Buyer Seeks Exclusive Network Access to Western Firms With $350M+ Revenue

Summary
A buyer posting as umbreon seeks exclusive access to large Western firms with verified annual revenue above $350 million, offering flat-rate terms and escrow for access to corporate networks and identity systems.
Key points
- The buyer, posting as umbreon, is seeking to purchase—not sell—exclusive access that has not already been sold.
- Targets must be in the US, Canada, UK, Switzerland, France, Australia, or Ireland and have verified annual revenue above $350 million.
- Requested access includes VPN, RDP, Citrix, VDI, RMM, Active Directory, Entra, AWS, Okta, and Oracle Identity Manager.
- The solicitation excludes CIS-region targets, schools, and hospitals; healthcare, pharmaceutical, and biotech firms are accepted.
- The post describes a solicitation; it does not establish that access was obtained or that any organization was compromised.
Article Details
- Event Type
- A buyer using the name umbreon solicited exclusive access to corporate networks.
- Impact
- The solicitation seeks access to large Western firms with verified annual revenue above $350 million, including access through VPN, RDP, Citrix, VDI, RMM, Active Directory, Entra, AWS, Okta, and Oracle Identity Manager. CIS-region targets, schools, and hospitals are excluded; healthcare, pharmaceutical, and biotech firms are accepted.
Threat Actors
Products
AWSThe solicitation targets VPN, RDP, Citrix, VDI, RMM, Active Directory, Entra, AWS, Okta, and Oracle Identity Manager access while explicitly excluding CIS-region targets, schools, and hospitals.CitrixThe solicitation targets VPN, RDP, Citrix, VDI, RMM, Active Directory, Entra, AWS, Okta, and Oracle Identity Manager access while explicitly excluding CIS-region targets, schools, and hospitals.EntraThe solicitation targets VPN, RDP, Citrix, VDI, RMM, Active Directory, Entra, AWS, Okta, and Oracle Identity Manager access while explicitly excluding CIS-region targets, schools, and hospitals.Microsoft Active DirectoryThe solicitation targets VPN, RDP, Citrix, VDI, RMM, Active Directory, Entra, AWS, Okta, and Oracle Identity Manager access while explicitly excluding CIS-region targets, schools, and hospitals.OktaThe solicitation targets VPN, RDP, Citrix, VDI, RMM, Active Directory, Entra, AWS, Okta, and Oracle Identity Manager access while explicitly excluding CIS-region targets, schools, and hospitals.Oracle Identity ManagerThe solicitation targets VPN, RDP, Citrix, VDI, RMM, Active Directory, Entra, AWS, Okta, and Oracle Identity Manager access while explicitly excluding CIS-region targets, schools, and hospitals.
Countries
AustraliaTargets must be in the US, Canada, UK, Switzerland, France, Australia, or Ireland.CanadaTargets must be in the US, Canada, UK, Switzerland, France, Australia, or Ireland.FranceTargets must be in the US, Canada, UK, Switzerland, France, Australia, or Ireland.IrelandTargets must be in the US, Canada, UK, Switzerland, France, Australia, or Ireland.SwitzerlandTargets must be in the US, Canada, UK, Switzerland, France, Australia, or Ireland.
