Threat actor claims sale of full access to Jinzhou municipal systems
A threat actor on a dark web forum claims to sell persistent access to Jinzhou Big Data Group, which runs municipal digital services in Jinzhou, China, including government, police and financial systems. The offer cites JWT signing keys valid across 42 services, control of OpenStack and vCenter environments, and 9.7 GB of internal documents. Nothing has been verified; if confirmed, key rotation and credential reset would come first.
What happened
A threat actor on a dark web forum is advertising full access to the infrastructure of Jinzhou Big Data Group, which runs municipal digital services in Jinzhou, China. The claim includes hidden admin accounts, control of virtualization environments and millions of citizen records. The source calls it an unverified claim, with no comment from Jinzhou authorities.
Why it matters
If true, a buyer could forge admin sessions across 42 municipal services and access citizen, financial and police data. The risk sits in Chinese municipal operations and nothing has been confirmed so far. The case shows the market value of persistent access to critical infrastructure.
What to do
Treat as an unverified claim and monitor for developments. If your organization integrates with the group's systems, review admin accounts and JWT keys. An analyst note in the source recommends key rotation and credential reset as the first step.
For the technical team
- Affected
- Jinzhou Big Data Group Infraestrutura digital do Jinzhou Big Data Group, que opera serviços digitais municipais de Jinzhou (China); alegado ace · Jinzhou Big Data Group, which runs municipal digital services in Jinzhou, China: city government, police and financial systems; 42 municipal services cited as reachable with the JWT keys.
- Exploitation
- No verified exploitation. Initial access sale advertised on a dark web forum and reported by DailyDarkWeb, which classifies it as an unverified threat-actor claim. Jinzhou authorities have not commented.
- Fix
- No fix applicable (alleged breach). An analyst note in the source points to JWT key rotation and credential reset as the first step.
- Vector
- Claimed persistent access via credential compromise: hidden admin accounts across servers, databases and message queues; control of OpenStack and vCenter environments; JWT signing keys said to work across 42 municipal services, which would allow forging admin sessions.
- More details
- Additional actor claims: millions of records (citizen profiles, financial ledgers, police recruitment, student data) and 9.7 GB of internal board documents plus payment merchant API details.
Timeline
First record: underground forum offer claims full access to Jinzhou municipal infrastructure.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
