Loading threat actor…
Miyako is an Initial Access Broker (IAB) active across cybercrime forums and Telegram channels, and is described as part of the HellCat ecosystem’s access layer. The actor has been observed advertising and brokering initial access rather than directly deploying ransomware or selling stolen data, explicitly stating, “I sell access not data.” Reported aliases and related identities include miyako, miyak0, MIYAK000, nastya-miyako, miya, and a BreachForums username mommy that shared the same session identifier. Telegram-linked identities associated with this activity included miyako (@miyuhko) and miya; the @miyuhko account previously used the names Kiro and ikia and the usernames @LKIEJHDJ and @kuuonline. Researchers linked Miyako activity across BreachForums, BreachStars, DarkForums, and Telegram using a persistent session identifier, repeated alias variations, and consistent behavior. One investigation identified 71 victim entries tied to Miyako between January 2023 and September 2025 across breachforums.st and breachsta.rs. Telegram channel infrastructure associated with the actor was observed rebranding over time from BF DWC to HELLCAT Access Team to Fresh Access, with a secondary channel FreshAccess2 also identified. Observed tradecraft centers on selling footholds such as remote code execution, administrative or CLI-level control, firewall access including FortiOS environments, VPN entry points, and on-demand access acquisition. A BreachForums thread presented Miyako as offering a hacker-for-hire style service in which buyers could submit target domains and receive access after successful compromise. Recovered listings referenced targets in U.S. government, aerospace and defense, Chinese crypto insurance, Spanish ISP networks, and other enterprise environments. Specific observed activity includes advertisements for root-level remote code execution and shell access on Linux-based firewall devices. In one case, Miyako advertised five separate listings for root-level firewall access across organizations in four countries, with claimed targets described as a UAE oilfield services contractor, a U.S. retail pharmacy chain, a South Korean electronics firm, a Saudi logistics and supply chain company, and a U.S. call-center operation. Each listing was priced at $400, marked non-negotiable, and posted on the same day. The claims were explicitly noted as unverified, no victim organizations were named, and the seller’s Session contact details were withheld. Another report states Miyako offered access credentials for firewall and network administrator panels of Chinese financial institutions on BreachForums, claiming administrator privileges, root-level RCE, and shell access on Linux-based firewall devices; that listing was priced at $300. DarkForums activity linked to the same session identifier included listings for access to the U.S. Department of the Treasury and Honduras Microfinance RCE Admin CLI. One BreachStars thread advertised access to an online casino database containing approximately 15,000 users. Observed pricing across Miyako listings ranged from approximately $400 to $1000 depending on target and privilege level. The reporting consistently characterizes Miyako as operating early in the intrusion lifecycle by supplying initial access that could enable downstream ransomware deployment, data theft, or broader network compromise. One source notes possible ties to East Asian cybercriminal forums and state-linked interests, but this is presented only as a possibility rather than a confirmed attribution.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
31 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An initial access broker advertising unverified root RCE and shell access to firewall appliances at five unnamed organizations across the UAE, USA, South Korea, and Saudi Arabia. The access is positioned as a potential foothold for ransomware or data theft buyers.
Initial Access Broker operating within the HellCat ecosystem, advertising and supplying access to victim environments across forums and Telegram, including on-demand access acquisition and sales of footholds such as RCE, administrative, firewall, and VPN access.
An initial access broker selling administrator-level access credentials for Chinese financial institutions' firewall and network administrator panels on BreachForums.
Initial Access Broker advertising alleged privileged/root access (RCE, shell, admin panel) to a Linux-based firewall associated with an Indonesian government land authority.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.