-
A seller using the handle “cvvman” says they kept access to an unnamed U.S. internet provider for years and wants at least six figures.
-
No company has confirmed a breach, and we found no outside proof of the claims.
-
Real telecom break-ins have lasted for years before, so the story is plausible but still unproven.
An online seller is pitching what could be a major breach. The actor, known as “cvvman,” says they spent years inside a U.S. internet provider’s network. Now they want a buyer. However, the post never names the company, so the claims remain unverified for now.
What the Seller Says is for Sale
The post lists several items. First, it offers full lists of employee and customer emails. Next, it claims root-level control of millions of customer routers. Root access is the highest level of control. It would let someone change a router’s settings at will.
Also, the seller lists internal VPN addresses and web links that employees use. In addition, the post promises steps for reaching RSA and Cisco management tools. Finally, it offers password hashes from Active Directory, the system that decides who can log in to company computers.
A hash is a scrambled password. The seller says most of them are cracked, so they reveal the real passwords. Details for reaching domain controllers, the servers that run those logins, round out the package.
The seller adds a bigger claim. They claim that the provider’s network links to one of the three largest US telecom companies. If this proves to be true, then the risk would be even higher. Yet the post does not name that carrier either.
How the Access Allegedly Ended
According to the post, the seller lost access after letting about 15 VPN logins expire. A VPN login lets an outsider enter a company network like an employee. Once those logins lapsed, the door closed. The post gives no dates, so we cannot tell how recent the access was.
The seller also says the provider never noticed. Furthermore, they claim the security team once decided it did not need CrowdStrike, a well-known security firm. The threat actor says that screenshots and samples are available, but only to serious buyers. That detail matters because real samples would help prove the claims. But until someone sees them, the post is only a sales pitch.
Currently, there’s no coverage of this post by any credible sources, whether researchers or media outlets. Likewise, we found no statement from any provider. We also searched the handle itself, and the results showed only unrelated pages. We found no sign that the data exists.
However, that does not mean the claim is false. It does mean people should be careful. Sellers on criminal forums want high prices, so they have a reason to brag. Therefore, treat every detail as a claim, not a fact.
Why the Threat Actor’s Claim is Still Believable
Even so, the idea is not far-fetched. Intruders have stayed inside U.S. carriers for years. For example, Cisco’s security team reported on a China-linked group called Salt Typhoon. In one case, it kept access for over three years. Cisco said the group abused a flaw in its software. The group first needed valid logins, Cisco added, and it captured network traffic to collect more of them.
Meanwhile, the FBI and CISA warned in October and November 2024 that attackers had breached several major U.S. telecoms. By December 2024, attackers had hit at least eight, TechRadar reported. Nothing links that group to this seller. Still, the cases show that long, quiet break-ins happen.
Router attacks have caused real damage, too. In October 2023, Lumen’s Black Lotus Labs documented an attack that knocked out more than 600,000 routers at one U.S. internet provider in about 72 hours. Customers needed new hardware. Lumen did not name the provider. In that case, malware did the damage, not the seller. Still, it shows what control of home routers can do.
US and allied authorities have also warned that Russian hackers continue to target routers and other edge devices, highlighting the ongoing risks to network infrastructure.
Selling network access is also common. Rapid7 notes that criminals often sell it on underground forums. Prices depend on the size of the company and the number of devices. As a result, a high ask for a large provider would not be unusual.
Next Step for Individuals and Organizations
Nothing shows that customers face danger today. Even so, a few steps cost little. To start with, alter your router’s admin password. Secondly, make sure to update your system when the service provider releases an update.
Also, set a unique password for your email, not the same one you use for your Netflix or other accounts. Then turn on two-step verification; this will ensure that even if someone manages to obtain your login password, they still can’t get in unless they have a second code. And last but not least, be wary of emails asking you to click a link or sign in; they’re often traps.
Providers have more to do. They should check for old VPN accounts and also reset staff passwords, especially for administrators. Additionally, they should require two-step login for staff and review who can manage customer routers. Finally, they should look for logins from strange places or at odd hours.
Several things would settle this story. A statement from the provider would help. A court or regulator filing could also confirm a breach. Meanwhile, a security researcher who reviews the samples could say whether they are real. Until one of those happens, the claims stay unverified.
