Live Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

15+Intel Sources
5mRefresh Interval
6Threat Categories
24/7Analyst Coverage
Incident Response Services Managed SOC & MDRDark Web Exposure Check
LIVE INTEL
⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors

Live Ransomware Victims

refreshed every 5 min

Active ransomware gang postings from public leak sites. For awareness and defensive intelligence only.

Threat GroupVictimSectorCountryDiscovered
qilin
Sponseller Group
🇺🇸 US COMPANY		Not FoundUSMay 24, 2026Details
qilin
Branded Products
Consumer ServicesAUMay 24, 2026Details
qilin
Alpha Group Holdings
Not FoundNZMay 24, 2026Details
qilin
Alpert Slobin & Rubenstein
🇺🇸 US COMPANY		Business ServicesUSMay 24, 2026Details
qilin
P & G Trading
Business Services—May 24, 2026Details
qilin
ExpoCredit
Financial ServicesCZMay 24, 2026Details
qilin
Global Retool Group
Business ServicesGBMay 24, 2026Details
dragonforce
Prologic Construction
ConstructionCAMay 24, 2026Details
dragonforce
HELIX INTERNATIONAL
Not FoundGBMay 24, 2026Details
dragonforce
Heartland Growers
🇺🇸 US COMPANY		Agriculture and Food ProductionUSMay 24, 2026Details

Showing latest 10 victims. Full searchable database available.

View All & Search

Intelligence Categories

Click a category for full archive + SIGMA rules
Telegram Intel
Criminal Telegram channels: malware drops, C2 announcements, stolen data dumps, and initial access postings.
View archive →

Underground Intelligence Feed

View All Intel Articles

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.

Get a Dark Web Exposure ReportIncident Response Services