Dark Web Most Wanted: Miyako

Miyako is an Initial Access Broker DarkWebSonar has tracked since 13 November 2024. The sharpest signal in the telemetry is not volume. It is the product: 211 of 221 listings (95%) are access sales, typically root RCE and shell on Linux firewalls, priced in the low hundreds of dollars. That is a specialist IAB book, not a ransomware leak site.

Vendor write-ups already name Miyako's Hellcat relationship and a handful of high-profile ads (a US Air Force base firewall, a China Telecom data center, ASUS). What the forum record adds is the rest of the book: 221 listings across 38 countries, a 42% United States share with China second, and a batch-and-disappear publication rhythm. Every listing below is an advertisement Miyako posted, not a compromise independently confirmed by DarkWebSonar.

Key findings from DarkWebSonar telemetry (through 2026-10-23):

• 221 forum and marketplace listings since 2024-11-13; last listing 2026-07-18. Attack-type mix is 211 Initial Access (95%) and 10 data-breach or leak records (5%).
• United States 93 (42%) and China 17 (8%) lead 38 named countries. Saudi Arabia is third (8).
• Top labeled industries: Government & Defense (34, 15%), Technology & Telecom (32, 14%), Financial Services (21, 10%).
• Largest weeks: 2024-W47 (47 listings) and 2026-W27 (21). Nearly two-thirds of all volume (142 listings) landed in the first 10 weeks of visibility.
• Named ads include a United States Air Force Base firewall (2024-12-11) and a China Telecom data-center firewall (2025-01-15). Public reporting the same week as the USAF ad also listed ASUS among sold Miyako access.

Miyako is also tracked as mommy and Miya. Public reporting places the persona as a primary access supplier to Hellcat ransomware, including the Pinger compromise via F5 BIG-IP CVE-2022-1388, and as the author of a January 2025 intrusion manual on edge-device exploitation. DarkWebSonar's observable product is the access listing, not Hellcat encryptor deployment.

By the Numbers (DarkWebSonar Telemetry)

DarkWebSonar monitors Miyako across the underground forums where the actor advertises access. The 221 listings below are what the broker chooses to publish. Listing volume is a useful proxy for inventory and sales tempo; it undercounts private deals and overstates unverified claims.

• Total listings: 221 across 38 named countries; United States 42% and China 8% lead the map
• Attack-type mix: Initial Access 211 (95%); data breach or leak 10 (5%)
• DarkWebSonar risk score: 100 / 100 (Critical)
• Where advertised: underground forums reachable without Tor (200 listings, 90%); Tor sites (21 listings, 10%)
• Last listing: 2026-07-18 (US casino and resort access, $500 via escrow)

Posting cadence and year-week analysis

Miyako does not drip listings evenly. ISO-week aggregation shows compressed bursts, then quiet.

Peaks, not a drip. The debut week 2024-W47 logged 47 listings (21–22 November). Other high weeks sit at 2024-W48 (21, including 18 on 1 December), 2026-W27 (21, late June–early July), and 2024-W50 (18). Four 2026 restarts (February, April, late June) put 95 to 100 percent of each cycle's volume in the opening week, then fell back to near zero.

The spike is a publication artifact. Twenty-one listings in 2026-W27 does not mean twenty-one same-day compromises. Same-day or adjacent-day batches across countries and sectors are a broker clearing or advertising stock. The defender takeaway is the first 48 to 72 hours after Miyako resurfaces: that is when the bulk of new firewall-access inventory appears.

Year-week	Listings	Notes
2024-W47	47	Debut peak (Nov 21–22)
2024-W48	21	Includes Dec 1 cluster of 18
2026-W27	21	Late June–early July 2026 batch
2024-W50	18	Mid-December 2024
2024-W46	15	First tracked week
2024-W49	12	Early December 2024
2026-W06	12	Early February 2026
2026-W14	11	Early April 2026

Targeting distribution: countries

A 42% United States share is expected for a Western-facing IAB. China ranking second (17 listings, 8%) is the distinctive geographic fact. Chinese organizations rarely surface on the ransomware leak sites most teams watch, so Miyako's China book is a real divergence from those datasets.

Saudi Arabia (8), Indonesia (7), Canada (7), the United Kingdom (6), and South Korea (6) fill out the next tier. The long tail across MENA, East Asia, and Southeast Asia means regional SOCs outside North America still see relevant ads.

