Loading story…
Armenian authorities opened an investigation after a threat actor using the alias dk0m advertised for sale a dataset allegedly containing nearly 8 million government-related records tied to a state notification system used to distribute official legal and administrative communications. The data was marketed on an underground forum for $2,500 and was described as including notifications and communications associated with police and judicial bodies; officials in Yerevan publicly denied that the country’s government email infrastructure had been breached while acknowledging the possibility that another state platform was accessed.
Armenia’s Public Relations and Information Center (PRIC) said a preliminary review indicates the leaked material may have originated from the electronic civil litigation platform, and that an internal probe is ongoing to confirm the source and access path. Researchers at CyberHUB-AM assessed dk0m as a recurring data broker active since at least 2024 and reported the actor commonly uses infostealer malware to harvest credentials/session data and identify access to sensitive government portals before repackaging and reselling datasets; screenshots reportedly dating to August 2024 were cited as supporting evidence. The alleged exposure could increase social engineering risk by enabling highly credible scams referencing real case numbers, fines, or enforcement actions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CyberHUB-AM researchers assessed that dk0m likely used infostealer malware to obtain credentials and session cookies for sensitive government portals before repackaging the data for resale. They warned that, if authentic, the dataset could be used for convincing social-engineering scams referencing real case numbers, fines, or enforcement actions.
Armenian officials in Yerevan opened an investigation into the claimed sale of the records. The Public Relations and Information Center denied a breach of government email infrastructure but said a preliminary review suggested the data may have come from the electronic civil litigation platform instead.
A threat actor using the alias dk0m offered for sale about 8 million alleged Armenian government-related records on an underground hacker forum for $2,500. The actor claimed the data came from a government notification system used to distribute official legal and administrative communications.
CyberHUB-AM researchers said screenshots dated August 2024 indicate Armenian-related government data may already have been in the threat actor dk0m's possession by that time. The material was described as including police and judiciary communications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NyxarGroup has claimed two separate compromises involving Chilean government-related platforms, including an alleged theft of **250GB** of data from Chile’s **Ley del Lobby** transparency portal and the publication of **110,000** records from the **Servicio Civil** training platform. The Ley del Lobby listing advertises data spanning **2018 to 2026** for **$2,000**, with the actor asserting it includes hearing records, institutional data, full names, Chilean `RUT` numbers, passport details, contact information, represented-party names, and detailed meeting schedules and locations. The alleged exposure is particularly sensitive because the sample reportedly contains upcoming hearings and meetings involving senior government and military officials, raising concerns about both privacy and operational security. In the separate Servicio Civil incident, the leaked records reportedly contain full names and internal user IDs, effectively creating a directory of Chilean public servants. The actor is said to have released that dataset for free on the open web and indicated plans to publish data from another Chilean website, suggesting a broader campaign targeting Chilean public-sector systems.
Jun 29, 2026
NVIDIA confirmed that personal information belonging to GeForce NOW users in Armenia was exposed after a breach at **GFN.am**, its regional alliance partner operating the service locally. GFN.am said attackers gained unauthorized access to a backend database between March and late March, with the intrusion reportedly first detected on May 2 and publicly disclosed on May 5. NVIDIA said its own network and NVIDIA-operated services were not affected, and no confirmed impact outside Armenia has been reported. The exposed data may include **names, email addresses, phone numbers, dates of birth, and platform usernames**, including full names for some users who signed in with Google and phone numbers for some who registered through a mobile operator. GFN.am said **passwords were not compromised**, but the breach followed claims by **ShinyHunters**, which allegedly advertised millions of GeForce NOW records for sale for **$100,000** in cryptocurrency on a hacker forum. The company said it has fixed the root cause and added security controls, while affected users face heightened risks of phishing, SIM-swapping, and other social-engineering attacks.
Jun 29, 2026
Dark web monitoring reports surfaced multiple **alleged data leaks** affecting unrelated organizations, with several listings offering databases for sale or direct download. Reports claim **Republic (republic.com)** user data (~4.94M users) was listed for sale for **$2,400**, allegedly including names, emails, physical addresses, and phone numbers. Separate dark web listings also alleged exposure of **rueducommerce.fr** user data (linked in reporting to **Carrefour**) totaling ~2.17M records with similar PII, as well as alleged leaks involving **Dunzo** (~3.4M records) and **Menulux** (~93K records). Additional reporting highlighted a historical breach dataset for the **YouHack** forum (2013; ~107K users) containing usernames, emails, passwords, IPs, posts, and private messages, and a smaller exposure tied to **buylottoonline.com** (~38.5K email records). One of the most consequential claims involved **Salesfloor / People Powered E-Commerce (salesfloor.net)**, attributed in reporting to **LAPSUS$**, alleging theft of roughly **4 TB uncompressed** (1 TB compressed) data including **source code, logs, and customer information**, with potential downstream impact to retail brands using the platform. Separately from the dark-web-leak theme, other items in the set describe distinct vulnerability-driven risks rather than breach listings: **Zoom Node MMRs** command injection (**CVE-2026-22844**, CVSS 9.9) enabling arbitrary code execution in certain hybrid meeting deployments; **SmarterMail** auth bypass (**CVE-2026-23760**) enabling admin password reset via `force-reset-password` and potential RCE; **Vite** improper access control (**CVE-2025-31125**) enabling sensitive file exposure via query parameters such as `?inline&import` / `?raw&import` (noted as added to CISA KEV); and **Appsmith** password-reset token exposure (**CVE-2026-22794**) enabling account takeover, with internet-exposed instances identified via Shodan and remediation via upgrade to *Appsmith* 1.93. These vulnerability reports are separate from the dark web leak claims and should be tracked as independent patching priorities rather than as part of a single breach event.
Jun 29, 2026