Threat Intelligence

Dark Web Roundup: Citizen Data Leak, Multi-Function Malware Kit, and Financial Database for Sale

SOCRadar · 21 Sept 2026

Key Takeaway Australian SMBs should monitor for exposed customer or financial data on dark web forums and strengthen email and account verification processes to reduce the impact of targeted phishing using leaked personal or payment details.

SOCRadar's Dark Web Team has flagged several fresh underground listings that highlight the ongoing trade in stolen data and cybercrime tools. One post claims to offer a free download of nearly 1.85 million Dominican Republic citizen records, including identifiers, names, and birth details, with some fields such as email and phone reportedly blank. Even partial identity data like this can fuel fraud, profiling, and phishing attempts.

A separate listing advertises a malware suite called Celestial, marketed as a builder-style platform combining hidden remote access, credential-stealing, brute-force, and cryptocurrency wallet-targeting features in one package. Tools like this lower the barrier for attackers by bundling multiple attack capabilities together, potentially fuelling a wider range of campaigns.

Another post offers an alleged database from a payment network, containing over one million records with names, sanitized phone numbers, emails, account IDs, credit range data, and balance alert information. If genuine, this kind of financial and account context could be used to craft convincing phishing or fraud attempts against affected individuals and institutions.

dark web data leak malware cybercrime threat intelligence

Summarised by CISO AI from SOCRadar. We link back to every original so you can read it yourself.