DarkOwl Tracks Seller13’s Alleged SolarWinds Data Listings and Rebranding
Summary
DarkOwl reported that Seller13 advertised alleged SolarWinds-related data for sale and later promoted “Shiny Leaks.” The researchers said the seller’s identity and data authenticity remain unconfirmed and suggested the operation may be a scam.
Key points
- DarkOwl found a marketplace listing offering alleged SolarWinds customer data, including confidential documents and credentials, for sale.
- The listing’s advertised price reportedly fell from $85,000 to 0.5 BTC by January 3, 2021.
- Seller13 said in an invitation-only chat that they were acquiring SolarWinds-related data and planned to resell it in 1–5 GB portions.
- DarkOwl linked the Seller13 alias to earlier darknet activity, but described some of the supporting email associations as low-confidence.
- The article says Seller13 later promoted “S# Hunters” and “Shiny Leaks”; DarkOwl assessed that the operation could be a scam impersonating or capitalizing on ShinyHunters’ notoriety.
- DarkOwl could not confirm that Seller13 possessed genuine stolen data or establish a connection to REvil or ShinyHunters.
Article Details
- Event Type
- Darknet marketplace advertising and attempted sale of data allegedly associated with SolarWinds customers, followed by a reported rebranding of the operation as “S# Hunters.”
- Impact
- The advertisements claimed the data included confidential customer information, network usernames and passwords, email addresses, and conversations. DarkOwl could not confirm whether Seller13 had genuine stolen data or was running a scam; the article also says some databases offered by the market had previously been attributed to REvil ransomware attacks.
Threat Actors
ProsoxSome darknet sources reportedly identify Prosox as a moniker previously used by ShinyHunters; the article presents this relationship as unconfirmed.REvilRansomware group whose “Happy Blog” reportedly advertised victims whose data later appeared among databases offered on the Dark Leak Market. DarkOwl raised, but did not confirm, a possible connection to Seller13.S# HuntersName used by the group DarkOwl says was rebranding its operation from Seller13 and advertising “Shiny Leaks.” DarkOwl assessed it was likely a scammer capitalizing on attention around ShinyHunters.Seller13Alias used by a darknet marketplace advertiser offering data described as a SolarWinds leak. DarkOwl considered it unconfirmed whether Seller13 possessed genuinely stolen data or was a scammer.ShinyHuntersDarknet threat actor group described as releasing databases from compromised commercial websites. The article distinguishes it from the likely scammer using the name S# Hunters.