Targeting distribution: industries

Government & Defense (34, 15%) and Technology & Telecom (32, 14%) are the two sectors that match the advertised product: edge firewall access that can pivot into large enterprise or public-sector networks. Financial Services (21, 10%), Education & Research (18), and Healthcare & Pharma (14) follow.

We assess Government & Defense and Technology & Telecom listings deserve elevated triage because a privileged foothold on the perimeter is the product, not a low-privilege user account. Industry labels are blank or Unknown for 36 of 221 listings (16%), so shares among labeled listings run modestly higher than the percentages above.

Tactics, Techniques & Procedures (TTPs)

DarkWebSonar visibility begins at the forum listing. The techniques below are inferred from the type of access each listing offers, not observed in victim networks.

Access product

The repeatable 2026 product is root RCE and shell on Linux-based firewalls, typically priced at $300–$700, with occasional escrow-mediated sales. DarkWebSonar maps 211 Initial Access listings to T1190 (Exploit Public-Facing Application), T1133 (External Remote Services), and T1078 (Valid Accounts). Those are the techniques implied by the product on sale.

The 10 data-breach and leak listings (late 2024) carry collection and exfiltration tags: T1005, T1530, T1041, T1048, T1567. We assess firewall-root ads as the primary monetization path in 2026, with data-sale posts a secondary, earlier mode.

Late June and early July 2026 listings include unnamed US telecom and insurance entities described with multi-billion-dollar revenue claims, a UAE oilfield services contractor, a Saudi logistics firm, a South Korean electronics firm, a US retail pharmacy chain, and a US call-center operation.

Recon and Hellcat follow-on (open-source reporting)

Exploit chains, scanner use, and buyer-side tradecraft come from public reporting.

That reporting describes Miyako building inventory through internet-wide recon of exposed edge devices (Shodan, FOFA, and Leakix are cited), then selling privileged footholds on firewalls, VPN gateways, and similar appliances. It links Miyako-supplied access to Hellcat ransomware, including Pinger via CVE-2022-1388, and notes PowerShell-based payload download and staging once a foothold is established. Post-purchase tradecraft (Mimikatz, PsExec/RDP, Rclone/MegaSync) is attributed to Hellcat operators, not to Miyako's listing activity.

High-value ads price above the commodity band. Cyber Daily covered a claimed FBI subdivision firewall near $2,000.

Evolution & Trends

• November 2024–January 2025: Debut surge. 142 listings in roughly 10 weeks, peaking at 47 in 2024-W47. Named ads in this window include a United States Air Force Base firewall (11 December), an ASUS-related access advertisement reported the same week, and a China Telecom data-center firewall (15 January 2025). A minority of late-2024 posts were data sales rather than access.
• January–September 2025: No DarkWebSonar-attributed listings for roughly eight months. Public reporting in this window documented the Pinger-to-Hellcat path and an intrusion manual covering edge-device exploitation.
• September–December 2025: Reactivation (25 listings), including 10 in 2025-W47.
• 2026: Batch cycles in February, April, and late June–July (2026-W06, W14, W27), then a US casino and resort listing on 18 July. The 2026 product is firewall root/RCE at $300–$700.

We assess the 2026 batches as accumulated inventory dumps rather than a change in victimology. Country and industry shares are stable across 221 listings. The Hellcat relationship is why IAB monitoring matters: a single prolific broker feeds ransomware crews that never appear on the same forum thread.

Notable Listings

A few of the higher-signal ads, from DarkWebSonar telemetry unless noted:

• United States Air Force Base (United States, Government & Defense; 2024-12-11). Claimed firewall access. DarkWebSonar ingested the BreachForums listing the same day. Cyber Daily reported that listing sold for $800.
• ASUS (public reporting, mid-December 2024). The same Cyber Daily piece listed an ASUS-related advertisement among Miyako's sold access that week, alongside a US ISP claimed at over $1 billion revenue. Treat it as a named high-value ad in the same cluster as the USAF listing, not as a confirmed compromise of ASUS.
• China Telecom data center (China, Technology & Telecom; 2025-01-15). Claimed firewall root access to an unnamed China Telecom data center. DarkWebSonar ingested the BreachForums thread on that date.
• US FBI subdivision firewall (public reporting, December 2024). Claimed root access reported near $2,000; covered in the same Cyber Daily article. The listing was later marked sold.
• Pinger (United States, Technology & Telecom; open-source reporting, November 2024). Miyako-linked F5 BIG-IP access feeding a Hellcat ransomware and data-theft operation. The listing-to-leak lag in public case studies is about two weeks.
• Saudi Post (Saudi Arabia, Government & Defense; 2026-06-30). Claimed root RCE and shell on a Linux firewall, priced at $400.

