What is "From The Dark Side" intelligence?

From The Dark Side is Security Arsenal's curated intelligence feed covering the criminal underground — ransomware gang leak sites, dark web markets, Telegram criminal channels, initial access broker activity, credential theft operations, and emerging attack tooling. Our analysts monitor these sources so your team doesn't have to.

How do ransomware groups choose their victims?

Modern ransomware gangs operate as Ransomware-as-a-Service (RaaS) businesses. Affiliates purchase access from initial access brokers (IABs) who specialize in compromising networks via phishing, stolen VPN credentials, or unpatched vulnerabilities. Targets are selected based on revenue, sector, and perceived ability to pay. Healthcare, manufacturing, and local government are consistently over-represented.

What are initial access brokers (IABs) and why do they matter?

Initial access brokers are specialized threat actors who compromise networks and sell that access on dark web forums — typically for $500–$50,000 depending on company size and network depth. Monitoring IAB listings for your organization's domains and IP ranges can provide early warning days to weeks before a ransomware deployment.

How do credential infostealers work and what should I do if my data appears?

Infostealers like RedLine, Lumma, and Vidar are malware distributed via phishing, malvertising, and trojanized software. They harvest browser-saved credentials, session cookies, crypto wallets, and autofill data, then upload to criminal Telegram channels or dark web markets. If your organization's credentials appear in a stealer log: force password resets for all affected users, invalidate active SSO sessions, review for lateral movement, and implement phishing-resistant MFA immediately.

How does Security Arsenal detect dark web threats targeting my organization?

Our AlertMonitor platform integrates dark web monitoring feeds alongside your SIEM and EDR telemetry. When your domains, IP ranges, or executive identities appear in underground activity, we alert your team in real time and initiate a pre-defined response playbook. Contact us for a dark web exposure assessment.

Live Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

15+Intel Sources

5mRefresh Interval

6Threat Categories

24/7Analyst Coverage

Incident Response Services Managed SOC & MDR Dark Web Exposure Check

LIVE INTEL

⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors

Live Ransomware Victims

refreshed every 5 min

Active ransomware gang postings from public leak sites. For awareness and defensive intelligence only.

Threat Group	Victim	Website	Sector	Country	Discovered
everest	Chugoku Bend	—	Manufacturing	—	Oct 16, 2026	Details
everest	Taekwang Network	—	Technology	KR	Oct 16, 2026	Details
everest	Brenner Base Tunnel	—	Transportation	AT	Oct 16, 2026	Details
N0n	Prafesta Ind. e Com. de Embalagens Ltda	—	Manufacturing	BR	Oct 16, 2026	Details
play	WSBI-ESBG	www.wsbi-esbg.org	Financial Services	BE	Oct 16, 2026	Details
play	New Tec Tool Limited	www.newtectool.com	Manufacturing	HK	Oct 16, 2026	Details
play	MicroSearch Corporation	www.microsearch.net	Technology	—	Oct 16, 2026	Details
play	Pure Options	www.pureoptions.com	Financial Services	—	Oct 16, 2026	Details
everest	Kissei Shoji	—	Manufacturing	JP	Oct 16, 2026	Details
Redact	ONEOK, Inc. 🇺🇸 US COMPANY	—	Energy & Utilities	US	Oct 16, 2026	Details

Showing latest 10 victims. Full searchable database available.

View All & Search

Intelligence Categories

Click a category for full archive + SIGMA rules

Ransomware

547

Gang campaigns, RaaS operations, victim disclosures, double-extortion activity. SIGMA rules for every active family.

View archive →

Credential Leaks

433

Infostealer campaigns — Lumma, RedLine, Vidar. Combo list releases and enterprise credential exposure tracking.

View archive →

Underground Markets

IAB network access listings, dark web marketplace trends, tool sales, and criminal forum intelligence.

View archive →

Data Breaches

Data sales on Tor markets, breach disclosures, exposure scope analysis, and affected sector reporting.

View archive →

Criminal Tooling

171

New malware families, loaders, droppers, RATs, and stealers emerging from criminal underground channels.

View archive →

APT & Nation-State

306

Nation-state actors — Lazarus, Sandworm, Volt Typhoon. Campaign TTPs, MITRE mapping, KQL/SIGMA rules.

View archive →

Telegram Intel

Criminal Telegram channels: malware drops, C2 announcements, stolen data dumps, and initial access postings.

View archive →

Underground Intelligence Feed

APT & Nation-State

DragonForce Ransomware Cartel, Noodle RAT Espionage Cluster + ScreenConnect Invitation Lures: OTX Pulse Analysis — Enterprise Detection Pack

OTX pulses expose DragonForce's ransomware cartel expansion, Chinese-speaking actors deploying Noodle RAT across APAC, and ScreenConnect RAT delivery via fake event invites. High urgency for enterprise SOC teams.

Oct 16, 2026

Ransomware

N0N Ransomware Gang: 23 New Leak-Site Listings in 24 Hours — Sector Targeting Analysis, Verification Caveats & Detection Rules

N0N posted 23 alleged victims to its leak site in a single day, claiming manufacturing, healthcare, and technology targets across the US, EG, and NL. All claims remain unverified.

Oct 16, 2026

Credential Leaks

PaperCut NG/MF AI-Orchestrated Exploitation: CVE-2026-81578/82078, Chisel SOCKS5, AD Credential Theft — OTX Detection Pack

OTX: exposed AI workbench shows PaperCut NG/MF exploitation, second RCE, reverse-SOCKS5 persistence and credential/AD theft across education victims; patch and hunt now.

