Live Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

15+Intel Sources
5mRefresh Interval
6Threat Categories
24/7Analyst Coverage
Incident Response Services Managed SOC & MDRDark Web Exposure Check
LIVE INTEL
⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors

Live Ransomware Victims

refreshed every 5 min

Active ransomware gang postings from public leak sites. For awareness and defensive intelligence only.

Threat GroupVictimSectorCountryDiscovered
lapsus$
INGKA GROUP
Consumer ServicesSEJun 13, 2026Details
lapsus$
GITHUB INTERNAL
🇺🇸 US COMPANY		TechnologyUSJun 13, 2026Details
krybit
www.mbt-energy.com
EnergyDEJun 13, 2026Details
payload
myipo.gov.my
Public SectorMYJun 12, 2026Details
threeam
jetmachprod.com
Manufacturing—Jun 12, 2026Details
threeam
jastrebarsko.hr
Not FoundHRJun 12, 2026Details
threeam
palmero.com
Not Found—Jun 12, 2026Details
threeam
insamani.com.ar
Not FoundARJun 12, 2026Details
threeam
bsynchro.com
TechnologyDEJun 12, 2026Details
threeam
molinoscabodi.com.ar
Agriculture and Food ProductionARJun 12, 2026Details

Showing latest 10 victims. Full searchable database available.

View All & Search

Intelligence Categories

Click a category for full archive + SIGMA rules
Telegram Intel
Criminal Telegram channels: malware drops, C2 announcements, stolen data dumps, and initial access postings.
View archive →

Underground Intelligence Feed

View All Intel Articles

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.

Get a Dark Web Exposure ReportIncident Response Services