StealthMole Traces RockHavks’ Earlier Seller Accounts Across Underground Forums
Summary
StealthMole linked RockHavks to earlier underground-forum seller accounts through a persistent Session ID, reused listings and a shared typo. Telegram records trace one account’s changing identities, but RockHavks attribution and advertised dataset claims remain unsubst
Key points
- StealthMole recorded 17 RockHavks listings from Sept. 16 to Oct. 9, 2026, advertising databases and claiming cloud or admin access.
- The same 66-character Session ID appeared in sales threads across BreachForums, PwnForums and DarkForums, predating RockHavks’ registration by nearly five months.
- Repeated listing details—including the same typo in three posts—and an identical sample file support links among some accounts; a shared contact alone could also indicate a broker.
- DarkForums moderators labeled Databroker1 and gtaviispeak as multiaccounts; those notes align with shared identifiers and listing evidence, though moderator conclusions are not infallible.
- Telegram user ID 7595680682 had 75 indexed messages under four usernames from 2024 to 2026, documenting a shift from seeking hacking tools to advertising databases. Its link to RockHavks remains less certain.
- The investigation did not test advertised samples or verify claims of government or business access, and it did not identify the operator’s real-world identity.
Article Details
- Attack Vectors
- Underground-forum accounts offered purported customer, employee, CRM, booking, patient, and user-account datasets for sale; the report did not verify the datasets’ authenticity.
- RockHavks advertised claimed access to an Indian government cloud-login portal and a Canadian property company’s administration system. The report says these claims were not confirmed and were accompanied by pasteboard images and invitations to negotiate on Telegram.
- Defensive Notes
- The investigation did not independently verify the advertised datasets or claims of live access; their authenticity and access status remain unresolved.
Threat Actors
AnosName used by Telegram user ID 7595680682, whose messages included seeking hacking tools and later offering Hong Kong data. The report connects the account history to underground data trading but says its relationship to RockHavks is uncertain.BfdfName used by Telegram user ID 7595680682 during 2026; the account participated in data-trading discussions and its handle appeared in sales posts by forum accounts. The report does not confirm its connection to RockHavks.Bfdf2PwnForums account that posted the Saudi Arabia dataset with the same Session ID and matching typo found in posts by Moelester and RockHavks. The report treats these similarities as evidence of linked activity, without establishing a real-world identity.databroker1DarkForums account that advertised purported data and was marked banned for multiaccount activity. Moderators linked it to Gtaviispeak, and the report cites overlapping contact details and listings as supporting evidence.GROCKName used by Telegram user ID 7595680682, whose messages included participation in underground trading disputes. The report does not establish a direct connection between this identity and RockHavks.GtaviispeakDarkForums account that advertised purported datasets. Forum moderators labeled it a multiaccount and linked it to a PwnForums ban; the report says this aligns with shared contact details and reused listings.KneeguardName used by Telegram user ID 7595680682; under this name, the account advertised a package of Chinese databases and discussed data transactions. The report does not confirm a connection to RockHavks.MoelesterBreachForums account that offered a Saudi Arabia CRM dataset also listed by other accounts using the same Session ID and a matching typo. The report presents this as evidence of linked storefront activity, not confirmed real-world attribution.RockHavksDarkForums account that advertised purported databases and claimed access to business and government systems. The report links its listings to earlier forum activity through reused contact details and content, but says the underlying datasets and access claims were not verified and does not establish the operator’s real-world identity.
Vendors
Products
Tools
Darkweb TrackerUsing StealthMole's Leaked Monitoring, Darkweb Tracker and Telegram Tracker, those details led back through several earlier forum identities, a string of bans, and a single Telegram account whose own message historyLeaked MonitoringUsing StealthMole's Leaked Monitoring, Darkweb Tracker and Telegram Tracker, those details led back through several earlier forum identities, a string of bans, and a single Telegram account whose own message historyTelegram TrackerUsing StealthMole's Leaked Monitoring, Darkweb Tracker and Telegram Tracker, those details led back through several earlier forum identities, a string of bans, and a single Telegram account whose own message history
Countries
ArgentinaEmail contacts (Argentina)AustraliaPatient contacts (Australia)AustriaHospitality contacts (Austria)BangladeshSales and contact data (Bangladesh)Belgiump****c.gov.tw (Taiwan), si****en.se***s.pi.gov.br (Brazil), B**l.com (Belgium), pro******er.aeBoliviaCRM contacts (Bolivia)BrazilPrivate company contacts (Brazil)CanadaProperty and contact records (Canada)ChinaUser accounts (China)Finlandcha*****r.sa, j*.t**s-***ia.org (Japan), ver******pa.com (Finland)IndiaCloud access (India)Japancha*****r.sa, j*.t**s-***ia.org (Japan), ver******pa.com (Finland)NorwayPassenger and booking records (Norway)PortugalCustomer database (Portugal)Saudi ArabiaEmployee records (Saudi Arabia)Taiwanp****c.gov.tw (Taiwan), si****en.se***s.pi.gov.br (Brazil), B**l.com (Belgium), pro******er.aeUAEUser profiles (UAE)
Industries
BankingOn 17 November, it advertised a package titled "10 Chinese Database in 1, Price: $2000", listing databases associated with China-based banking, UnionPay, Yuantong Express, WeChat and China Telecom, among others.GovernmentIt was a DarkForums account barely a month old, with zero reputation and a run of database sales covering customers of loan providers, job portals, travel companies and government bodies across a dozen countries.