What is "From The Dark Side" intelligence?

From The Dark Side is Security Arsenal's curated intelligence feed covering the criminal underground — ransomware gang leak sites, dark web markets, Telegram criminal channels, initial access broker activity, credential theft operations, and emerging attack tooling. Our analysts monitor these sources so your team doesn't have to.

How do ransomware groups choose their victims?

Modern ransomware gangs operate as Ransomware-as-a-Service (RaaS) businesses. Affiliates purchase access from initial access brokers (IABs) who specialize in compromising networks via phishing, stolen VPN credentials, or unpatched vulnerabilities. Targets are selected based on revenue, sector, and perceived ability to pay. Healthcare, manufacturing, and local government are consistently over-represented.

What are initial access brokers (IABs) and why do they matter?

Initial access brokers are specialized threat actors who compromise networks and sell that access on dark web forums — typically for $500–$50,000 depending on company size and network depth. Monitoring IAB listings for your organization's domains and IP ranges can provide early warning days to weeks before a ransomware deployment.

How do credential infostealers work and what should I do if my data appears?

Infostealers like RedLine, Lumma, and Vidar are malware distributed via phishing, malvertising, and trojanized software. They harvest browser-saved credentials, session cookies, crypto wallets, and autofill data, then upload to criminal Telegram channels or dark web markets. If your organization's credentials appear in a stealer log: force password resets for all affected users, invalidate active SSO sessions, review for lateral movement, and implement phishing-resistant MFA immediately.

How does Security Arsenal detect dark web threats targeting my organization?

Our AlertMonitor platform integrates dark web monitoring feeds alongside your SIEM and EDR telemetry. When your domains, IP ranges, or executive identities appear in underground activity, we alert your team in real time and initiate a pre-defined response playbook. Contact us for a dark web exposure assessment.

Live Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

15+Intel Sources

5mRefresh Interval

6Threat Categories

24/7Analyst Coverage

Incident Response Services Managed SOC & MDR Dark Web Exposure Check

LIVE INTEL

⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors

Live Ransomware Victims

refreshed every 5 min

Active ransomware gang postings from public leak sites. For awareness and defensive intelligence only.

Threat Group	Victim	Website	Sector	Country	Discovered
qilin	S.J. Louis	www.sjlouis.com	Not Found	BR	Jul 8, 2026	Details
krybit	xuerong.com	xuerong.com	Technology	CN	Jul 8, 2026	Details
krybit	shelby.com.mx	shelby.com.mx	Not Found	MX	Jul 8, 2026	Details
chaos	opportune.com 🇺🇸 US COMPANY	www.zoominfo.com/c/opportune-llp/147440067	Business Services	US	Jul 8, 2026	Details
chaos	corepharma.com 🇺🇸 US COMPANY	www.zoominfo.com/c/corepharma-llc/30217761	Healthcare	US	Jul 8, 2026	Details
akira	Wade's Dairy	—	Agriculture and Food Production	GB	Jul 8, 2026	Details
play	Preneed Funeral Programs 🇺🇸 US COMPANY	www.preneed.net	Consumer Services	US	Jul 7, 2026	Details
qilin	Next Clinics	www.next-clinics.cz	Healthcare	CZ	Jul 7, 2026	Details
play	Kevin Bao Lenguyen	www.kblaa.com	Not Found	—	Jul 7, 2026	Details
play	United Infrastructure 🇺🇸 US COMPANY	www.unitedinfrastructure.com	Energy	US	Jul 7, 2026	Details

Showing latest 10 victims. Full searchable database available.

View All & Search

Intelligence Categories

Click a category for full archive + SIGMA rules

Ransomware

252

Gang campaigns, RaaS operations, victim disclosures, double-extortion activity. SIGMA rules for every active family.

View archive →

Credential Leaks

242

Infostealer campaigns — Lumma, RedLine, Vidar. Combo list releases and enterprise credential exposure tracking.

View archive →

Underground Markets

IAB network access listings, dark web marketplace trends, tool sales, and criminal forum intelligence.

View archive →

Data Breaches

Data sales on Tor markets, breach disclosures, exposure scope analysis, and affected sector reporting.

View archive →

Criminal Tooling

New malware families, loaders, droppers, RATs, and stealers emerging from criminal underground channels.

View archive →

APT & Nation-State

170

Nation-state actors — Lazarus, Sandworm, Volt Typhoon. Campaign TTPs, MITRE mapping, KQL/SIGMA rules.

View archive →

Telegram Intel

Criminal Telegram channels: malware drops, C2 announcements, stolen data dumps, and initial access postings.

View archive →

Underground Intelligence Feed

APT & Nation-State

GIFTEDCROOK, Overlord & BRICKSTORM: OTX Pulse Analysis — Multi-Front APT Campaigns & Detection Pack

Russian, North Korean, and Chinese APTs target Ukraine, US Devs, and MSPs via WinRAR flaws, GitHub phishing, and edge device compromise.

Jul 8, 2026

Credential Leaks

GIFTEDCROOK, OtterCookie & BRICKSTORM: OTX Pulse Analysis — Multi-Vector Credential Theft Campaigns

Active campaigns by SHADOW-EARTH-066 and UNK_DeadDrop exploit WinRAR and GitHub to steal credentials. Urgent detection required.

