# Dark Web Data-Leak Roundup (June 2026): Iran Hajj Organization (168M records), AdressFakta/SUPEReROI Sweden (5.4M+), Chrysler/Salesforce (1TB+, Everest Ransomware), and Crypto-Platform Lead Lists

> SOCRadar DarkMirror dark-web monitoring surfaced multiple high-volume data-leak and breach claims in June 2026: ~168M records (1984-2024) allegedly from Iran's Hajj and Pilgrimage Organization sold for $80,000, 5,452,000+ unique records from Swedish contact-data service AdressFakta (operated by SUPEReROI AB) offered for $3,800, over 1 TB of Chrysler data including 105+ GB of Salesforce records (2021-2025) claimed by the Everest ransomware group, and aggregated cryptocurrency-platform lead lists. Accompanying APT43/Kimsuky malware and zero-day claims are reported as unverified actor boasts.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0803
- **ID:** TL-2026-0803
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** Everest ransomware group (North Korea)
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat record tracks a SOCRadar dark-web monitoring roundup published 2026-06-15 documenting four distinct high-volume data-exposure events plus a set of unverified advanced-persistent-threat tooling claims. It is a DATA_BREACH intelligence aggregation, not a single CVE-bound vulnerability; no CVE or CVSS is stated by the source.

1) IRAN HAJJ AND PILGRIMAGE ORGANIZATION (~168M records, 1984-2024). An unnamed actor advertised a dataset spanning four decades of pilgrim records. Exposed fields reportedly include full names, birth dates and places, national ID numbers, national codes, passport details, contact information, travel/pilgrimage records, insurance data, banking and payment information, and security-deposit documents. The seller additionally claimed possession of Hajj-application source code and asserted the records include government officials, NAJA (police) forces, Basij paramilitary forces, and clerics. Asking price: $80,000 USD payable in Bitcoin. Primary SOC risk: large-scale identity theft, targeted phishing/spear-phishing of named officials, financial fraud, and foreign-intelligence collection against a sensitive population.

2) ADRESSFAKTA / SUPEReROI AB, SWEDEN (5,452,000+ unique users). A contact/marketing dataset from the Swedish service AdressFakta (operator SUPEReROI AB) was offered for a $3,800 base-plus-access price. Exposed fields include names, gender, mobile and landline numbers, street addresses, ZIP codes, towns, birthdates, and housing-type information. Primary SOC risk: smishing, vishing, identity profiling, and social-engineering of Swedish consumers.

3) CHRYSLER / SALESFORCE (1+ TB; 105+ GB Salesforce records, 2021-2025) - EVEREST RANSOMWARE. The Everest extortion group claimed exfiltration of more than 1 TB of Chrysler (Stellantis) data, including over 105 GB of Salesforce CRM records covering 2021-2025. Exposed data reportedly includes customer, dealer, and agent records; interaction/call logs; names, phone numbers, emails, and addresses; vehicle details; recall notes; and call outcomes. Everest (active since December 2020) has evolved into a hybrid ransomware/initial-access-broker operation; documented TTPs include initial access via exposed RDP, purchased credentials, and an insider-recruitment program (running since October 2023), lateral movement over RDP with valid accounts, and data exfiltration using rclone.exe, winscp.exe, and custom PowerShell scripts to bulletproof C2 infrastructure. Primary SOC risk: dealer-impersonation phishing, recall scams, and double-extortion.

4) CRYPTOCURRENCY-PLATFORM LEAD LISTS (millions aggregated). Combined lead lists referencing users of Binance.US, Coinbase, Crypto.com (1.8M lines), Gemini (930k+ lines), Kraken, Robinhood, Ledger, and Paxful were advertised. Exposed fields are names, emails, and phone numbers, reportedly aggregated using a 'crypto checker' tool. Primary SOC risk: targeted phishing, SIM-swapping, and credential stuffing against crypto holders.

5) UNVERIFIED APT43 / KIMSUKY CLAIMS. A separate dark-web post attributed to APT43 (Kimsuky, North-Korea-linked) advertised a C++ backdoor with encryption/anti-forensic capabilities, Android kernel attack tools, a server-takeover rootkit, and three alleged zero-days including a Linux root privilege-escalation. SOCRadar explicitly flags these as unverified and notes such APT claims are frequently exaggerated. APT43/Kimsuky is a documented espionage actor (MITRE G0094) whose real, sourced tooling includes the BabyShark/LATEOP VBScript backdoor and off-the-shelf RATs such as XenoRAT, QuasarRAT, and Gh0st RAT; the specific tools advertised here are not independently confirmed.

Defensive priority: breach response and credential-exposure monitoring for affected populations, anti-phishing and anti-fraud controls, and Everest-ransomware hardening (RDP exposure reduction, exfil-tool detection).

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1650 Acquire Access
- T1133 External Remote Services
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1014 Rootkit
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact
- T1657 Financial Theft

## Sources

- [Iran Hajj Organization, APT43, Sweden Data (SOCRadar Dark Web Monitoring)](https://socradar.io/blog/iran-hajj-organization-apt43-sweden-data/)
- [Dark Web Profile: Everest Ransomware (SOCRadar)](https://socradar.io/blog/dark-web-profile-everest-ransomware/)
- [Everest Threat Group Profile (Halcyon)](https://www.halcyon.ai/threat-group/everest)
- [Kimsuky / APT43 (MITRE ATT&CK Group G0094)](https://attack.mitre.org/groups/G0094/)
- [North Korean APT Focus: Kimsuky (CISA AA20-301A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a)
- [Threat Assessment: North Korean Threat Groups (Unit 42)](https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups-2024/)
- [APT43: Investigation into the North Korean group's cybercrime operations (VirusTotal)](https://blog.virustotal.com/2023/04/apt43-investigation-into-north-korean.html)
- [North Korean threat actor APT43 pivots back to strategic cyberespionage (CSO Online)](https://www.csoonline.com/article/574919/north-korean-threat-actor-apt43-pivots-back-to-strategic-cyberespionage.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0803