JEDI-SEC | Security Research & Digital Defense

Tag: Initial Access

  • Multiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day Exploitation

    Initial Access Report
    Multiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day ExploitationSouth Africa
    Multiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day ExploitationUnited States
    Multiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day ExploitationIndia
    ERP Systems
    Multiple Accesses
    Unverified

    Multiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day Exploitation

    Accesses listed13
    Countries represented9
    Access levelNormal user
    Claimed vectorUnpatched 0-day

    Overview

    Multiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day Exploitation

    An actor using the handle “Lenken” claims to have access to multiple ERP environments across organizations in South Africa, the United States, Iraq, India, Austria, Saudi Arabia, the United Arab Emirates, Egypt and Tanzania.

    The actor states that all listed systems were compromised through an unpatched 0-day and describes access via a reverse shell, implant or agent installation, with a normal-user privilege level. The post provides sector descriptions, estimated revenue for some organizations, and filesystem/disk-usage output intended to demonstrate access. The access, exploitation method, victim identities, revenues and system details have not been independently verified.

    Post details

    Actor“Lenken”
    ActivityMultiple ERP initial-access listings
    Claimed access levelNormal user
    Claimed exploitationUnpatched 0-day
    Access mechanisms namedReverse shell / implant / agent install
    Organizations listed13
    Countries represented9
    Observed date

    Accesses described

    • South Africa — IT consulting — claimed $22M revenue
    • United States — AI-powered commercial credit intelligence — claimed $50M revenue
    • Iraq — integrated engineering / technical consultancy — revenue undisclosed
    • United States — vitamins, minerals and supplements — claimed $5.5M 2025 revenue
    • India — automotive / railways — revenue undisclosed
    • Austria — agricultural measurement / weighing / IT equipment — claimed €1.2M 2025 revenue
    • India — LED-light industry — claimed $1.2M revenue
    • India / United States — digital solutions — revenue undisclosed
    • Saudi Arabia — MEP engineering / smart systems / GRMS — private sector
    • India — sustainable-energy solutions — claimed $5.1M revenue
    • United Arab Emirates — corporate services / management consultancy
    • Egypt — water technologies — revenue undisclosed
    • Tanzania — building and construction — claimed $4.5M revenue

    The post includes filesystem and disk-usage output for each entry as apparent proof-of-access. Those low-level system values are summarized rather than reproduced line-for-line here.

    Screenshots

    Screenshot 1Source screenshotMultiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day Exploitation
    Screenshot 2Source screenshotMultiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day Exploitation
    Screenshot 3Source screenshotMultiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day Exploitation
    Screenshot 4Source screenshotMultiple ERP Access Claims Span 13 Organizations Across Nine Countries After Alleged 0-Day Exploitation
    The supplied captures show 13 alleged ERP accesses across nine countries, with sector/revenue descriptions, filesystem output and a Session contact identifier. The screenshots do not name the victim organizations directly.

    IOCs & identifiers

    Identifiers directly visible in the supplied material. These support correlation and do not independently verify the access claims.

    Type Identifier Source
    Actor handle Lenken Screenshots 1–4
    Session ID 0527974f9062fe413b0f33c25c21be244b9724617e18090af415bff61f845c0a35 Screenshot 1

    No victim domains, malware hashes, Tox IDs, Telegram handles or public attacker-controlled IP addresses are visible in the supplied screenshots. Filesystem output and host-specific values are not reproduced here.

    Mapped techniques

    Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.

    • Initial AccessT1190Exploit Public-Facing ApplicationInferredThe actor claims the ERP environments were compromised through an unpatched 0-day vulnerability. The exact vulnerable product and exploitation path are not shown.

    Potential impact

    If authentic, the accesses could give an operator a foothold inside ERP environments across consulting, finance, engineering, manufacturing, energy, construction and other sectors. Even at a claimed normal-user privilege level, persistent shell or agent access could create risks of data theft, credential abuse, lateral movement, operational disruption or resale to other threat actors.

    Status Unverified

    Dark Web Informer has not independently verified the existence of the alleged 0-day, the listed ERP compromises, victim identities, access level, revenue figures, shell/agent persistence or filesystem evidence. The supplied screenshots document the actor’s claims only.

    Dark Web Informer

    Source: Dark Web Informer · 2026-11-06

  • Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026

    Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026

    Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing

    Source: Palo Alto Networks Unit 42 · 2026-10-16