The rest of the book is the same shape at smaller scale: unnamed US telecom and insurance ads with multi-billion-dollar revenue claims, Gulf logistics and energy contractors, and East Asian electronics and manufacturing names. The story is the product (firewall root, cheap, batched), not any single brand.

DarkWebSonar Insights

• China, not only the US. A second-place China share (17 listings) is unusual next to the ransomware leak-site datasets we publish, which rarely name Chinese victims. Pair it with the China Telecom data-center ad and the US Air Force Base listing, and the picture is a broker selling privileged edge access into both Western public-sector networks and Chinese telecom infrastructure.

• Named ads sit in the same book. The US Air Force Base and China Telecom firewall ads are DarkWebSonar entries from December 2024 and January 2025. The ASUS ad sits in the same public cluster. The value of the 221-listing set is the country and industry pattern around those names, not any one headline.
• Venue split (90% non-Tor). Miyako advertises mostly on underground forums that do not require Tor. Tor-only monitoring misses the majority of listings.
• First-week batches. Year-week tracking separates a quiet trough from a 21-listing opening week (2026-W27). Monthly rollups hide that shape. The monitoring window that matters is the first days back, not a calendar month.

Defender Outlook 2026

Persistent risk: Organizations in Government & Defense, Technology & Telecom, Financial Services, Education, and Healthcare should treat Miyako-style IAB listings as early warning for perimeter compromise, especially where internet-facing firewalls and remote services lack strong authentication and timely patching. US entities face the highest listing volume. China, Saudi Arabia, Indonesia, Canada, the UK, South Korea, and the UAE appear often enough to justify a global watch.

Tempo: Output arrives in compressed reactivation bursts (2024-W47, 2025-W47, 2026-W06, W14, W27) with quiet troughs between dumps. Forum alerting needs to stay on during the quiet weeks. The first 48 to 72 hours after a new Miyako ad is the highest-value window for catching the rest of that cycle's inventory.

Defensive actions:

• Patch and inventory internet-facing firewalls, VPN concentrators, and load balancers. Prioritize known-exploited edge CVEs such as CVE-2022-1388 (an actively exploited F5 BIG-IP authentication bypass flagged in CISA advisory AA22-138A), and reduce public exposure of management interfaces.
• Enforce MFA and strong credential hygiene on administrative interfaces for perimeter devices. Assume valid privileged accounts (T1078) are part of the product Miyako sells.
• Monitor forums for the aliases Miyako, mommy, and Miya, plus organization-, sector-, or geography-specific ads mentioning root, RCE, or firewall shell.
• Hunt for suspicious PowerShell download and staging patterns after edge compromise. Open-source hunting content tied to this persona treats atypical PowerShell file retrieval as a high-signal IAB staging behavior.
• Treat a Miyako listing as a trigger for external attack-surface review and incident readiness, not as automatic proof of compromise. Plan for multi-buyer reuse: once access is sold, more than one downstream actor may attempt to use the same foothold.
• Correlate IAB spikes with ransomware affiliate activity in the following weeks. Public reporting documents Miyako access feeding Hellcat operations, including the Pinger case.

Conclusion

Miyako has listed 221 access ads since November 2024, 95% of them Initial Access, with 42% of named targets in the United States and China second. The practical signal is the product (firewall root, cheap, batched) and the named ads around it (US Air Force Base, China Telecom, ASUS in public reporting), not the internals of a Hellcat encryptor. Read this profile next to ransomware crews that buy access rather than scanning for it.

For CTI and SOC teams, the exposure is addressable: unpatched edge appliances, administrative interfaces without MFA, no forum coverage for IAB aliases, and no correlation between a Miyako ad and a Hellcat-style follow-on weeks later. Closing those gaps is the highest-value control stack against this actor.

---

Data notes: Figures come from DarkWebSonar's monitoring of Miyako-attributed forum and marketplace listings, current to 2026-10-23, except where attributed to open-source reporting. Listing dates reflect publication, not compromise date. Country and industry fields reflect listing metadata (industry is blank or Unknown for 36 of 221). Trend, country, and industry charts are the July 2026 snapshot.

---

👉 Dark Web Most Wanted profiles are powered by DarkWebSonar's continuous monitoring of dark web forums and threat-actor activity. Want real-time visibility into Initial Access Brokers like Miyako? Contact Sales.

See ranked watchlists and actor profiles: Threat intelligence for teams without a CTI team.