x.comthreadDark Web Informer (@DarkWebInformer) on X
A DarkWebInformer post on an actor called "Zerrix" advertising a VirusTotal Enterprise API key for sale. The seller claims 3 million requests per month, Retrohunt Tier 3 (YARA search over historical samples), Google Threat Intelligence and Mandiant access, sample downloads and private scanning, valid until 12 March 2028. How the key was obtained is not stated, and the post says its authenticity is unverified.
TL;DR Reports a dark web listing selling a claimed VirusTotal Enterprise API key with 3M monthly requests and Retrohunt Tier 3, unverified.
Organisations named here
- DarkWebInformer
- Retrohunt
Technologies named here
- VirusTotal Retrohunt Tier 3
- Dark web monitoring and compromised credential alerts
- Dark Web Informer
- VirusTotal
- YARA
- Google Threat Intelligence
- Mandiant
Techniques named here
- Retrohunting
Threat actors named here
- Zerrix
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup