What is "From The Dark Side" intelligence?

From The Dark Side is Security Arsenal's curated intelligence feed covering the criminal underground — ransomware gang leak sites, dark web markets, Telegram criminal channels, initial access broker activity, credential theft operations, and emerging attack tooling. Our analysts monitor these sources so your team doesn't have to.

How do ransomware groups choose their victims?

Modern ransomware gangs operate as Ransomware-as-a-Service (RaaS) businesses. Affiliates purchase access from initial access brokers (IABs) who specialize in compromising networks via phishing, stolen VPN credentials, or unpatched vulnerabilities. Targets are selected based on revenue, sector, and perceived ability to pay. Healthcare, manufacturing, and local government are consistently over-represented.

What are initial access brokers (IABs) and why do they matter?

Initial access brokers are specialized threat actors who compromise networks and sell that access on dark web forums — typically for $500–$50,000 depending on company size and network depth. Monitoring IAB listings for your organization's domains and IP ranges can provide early warning days to weeks before a ransomware deployment.

How do credential infostealers work and what should I do if my data appears?

Infostealers like RedLine, Lumma, and Vidar are malware distributed via phishing, malvertising, and trojanized software. They harvest browser-saved credentials, session cookies, crypto wallets, and autofill data, then upload to criminal Telegram channels or dark web markets. If your organization's credentials appear in a stealer log: force password resets for all affected users, invalidate active SSO sessions, review for lateral movement, and implement phishing-resistant MFA immediately.

How does Security Arsenal detect dark web threats targeting my organization?

Our AlertMonitor platform integrates dark web monitoring feeds alongside your SIEM and EDR telemetry. When your domains, IP ranges, or executive identities appear in underground activity, we alert your team in real time and initiate a pre-defined response playbook. Contact us for a dark web exposure assessment.

Live Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

15+Intel Sources

5mRefresh Interval

6Threat Categories

24/7Analyst Coverage

Incident Response Services Managed SOC & MDR Dark Web Exposure Check

LIVE INTEL

⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors

Live Ransomware Victims

refreshed every 5 min

Active ransomware gang postings from public leak sites. For awareness and defensive intelligence only.

Threat Group	Victim	Website	Sector	Country	Discovered
N0n	Max Fashion	—	Retail & E-Commerce	AE	Nov 5, 2026	Details
N0n	Hallmark Cards, Inc. 🇺🇸 US COMPANY	—	Retail & E-Commerce	US	Nov 5, 2026	Details
N0n	Scry Analytics 🇺🇸 US COMPANY	—	Technology	US	Nov 5, 2026	Details
qilin	Rotstein & Shiffman	www.rotstein-shiffman.com	Professional Services	IL	Nov 6, 2026	Details
SilentRansomGroup	Smith, Gambrell & Russell, LLP 🇺🇸 US COMPANY	—	Professional Services	US	Nov 5, 2026	Details
SilentRansomGroup	W... R...	—	Not Found	—	Nov 5, 2026	Details
N0n	Company #137	—	Not Found	CA	Nov 5, 2026	Details
N0n	Company #136	—	Not Found	DK	Nov 5, 2026	Details
N0n	Company #135	—	Not Found	ID	Nov 5, 2026	Details
N0n	Company #134 🇺🇸 US COMPANY	—	Not Found	US	Nov 5, 2026	Details

Showing latest 10 victims. Full searchable database available.

View All & Search

Intelligence Categories

Click a category for full archive + SIGMA rules

Ransomware

613

Gang campaigns, RaaS operations, victim disclosures, double-extortion activity. SIGMA rules for every active family.

View archive →

Credential Leaks

480

Infostealer campaigns — Lumma, RedLine, Vidar. Combo list releases and enterprise credential exposure tracking.

View archive →

Underground Markets

IAB network access listings, dark web marketplace trends, tool sales, and criminal forum intelligence.

