Read Time 3 mins | 26 November 2025
A dark web listing appeared in late November 2025 offering complete administrative access to a Canadian architecture and engineering firm's FTP server for $2.5K. The seller, known as "Dark_Alpha," included specific metadata: 59M$ revenue, over 200,000 employees, architecture and engineering industry, and 1.9TB of data including source code, documents and PDF.
For most dark web monitoring solutions, this listing would go undetected unless the company's name appeared explicitly. This is where metadata analysis becomes critical in detecting when compromised access is being sold, providing the intelligence needed to prevent exploitation.
Why is FTP Valuable to Attackers
FTP (File Transfer Protocol) is a network protocol used to transfer files between computers. Organisations commonly use FTP servers to store and share large volumes of data, including project files, source code, documentation, and other business-critical information. Administrative access provides complete control over all stored files. With admin credentials, an attacker can view, download, modify, or delete any data on the server.
In this case, admin access meant control over 1.9TB of architectural designs, engineering documents, and proprietary source code.
The Problem with Traditional Dark Web Monitoring
Most dark web monitoring services search for company names across known breach databases and marketplaces. If your organisation is explicitly mentioned, you receive an alert.
This approach has a fundamental flaw. Sophisticated threat actors often advertise stolen access using metadata (industry classifications, revenue brackets, geographic locations, employee counts, technology stacks) rather than company names. This attracts serious buyers who can identify high-value targets from limited information whilst evading basic monitoring tools.
A traditional monitoring service searching for "XYZ Engineering Ltd" would miss this listing entirely, yet any prospective buyer with access to business databases could narrow down potential targets within minutes.
Analysing Dark Web Metadata
Rivanorth Oko analyses metadata from thousands of dark web listings, posts, and leak advertisements to identify when compromised access to organisations matching your profile is being sold.
The company being targeted had already been compromised. The critical window is between when that access is offered for sale and when a buyer exploits it.
Rivanorth Oko processed the listing's key attributes:
- Country: CANADA
- Industry: Architecture, Engineering
- Revenue: 59M$
- Employees: +200,000
- Access Type: FTP SERVER (Admin privileges)
- Data Volume: 1.9TB
By cross-referencing these data points against clients and their supply chains, Rivanorth Oko identified organisations matching this profile. Detection at the point of sale provides the critical intelligence needed to respond before exploitation.
Supply Chain Visibility
Rivanorth Oko monitors both your organisation and your supply chain. Whether the exposure affects your company directly or one of your vendors, you receive alerts with actionable intelligence.
Consider the architecture firm in this example. If you're their client, the confidential documents on that FTP server may include your proprietary designs, project specifications, and sensitive financial information. Traditional monitoring focused solely on your company would not detect this exposure.
When third-party suppliers appear in dark web listings (even when described only by metadata), you receive alerts as if it were your own organisation at risk.
The Intelligence Advantage
When compromised access is sold on the dark web but goes undetected, a buyer can conduct reconnaissance and exfiltrate data, with organisations discovering the damage weeks or months later.
Detection at the point of sale provides time to respond. Organisations can immediately revoke access, conduct forensic investigation, rotate credentials, notify impacted parties, and implement additional monitoring.
Rivanorth Oko monitors marketplace listings, forum discussions where threat actors share reconnaissance, paste sites with exposed credentials, code repositories with accidentally committed secrets, Telegram channels where access is traded, and historical breach data.
As sellers increasingly describe compromised access by characteristics rather than explicit names, effective monitoring requires analysing these metadata patterns to detect threats before exploitation occurs.
About Rivanorth Oko
Rivanorth Oko provides adversarial intelligence for businesses, monitoring the dark web from an attacker's perspective. By detecting compromised access at the point of sale through metadata analysis, Rivanorth Oko provides the critical intelligence window between initial compromise and exploitation when response can still prevent damage.