue is between $25 million and $50 million.

Requested Ransom and Sale Price

The price requested for the corporate access package is similar to standard starting access prices in the cybercrime market:

• Requested Amount: 2,487,240 Satoshi (approximately 0.02487 BTC / $1,920)
• Access Scope: Azure Active Directory, Database Administrator (SA) privileges, and approximately 100 servers
• Security Status: Allegedly no EDR and advanced security layers detected

Company Identity and Accuracy of Claims

The announcement text shared on the Dark Web does not include the trade name of the targeted telecommunications company. It should be noted that the allegations have not yet been confirmed by independent cybersecurity experts or official institutions. Whether the access keys offered for sale are active, whether they are based on a past leak, or whether it is a scam is not yet clear. We will continue to report on developments should an official statement be released regarding the matter.