Jul 8, 2026

Ransomware

THEGENTLEMEN Ransomware: Global Surge in Critical Infrastructure Targeting & Exploitation of Firewall Vulnerabilities

THEGENTLEMEN claims 15+ victims in 24 hours targeting Energy, Tech, and Manufacturing. Urgent patching of Check Point and Cisco CVEs required.

Jul 8, 2026

APT & Nation-State

Salat Stealer, UNK_MassTraction & Cavern Manticore: OTX Pulse Analysis — Multi-Vector APT Campaigns

Three active campaigns: Salat Stealer infostealer, UNK_MassTraction exploiting Roundcube in universities, and Iran-linked Cavern Manticore targeting Israel. High urgency.

Jul 7, 2026

Credential Leaks

CrySome RAT, Salat Stealer & UNK_MassTraction: Multi-Vector Credential Theft Operations — OTX Intel

Active campaigns deploy CrySome RAT and Salat Stealer for credential theft, while UNK_MassTraction exploits university mail servers. Immediate action required.

Jul 7, 2026

Ransomware

QILIN Ransomware: 15 New Victims Posted — Construction & Business Services Targeted via Check Point & ScreenConnect Exploits

QILIN ransomware targets Business Services and Construction sectors using Check Point and ScreenConnect exploits. Immediate patching advised.

Jul 6, 2026

Criminal Tooling

BabaDeda Loader: ClickFix Malware Campaign Analysis — Enterprise Detection Pack

Evolving BabaDeda loader using ClickFix technique for payload delivery. Urgent: block identified C2 IPs and hunt for installer-based infections.

Jul 6, 2026

Ransomware

SAFEPAY Ransomware: Aggressive German Sector Targeting & Critical Infrastructure Exploits

SAFEPAY targets German Health, Transport, Public Sector; exploits Check Point & Cisco CVEs.

Jul 6, 2026

Criminal Tooling

Nezha Web Shell Campaign & BabaDeda ClickFix Loader: OTX Pulse Analysis — Enterprise Detection Pack

OTX pulses reveal active abuse of Nezha monitoring tool via phpMyAdmin log poisoning and the evolution of the BabaDeda ClickFix loader.

Jul 6, 2026

Ransomware

PAYLOAD Ransomware: Central European Campaign Targeting Energy and Agriculture via Firewall Exploits

PAYLOAD gang hits Energy and Food sectors in CH, IT, DE. Exploits targeting Check Point VPNs and Cisco FMC observed.

Jul 6, 2026

Criminal Tooling

AsyncRAT & Remcos Steganography Campaign: OTX Pulse Analysis — Enterprise Detection Pack

Active global phishing campaign using Excel macros and steganography to deliver AsyncRAT/Remcos. High urgency.

Jul 5, 2026

APT & Nation-State

OP-512 China-Linked Espionage + UNC3753 Targeted Campaigns: GhostKit, PlugX, Cobalt Strike, BazarLoader, TrickBot - OTX Pulse Analysis — Enterprise Detection Pack

China-linked OP-512 targets IIS with GhostKit; UNC3753 attacks US law firms with BazarLoader/TrickBot. HIGH PRIORITY threat intel.

Jul 5, 2026

Criminal Tooling

CastleRAT, AsyncRAT & Havoc Framework: Multi-Vector Malware Campaign Analysis — Detection Pack

Active campaigns utilizing ClickFix, steganography, and tax lures delivering CastleRAT, AsyncRAT, and Havoc. High urgency.

Jul 5, 2026

Credential Leaks

Gaming Platform Phishing & Credential Harvesting: Roblox/Minecraft Targeted Campaign Analysis

Active phishing campaign targeting children via fake Roblox/Minecraft sites. High urgency for Education sectors to block IOCs.

Jul 5, 2026

Ransomware

GENESIS Ransomware Gang: 9 New US Victims Targeted — Critical Firewall & VPN Exploitation Detected

Genesis gang posts 9 US victims in Healthcare & Tech. Actively exploiting Check Point (CVE-2026-50751) and Cisco FMC flaws for initial access.

Jul 5, 2026

APT & Nation-State

MarkiRAT Surveillance Operations + Pink Vishing Campaign + Global Smishing Network: OTX Pulse Analysis — Enterprise Detection Pack

Iran's TAG-182 using MarkiRAT; Pink gang with vishing; massive smishing op. High urgency for global enterprises.

Jul 4, 2026

Credential Leaks

Pink Vishing & Global PhaaS Campaigns: OTX Credential Theft Analysis

Pink actor vishing, global smishing operations, and gaming credential theft target finance, telco, and education sectors.

Jul 4, 2026

Ransomware

PLAY Ransomware Gang: Construction & Finance Sector Surge — Firewall & Remote Access Exploitation

PLAY targets AU/US Construction & Finance firms via ScreenConnect & Firewall flaws. Immediate patching of CVE-2024-1708 required.

Jul 4, 2026

View All Intel Articles

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.

Get a Dark Web Exposure Report Incident Response Services