dk0m

dk0m is an underground cybercriminal data broker active since at least 2024 that has advertised government-related datasets for sale on criminal forums. The actor has been linked to the sale of alleged government and judicial data associated with Armenia and Ukraine, and has also been reported to have advertised data tied to ministries in Argentina and Brazil. Reported activity indicates a focus on monetizing unauthorized access to sensitive state-related information rather than disruptive operations. The actor has been assessed as using information-stealing malware to harvest saved credentials and session cookies from compromised devices, then leveraging that access to identify reachable government portals and obtain data for repackaging and resale. This behavior supports capabilities in credential theft, session hijacking, initial access, reconnaissance, and exfiltration, followed by post-compromise monetization through underground marketplace sales. dk0m has also reportedly shared sample data or database structures to increase the credibility of sale offers. Known activity includes advertising a large dataset allegedly sourced from an Armenian government notification or civil litigation-related platform, including police and judiciary communications, and offering confidential Ukrainian justice and court-related data for sale. The actor is best characterized as a financially motivated cybercriminal broker specializing in stolen government-related data.