The threat actor claims to be selling unauthorized RDWeb access in Spain to a manufacturing company, with a domain user account and Sophos antivirus installed. The listing values the access at approximately $13 million.