What is "From The Dark Side" intelligence?

From The Dark Side is Security Arsenal's curated intelligence feed covering the criminal underground — ransomware gang leak sites, dark web markets, Telegram criminal channels, initial access broker activity, credential theft operations, and emerging attack tooling. Our analysts monitor these sources so your team doesn't have to.

How do ransomware groups choose their victims?

Modern ransomware gangs operate as Ransomware-as-a-Service (RaaS) businesses. Affiliates purchase access from initial access brokers (IABs) who specialize in compromising networks via phishing, stolen VPN credentials, or unpatched vulnerabilities. Targets are selected based on revenue, sector, and perceived ability to pay. Healthcare, manufacturing, and local government are consistently over-represented.

What are initial access brokers (IABs) and why do they matter?

Initial access brokers are specialized threat actors who compromise networks and sell that access on dark web forums — typically for $500–$50,000 depending on company size and network depth. Monitoring IAB listings for your organization's domains and IP ranges can provide early warning days to weeks before a ransomware deployment.

How do credential infostealers work and what should I do if my data appears?

Infostealers like RedLine, Lumma, and Vidar are malware distributed via phishing, malvertising, and trojanized software. They harvest browser-saved credentials, session cookies, crypto wallets, and autofill data, then upload to criminal Telegram channels or dark web markets. If your organization's credentials appear in a stealer log: force password resets for all affected users, invalidate active SSO sessions, review for lateral movement, and implement phishing-resistant MFA immediately.

How does Security Arsenal detect dark web threats targeting my organization?

Our AlertMonitor platform integrates dark web monitoring feeds alongside your SIEM and EDR telemetry. When your domains, IP ranges, or executive identities appear in underground activity, we alert your team in real time and initiate a pre-defined response playbook. Contact us for a dark web exposure assessment.

Live Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

15+Intel Sources

5mRefresh Interval

6Threat Categories

24/7Analyst Coverage

Incident Response Services Managed SOC & MDR Dark Web Exposure Check

LIVE INTEL

⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors

Live Ransomware Victims

refreshed every 5 min

Active ransomware gang postings from public leak sites. For awareness and defensive intelligence only.

Threat Group	Victim	Website	Sector	Country	Discovered
blacknevas	Speed Group	—	Transportation	—	Jul 28, 2026	Details
thegentlemen	Buck Knives 🇺🇸 US COMPANY	buckknives.com	Manufacturing	US	Jul 28, 2026	Details
chaos	thecranewaregroup.com	thecranewaregroup.com	Technology	GB	Jul 28, 2026	Details
cmdorganization	B-K Tool & Design 🇺🇸 US COMPANY	www.bktool.com	Manufacturing	US	Jul 28, 2026	Details
Deadlock	DIATER	diater.com/en	Manufacturing	ES	Jul 28, 2026	Details
Deadlock	Pasello	pasello.com	Technology	IT	Jul 28, 2026	Details
Booba Project	Oklahoma Manufacturing Alliance 🇺🇸 US COMPANY	www.okalliance.com	Manufacturing	US	Jul 28, 2026	Details
Booba Project	Incredible Technologies 🇺🇸 US COMPANY	www.itsgames.com	Technology	US	Jul 28, 2026	Details
incransom	Della Casa Group AG	dellacasa.group	Other	CH	Jul 28, 2026	Details
qilin	Gran valle negocios	www.granvallenegocios.com.ar	Other	AR	Jul 28, 2026	Details

Showing latest 10 victims. Full searchable database available.

View All & Search

Intelligence Categories

Click a category for full archive + SIGMA rules

Ransomware

308

Gang campaigns, RaaS operations, victim disclosures, double-extortion activity. SIGMA rules for every active family.

View archive →

Credential Leaks

285

Infostealer campaigns — Lumma, RedLine, Vidar. Combo list releases and enterprise credential exposure tracking.

View archive →

Underground Markets

IAB network access listings, dark web marketplace trends, tool sales, and criminal forum intelligence.

View archive →

Data Breaches

Data sales on Tor markets, breach disclosures, exposure scope analysis, and affected sector reporting.

View archive →

Criminal Tooling

New malware families, loaders, droppers, RATs, and stealers emerging from criminal underground channels.

View archive →

APT & Nation-State

198

Nation-state actors — Lazarus, Sandworm, Volt Typhoon. Campaign TTPs, MITRE mapping, KQL/SIGMA rules.

View archive →

Telegram Intel

Criminal Telegram channels: malware drops, C2 announcements, stolen data dumps, and initial access postings.

View archive →

Underground Intelligence Feed

Credential Leaks

AI Agent LLMjacking & QR Code Phishing: OTX Pulse Analysis — Enterprise Detection Pack

OTX pulses reveal active exploitation of AI Model Context Protocol for credential theft and QR code phishing campaigns targeting financial sectors.

Jul 28, 2026

Ransomware

M3RX Ransomware Gang: 3 New Victims Posted — Manufacturing & Professional Services Under Siege

M3RX targets Manufacturing and Professional Services in DE, PT, and US. Immediate patching for Check Point and ScreenConnect required.