View archive →

Data Breaches

Data sales on Tor markets, breach disclosures, exposure scope analysis, and affected sector reporting.

View archive →

Criminal Tooling

195

New malware families, loaders, droppers, RATs, and stealers emerging from criminal underground channels.

View archive →

APT & Nation-State

341

Nation-state actors — Lazarus, Sandworm, Volt Typhoon. Campaign TTPs, MITRE mapping, KQL/SIGMA rules.

View archive →

Telegram Intel

Criminal Telegram channels: malware drops, C2 announcements, stolen data dumps, and initial access postings.

View archive →

Underground Intelligence Feed

APT & Nation-State

Storm-0940 ARTEX Autonomous AI Attack Framework + CL-STA-1178 Blinder Tunnel Campaign: OTX Pulse Analysis — APT Detection Pack for Finance and Critical Infrastructure

OTX pulses expose agentic AI-driven attacks on South Korean finance (Storm-0940/ARTEX), Iranian APT CL-STA-1178's Blinder Tunnel campaign in Iraq, and mass Langflow RCE scanning. Hunt now.

Nov 6, 2026

Credential Leaks

CL-STA-1178 Blinder Tunnel + Agent Tesla Q3 Surge: OTX Detection Pack for ShelbyLoader, GTA VI Lures, Langflow RCE and AWS Bedrock Key Testing

OTX shows CL-STA-1178 Blinder/ShelbyLoader, Agent Tesla email surge, GTA VI credential lures, Langflow RCE scans and AWS Bedrock key testing. High urgency.

Nov 6, 2026

Ransomware

N0N Ransomware Gang: 15 New Leak-Site Postings Claim Retail, Healthcare, and Technology Victims — Detection Rules and Hunt Queries

N0N has listed 15 organizations across retail, healthcare, and technology sectors in 3 days. Multi-source corroboration on 10 claims. Includes Sigma rules, KQL hunts, and response checklists.

Nov 6, 2026

Credential Leaks

K2F RAT via NIKKE Launcher Supply-Chain Compromise + GTA VI & Bank Phishing Credential Harvesting: OTX Pulse Analysis — Enterprise Detection Pack

CDN supply-chain compromise drops K2F credential stealer via NIKKE launcher; GTA VI phishing, fake bank-takedown cloaking, and AWS key validation campaigns active. Hunt now.

Nov 5, 2026

Criminal Tooling

CWPdoor, Lindnor & ARTEX: OTX Pulse Analysis — Linux Backdoors, Ransomware Tooling and Autonomous Intrusion Frameworks

Three live OTX pulses reveal passive Linux backdoors in CWP, ransomware-linked security killers, and AI-driven infrastructure targeting financial institutions. Immediate detection advised.

Nov 5, 2026

APT & Nation-State

BO Team Supply Chain Intrusion, Mirax Android DTO, and Storm-2603 ToolShell Fileless Attacks: OTX Pulse Analysis — Enterprise Detection Pack

OTX pulses reveal BO Team hypervisor compromise via Log4Shell, Mirax Android banking takeover in META, and Storm-2603 fileless SharePoint ransomware. Hunt now.

Nov 5, 2026

Credential Leaks

Phexia macOS Infostealer, NIKKE K2F Supply Chain RAT & VAPOR PANDA ARTEX: OTX Pulse Analysis — Enterprise Detection Pack

OTX pulses reveal Phexia macOS infostealer via ClickFix, NIKKE launcher supply-chain RAT, BO Team hypervisor compromise, GTA VI phishing, and VAPOR PANDA AI-driven espionage. Credential theft across all campaigns — hunt now.

Nov 5, 2026

Ransomware

N0N Ransomware Gang: 12 New Leak-Site Postings — Sector Targeting Analysis & Detection Rules

N0N has listed 12 organizations on its dark web leak site since 2026-11-03, including named US healthcare and retail entities. Sectors should validate exposure and hunt pre-encryption staging now.

