Live Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

15+Intel Sources
5mRefresh Interval
6Threat Categories
24/7Analyst Coverage
Incident Response Services Managed SOC & MDRDark Web Exposure Check
LIVE INTEL
⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors

Live Ransomware Victims

refreshed every 5 min

Active ransomware gang postings from public leak sites. For awareness and defensive intelligence only.

Threat GroupVictimSectorCountryDiscovered
qilin
Law Office of Steven R Smith
🇺🇸 US COMPANY		Business ServicesUSMay 4, 2026Details
qilin
Foxstone Financial
Financial ServicesAUMay 4, 2026Details
qilin
Lexus
ManufacturingJPMay 4, 2026Details
qilin
Rizzuto Law Firm
🇺🇸 US COMPANY		Business ServicesUSMay 4, 2026Details
qilin
General Hardware
ManufacturingCOMay 4, 2026Details
chaos
vacaero.com
Hospitality and TourismMXMay 4, 2026Details
chaos
www.cswindustrials.com
🇺🇸 US COMPANY		ManufacturingUSMay 4, 2026Details
interlock
Lonestar Truck Group & Tag Truck Center
🇺🇸 US COMPANY		Transportation/LogisticsUSMay 4, 2026Details
lamashtu
Luna Group
Not FoundEGMay 4, 2026Details
qilin
City of Sandstone
🇺🇸 US COMPANY		Public SectorUSMay 4, 2026Details

Showing latest 10 victims. Full searchable database available.

View All & Search

Intelligence Categories

Click a category for full archive + SIGMA rules
Telegram Intel
Criminal Telegram channels: malware drops, C2 announcements, stolen data dumps, and initial access postings.
View archive →

Underground Intelligence Feed

View All Intel Articles

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.

Get a Dark Web Exposure ReportIncident Response Services