Jul 28, 2026

Criminal Tooling

GoGRPC Backdoor & Teams Vishing Campaign: Helpdesk Hijacker IAB Tactics — OTX Pulse Analysis

Active IAB campaign abusing Microsoft Teams vishing and Quick Assist to deploy GoGRPC backdoor. Critical urgency.

Jul 28, 2026

APT & Nation-State

Mirage Kitten Campaign: NightLedger Backdoor & ArcBridge Toolset Analysis

APT group Mirage Kitten targets Middle East & Africa aerospace/defense sectors using NightLedger backdoor and custom malware. Critical urgency.

Jul 28, 2026

Credential Leaks

CastleLoader, NeedleStealer & AI MCP Exploits: Multi-Vector Credential Theft — OTX Pulse Analysis

Active campaigns deploying CastleLoader/NeedleStealer and exploiting AI infrastructure alongside QR-based mobile phishing for credential harvesting.

Jul 28, 2026

Ransomware

SAFEPAY Ransomware: DACH Region Blitz — Retail & Education Sectors Under Siege via Critical VPN Flaws

SAFEPAY targets German Retail/Edu sectors using ScreenConnect & VPN exploits. Immediate patching and detection required.

Jul 28, 2026

Ransomware

CISA KEV Flash: 8 Critical CVEs Under Active Attack — Fortinet, Check Point & Microsoft Targeted

CISA adds 8 actively exploited CVEs. Critical flaws in Fortinet, Arista, and Microsoft SharePoint allow RCE & auth bypass. Patch immediately.

Jul 27, 2026

Criminal Tooling

BabaDeda Loader + ClickFix Social Engineering: OTX Pulse Analysis — Enterprise Detection Pack

Advanced BabaDeda loader using ClickFix social engineering targeting enterprise networks. High urgency - widespread detection recommended.

Jul 27, 2026

Ransomware

GENESIS Ransomware Gang: 6 New Victims Posted — Critical Infrastructure & Manufacturing Targeted via Firewall Exploits

GENESIS ransomware claims 6 new US/CA victims. Immediate action required on Check Point & Cisco firewall flaws.

Jul 27, 2026

Credential Leaks

Fake Corepack Supply Chain Attack: OpenShield & Apprunner Distribution

Fake Corepack site targeting developers with OpenShield infostealer and Apprunner proxyware via typosquatting. Urgent blocking required.

Jul 27, 2026

Ransomware

CRPXO Ransomware: Cross-Sector Surge & Firewall Exploitation — Detection Engineering Brief

CRPXO aggressively targets US Healthcare & Tech sectors via firewall and RMM flaws. Immediate patching of CVE-2026-50751 required.

Jul 27, 2026

Ransomware

SECTION9 Ransomware: Surge in LATAM & Global Attacks — Check Point & ScreenConnect Exploitation

SECTION9 claims 15+ new victims targeting Tech, Ag, and Retail. Active exploitation of Check Point and ScreenConnect vulnerabilities observed.

Jul 26, 2026

Criminal Tooling

AsyncRAT & Remcos RATs + BabaDeda Loader: Multi-Stage Phishing & ClickFix Campaigns — Enterprise Detection Pack

Active phishing campaigns delivering AsyncRAT/Remcos via steganography and the BabaDeda ClickFix loader. Urgent blocking required.

Jul 26, 2026

Credential Leaks

Langflow AI Pipeline Exploitation (CVE-2026-55255): Chained RCE & IDOR Credential Theft

Active exploitation of Langflow via chained RCE and IDOR vulnerabilities results in credential theft and botnet deployment.

Jul 26, 2026

Ransomware

GLOBAL SECRET GROUP: 2026-07-26 Mass Victim Posting — Tech & Finance Sector Targeting via Critical VPN & RMM Exploits

Global Secret Group posts 15 new victims targeting Tech & Finance. Active exploitation of Check Point (CVE-2026-50751) and ScreenConnect (CVE-2024-1708) observed.

Jul 26, 2026

Criminal Tooling

TonRAT, AsyncRAT & BabaDeda Campaigns: OTX Pulse Analysis — Enterprise Detection Pack

Active campaigns delivering TonRAT, AsyncRAT, and BabaDeda via ZIPs, phishing, and ClickFix. High urgency for hospitality.

Jul 26, 2026

APT & Nation-State

Kimsuky & Void Arachne Surge: KimJongRAT, XenoRAT & DcRAT Campaigns Targeting Asian Infrastructure

Kimsuky & Void Arachne APTs active with KimJongRAT/XenoRAT/DcRAT. Targeting Japan, SK, India via phishing & GitHub abuse. Urgent.

Jul 26, 2026

Credential Leaks

Kimsuky's KimJongRAT & Langflow Exploitation: OTX Pulse Analysis — Enterprise Detection Pack

Kimsuky abuses GitHub for KimJongRAT attacks; Langflow CVEs facilitate credential theft. High urgency.

Jul 26, 2026

View All Intel Articles

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.

Get a Dark Web Exposure Report Incident Response Services