Between September 3-9, 2026, multiple threat actors allegedly conducted extensive criminal marketplace operations across dark web platforms, advertising and selling stolen financial data, compromised credentials, and personally identifiable information (PII). The activity represents a significant escalation in organized cybercrime targeting financial institutions, logistics companies, and consumers globally. Key developments include the alleged breach of Aymakan logistics platform affecting over 10,000 clients, the claimed operation of DOC-SHOP marketplace with over 34,000 fullz records and credentials from major US financial institutions, and coordinated carding operations offering stolen payment cards from multiple countries. These operations allegedly demonstrate sophisticated criminal infrastructure with established communication channels, quality assurance processes, and diversified service offerings including malware distribution, social engineering tools, and money laundering services. The convergence of multiple threat actors on established marketplaces with standardized pricing and replacement policies indicates a mature criminal ecosystem that poses immediate risks to financial institutions, enterprises, and individuals worldwide.
- Multiple threat actors allegedly operated coordinated dark web marketplaces selling stolen credit cards, CVV data, fullz information, and compromised credentials from US, UK, EU, Canada, Australia, and Asian countries between September 3-9, 2026
- ZentinelTeam (actor Keishell) allegedly breached Aymakan logistics platform, claiming to exfiltrate data on over 10,000 clients including names, addresses, phone numbers, tracking information, and delivery history on September 3, 2026
- DOC-SHOP marketplace allegedly advertised over 34,000 fullz records, 7,416 bank credentials from major US financial institutions, and 1,630 compromised retail accounts from companies including American Express, Bank of America, Wells Fargo, and Chase
- Threat actors allegedly offered comprehensive criminal services including malware (RATs, keyloggers), social engineering tools (phishing kits, spamming infrastructure), payment processor validation tools (Braintree, Stripe, NMI), and money laundering services through PayPal, CashApp, Western Union, and cryptocurrency
- Criminal operations allegedly demonstrated organizational maturity with quality control teams, 24/7 customer service, replacement guarantees, standardized pricing models, and established Telegram communication channels for transaction coordination