Oct 16, 2026

Ransomware

THEGENTLEMEN Ransomware Gang: 31 New Leak-Site Listings in 48 Hours — Sector Targeting Analysis, Detection Rules & Response Priorities

THEGENTLEMEN has listed 31 organizations on its dark web leak site, skewing toward healthcare and government. Unverified claims — but defenders in these sectors should hunt now.

Oct 16, 2026

Criminal Tooling

BambooToken MQTT C2, PeckBirdy Scambling Infrastructure & Fake MP4 NetSupport RAT: OTX Pulse Analysis — Enterprise Detection Pack

OTX pulses reveal MQTT-based BambooToken/PlugX campaign across Asia, 1.7M PeckBirdy casino-laundering domains, and fake MP4 files delivering encrypted NetSupport RAT. High urgency.

Oct 16, 2026

APT & Nation-State

KREMLIN Banking Extension, SysGoRAT Espionage & ARMORY CASTLE BeyondTrust Zero-Day: OTX Pulse Analysis — Enterprise Detection Pack

Three active campaigns: REF9334 KREMLIN banking malware targets Brazil, CL-UNK-1211 AI-built SysGoRAT hits government Linux, ARMORY CASTLE exploits BeyondTrust CVE-2026-102764 zero-day.

Oct 16, 2026

Credential Leaks

KGB RAT, KREMLIN, Variola & ARMORY CASTLE: OTX Pulse Analysis — Infostealer, Browser Hijack, and Zero-Day Exploitation Detection Pack

OTX pulses reveal FUD RAT sales, Chrome extension banking theft in Brazil, AI-orchestrated PaperCut exploitation, a ClickFix implant, and a PRC-nexus BeyondTrust zero-day. Hunt now.

Oct 16, 2026

Ransomware

N0N Ransomware Gang: 17 Leak-Site Listings in 4 Days — Cross-Sector Campaign Analysis & Detection Rules

N0N's dark web leak site shows 17 new victim claims in four days, spanning healthcare, technology, financial services and retail. Unverified claims — but defenders should hunt now.

Oct 16, 2026

Ransomware

CISA KEV Flash: 7 CVEs Added — Atlassian, Ivanti, PAN-OS & AhsayCBS Under Active Exploitation

CISA confirms 7 new actively exploited CVEs hitting Atlassian DC products, Ivanti Connect Secure, PAN-OS, AhsayCBS, Cisco SEG & Windows Shell. Patch now.

Oct 15, 2026

APT & Nation-State

Iron Man System + YamStore PhaaS: OTX Pulse Analysis — Global Postal, Bank and Government Lure Infrastructure

OTX: Iron Man System/YamStore PhaaS sells postal, bank and gov lure kits to Chinese-speaking buyers; finance, health, telecom and retail should hunt IOCs now.

Oct 15, 2026

Ransomware

N0N Ransomware Gang: 14 Leak-Site Listings — Sector Targeting Analysis & Detection Rules

N0N lists 14 orgs across tech, healthcare, finance, retail and services; verify VPN/RDP/CI edge exposure and hunt pre-encryption staging.

Oct 15, 2026

APT & Nation-State

Iron Man & CoGUI PhaaS Ecosystem: Chinese-Language Phishing Kit Disruption — OTX Pulse Analysis & Enterprise Detection Pack

OTX pulses expose the Iron Man/YamStore PhaaS ecosystem and CoGUI/CoAceV/CoFish_Ws kits hitting finance, government, and Japanese enterprises. High urgency: hunt and block now.

Oct 15, 2026

Credential Leaks

Agentic AI-Driven Spring Batch Intrusion + CoGUI/CoAceV/CoFish_Ws Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack

Live OTX pulses: LLM-agent orchestrated server takeover via exposed Spring Batch endpoint, and disruption of 3 Chinese-language phishing kits targeting Japanese finance & consumer brands. HIGH urgency.

Oct 15, 2026

Ransomware

N0N Ransomware Gang: 12 New Leak-Site Listings — Sector Exposure, Verification Limits & Detection Rules

N0N listed 12 organizations across technology, services, healthcare, retail and financial sectors in US/NL/BR; claims are unverified. Prioritize edge, virtualization and pre-encryption detection.

Oct 15, 2026

Criminal Tooling

PEERSTITCH FortiGate Implant + Iron Man PhaaS Ecosystem: OTX Pulse Analysis — Edge Device & Phishing Detection Pack

CL-STA-0954 deploys PEERSTITCH memory-resident implant on FortiManager via CVE-2024-47575/CVE-2025-61624; Iron Man PhaaS kit mapped. Telecom, finance, gov at risk. Urgent patching + IOC sweep required.

Oct 15, 2026

APT & Nation-State

Calendly Meta Phishing Kit + Candiru AdFection + CoGUI/CoAceV/CoFish Disruption: OTX Enterprise Detection Pack

OTX: fake Calendly Meta interviews steal Facebook/Google creds; Candiru AdFection zero-click ads; CoGUI/CoAceV/CoFish kits hit Japan. Hunt now.

Oct 15, 2026

Credential Leaks

Aoki Infostealer Targets AI Coding Assistant Credentials + CoGUI Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack

Aoki infostealer now harvests AI assistant API keys; fake Calendly/Meta phishing bypasses 2FA; AI agents breach servers. High urgency for credential-heavy environments.

Oct 15, 2026

Ransomware

WALLSTREET Ransomware Gang: 13 New Leak-Site Listings in 48 Hours — Sweden-Heavy Campaign Analysis & Detection Engineering

WALLSTREET listed 13 organizations on its dark web leak site Oct 13–14, 2026, with heavy concentration in Sweden and healthcare/professional services. Claims remain unverified — defenders should hunt now.

Oct 14, 2026

View All Intel Articles

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.

Get a Dark Web Exposure Report Incident Response Services