Threat actor claims to be selling root-level CMS access to an unidentified rail freight and logistics company in Germany. The advertised access reportedly includes root privileges across four CMS instances, allowing user management, file uploads, and other administrative functions.