Nov 5, 2026

Criminal Tooling

Haiou Jailbreak Bundle: Prompt Adware Targets Codex LLM Gateways via Cobalt Strike & Ladon Tooling — OTX Pulse Analysis & Detection Pack

Check Point Research flags the Haiou jailbreak bundle: prompt adware that hijacks OpenAI Codex configs, weakens guardrails, and injects ads for a rogue LLM gateway. Hunt now.

Nov 5, 2026

APT & Nation-State

SkyW4lker Device-Code Phishing Kit: Microsoft 365 OAuth Token Theft Campaign — OTX Detection Pack

SkyW4lker phishing kit abuses Microsoft device-code OAuth flow to hijack M365 sessions without passwords or MFA. 618 sandbox hits. US, UK, Canada, India targeted.

Nov 5, 2026

Credential Leaks

SkyW4lker Phishing Kit + K2F Launcher RAT + Bank Phish Cloaking Network: OTX Pulse Analysis — Enterprise Detection Pack

Device-code phishing, supply-chain RAT, GTA VI lures, and cloaked bank phishing networks drive credential theft against US enterprises, gaming platforms, and financial institutions.

Nov 5, 2026

Ransomware

MEDUSALOCKER Leak-Site Surge: 18 New Claimed Victims Posted in One Day — Sector Analysis & Detection Rules

MEDUSALOCKER listed 18 claimed victims on its leak site on 2026-11-04, spanning tech, manufacturing, education and legal services. Detection content inside.

Nov 5, 2026

Credential Leaks

Claude Code-Brand Cursor Extension SSH Backdoor + Fake-Takedown Bank Phishing: OTX Detection Pack

CRITICAL: trojanized Claude Code Cursor extensions drop macOS SSH persistence while 248 look-alike domains phish 189 US banks with fake suspended-page cloaking.

Nov 4, 2026

Ransomware

N0N Ransomware Gang: 20 New Leak-Site Claims in 72 Hours — Unverified Victim Postings, Detection Rules & Pre-Encryption Hunt Queries

N0N's leak site added 20 claimed victims across the US, Germany, Saudi Arabia and the UAE in ~48 hours. Here's what defenders should hunt for before encryption fires.

Nov 4, 2026

Criminal Tooling

ClingSTUN IoT Botnet + Fake-Download Monetization Campaign: STUN C2 Abuse and Trojanized Installer Detection Pack

OTX pulses reveal ClingSTUN exploiting IoT CVEs with STUN-protocol C2 disguise, plus a fake-download campaign dropping WorldProxyPool and monetization payloads. Hunt now.

Nov 4, 2026

APT & Nation-State

KeyHunter Operation: leepsmarts LLM API Key Theft & Academic Fraud Campaign — OTX Detection Pack

Chinese-speaking actor 'leepsmarts' harvested 2,233 LLM API keys from misconfigured cloud infra and ran academic fraud against 20 universities. URGENT: rotate exposed keys, hunt IOCs now.

Nov 4, 2026

Credential Leaks

KeyHunter LLM API Theft + Claude Code SSH Backdoor + Fake-Takedown Bank Phishing: OTX Pulse Analysis — Enterprise Detection Pack

OTX pulses reveal LLM API key theft across cloud platforms, a malicious Claude Code Cursor extension with a persistent macOS SSH backdoor, and 248 bank-phishing domains using fake-takedown cloaking. Hunt now.

Nov 4, 2026

Ransomware

N0N Ransomware Gang: 15 Leak-Site Claims in 48 Hours — Victimology Analysis, Detection Rules & Pre-Encryption Hunt Content

N0N listed 15 organizations on its dark web leak site across Nov 3-4, concentrated in the US, Germany, Saudi Arabia, and the UAE. Sectors undisclosed; claims unverified. Detection content inside.

Nov 4, 2026

View All Intel Articles

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.

Get a Dark Web Exposure Report Incident Response Services