miyako

Miyako is an Initial Access Broker (IAB) active across cybercrime forums and Telegram channels, and is described as part of the HellCat ecosystem’s access layer. The actor has been observed advertising and brokering initial access rather than directly deploying ransomware or selling stolen data, explicitly stating, “I sell access not data.” Reported aliases and related identities include miyako, miyak0, MIYAK000, nastya-miyako, miya, and a BreachForums username mommy that shared the same session identifier. Telegram-linked identities associated with this activity included miyako (@miyuhko) and miya; the @miyuhko account previously used the names Kiro and ikia and the usernames @LKIEJHDJ and @kuuonline. Researchers linked Miyako activity across BreachForums, BreachStars, DarkForums, and Telegram using a persistent session identifier, repeated alias variations, and consistent behavior. One investigation identified 71 victim entries tied to Miyako between January 2023 and September 2025 across breachforums.st and breachsta.rs. Telegram channel infrastructure associated with the actor was observed rebranding over time from BF DWC to HELLCAT Access Team to Fresh Access, with a secondary channel FreshAccess2 also identified. Observed tradecraft centers on selling footholds such as remote code execution, administrative or CLI-level control, firewall access including FortiOS environments, VPN entry points, and on-demand access acquisition. A BreachForums thread presented Miyako as offering a hacker-for-hire style service in which buyers could submit target domains and receive access after successful compromise. Recovered listings referenced targets in U.S. government, aerospace and defense, Chinese crypto insurance, Spanish ISP networks, and other enterprise environments. Specific observed activity includes advertisements for root-level remote code execution and shell access on Linux-based firewall devices. In one case, Miyako advertised five separate listings for root-level firewall access across organizations in four countries, with claimed targets described as a UAE oilfield services contractor, a U.S. retail pharmacy chain, a South Korean electronics firm, a Saudi logistics and supply chain company, and a U.S. call-center operation. Each listing was priced at $400, marked non-negotiable, and posted on the same day. The claims were explicitly noted as unverified, no victim organizations were named, and the seller’s Session contact details were withheld. Another report states Miyako offered access credentials for firewall and network administrator panels of Chinese financial institutions on BreachForums, claiming administrator privileges, root-level RCE, and shell access on Linux-based firewall devices; that listing was priced at $300. DarkForums activity linked to the same session identifier included listings for access to the U.S. Department of the Treasury and Honduras Microfinance RCE Admin CLI. One BreachStars thread advertised access to an online casino database containing approximately 15,000 users. Observed pricing across Miyako listings ranged from approximately $400 to $1000 depending on target and privilege level. The reporting consistently characterizes Miyako as operating early in the intrusion lifecycle by supplying initial access that could enable downstream ransomware deployment, data theft, or broader network compromise. One source notes possible ties to East Asian cybercriminal forums and state-linked interests, but this is presented only as a possibility rather than a confirmed attribution.