What is "From The Dark Side" intelligence?

From The Dark Side is Security Arsenal's curated intelligence feed covering the criminal underground — ransomware gang leak sites, dark web markets, Telegram criminal channels, initial access broker activity, credential theft operations, and emerging attack tooling. Our analysts monitor these sources so your team doesn't have to.

How do ransomware groups choose their victims?

Modern ransomware gangs operate as Ransomware-as-a-Service (RaaS) businesses. Affiliates purchase access from initial access brokers (IABs) who specialize in compromising networks via phishing, stolen VPN credentials, or unpatched vulnerabilities. Targets are selected based on revenue, sector, and perceived ability to pay. Healthcare, manufacturing, and local government are consistently over-represented.

What are initial access brokers (IABs) and why do they matter?

Initial access brokers are specialized threat actors who compromise networks and sell that access on dark web forums — typically for $500–$50,000 depending on company size and network depth. Monitoring IAB listings for your organization's domains and IP ranges can provide early warning days to weeks before a ransomware deployment.

How do credential infostealers work and what should I do if my data appears?

Infostealers like RedLine, Lumma, and Vidar are malware distributed via phishing, malvertising, and trojanized software. They harvest browser-saved credentials, session cookies, crypto wallets, and autofill data, then upload to criminal Telegram channels or dark web markets. If your organization's credentials appear in a stealer log: force password resets for all affected users, invalidate active SSO sessions, review for lateral movement, and implement phishing-resistant MFA immediately.

How does Security Arsenal detect dark web threats targeting my organization?

Our AlertMonitor platform integrates dark web monitoring feeds alongside your SIEM and EDR telemetry. When your domains, IP ranges, or executive identities appear in underground activity, we alert your team in real time and initiate a pre-defined response playbook. Contact us for a dark web exposure assessment.

Live Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

15+Intel Sources

5mRefresh Interval

6Threat Categories

24/7Analyst Coverage

Incident Response Services Managed SOC & MDR Dark Web Exposure Check

LIVE INTEL

⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors⚠ RANSOMWARE: RansomHub — double-extortion op targeting healthcare sector⚠ IAB: RDP access to mid-market manufacturing firm listed on underground forum⚠ INFOSTEALER: Lumma Stealer campaign — 1.4M credentials harvested from browser sessions⚠ APT: Nation-state actor targeting critical infrastructure with spear-phishing⚠ RANSOMWARE: Akira affiliate — network access via exposed VPN credential⚠ CREDENTIALS: Combo list from enterprise SSO breach surfaced on Telegram⚠ IAB: Cloud admin access to financial sector org listed at $18K⚠ MALWARE: New evasion-capable RAT advertised on criminal forums — C2 via Telegram⚠ DATABREACH: Tor leak site posting — legal sector data including PII and contracts⚠ RANSOMWARE: LockBit variant — active RaaS affiliate recruitment observed⚠ CREDENTIALS: Vidar stealer log drop — corporate VPN credentials included⚠ APT: Supply chain compromise targeting software vendors in critical sectors

Live Ransomware Victims

refreshed every 5 min

Active ransomware gang postings from public leak sites. For awareness and defensive intelligence only.

Threat Group	Victim	Website	Sector	Country	Discovered
xpl0itrs	BMW Group	—	Manufacturing	DE	Aug 17, 2026	Details
Global Secret Group	The Rubber Group 🇺🇸 US COMPANY	www.rubber-group.com	Manufacturing	US	Aug 17, 2026	Details
Global Secret Group	4M REALTY COMPANY 🇺🇸 US COMPANY	4mrealty.com	Retail & E-Commerce	US	Aug 17, 2026	Details
Panzer	DL E&C	—	Manufacturing	KR	Aug 17, 2026	Details
direwolf	Wishfully Studios	wishfully.se	Technology	SE	Aug 17, 2026	Details
direwolf	Arizona State University (ASU) 🇺🇸 US COMPANY	asu.edu	Education	US	Aug 17, 2026	Details
direwolf	Eva AI Limited	eva.ai	Technology	GB	Aug 17, 2026	Details
direwolf	Mighty Kingdom	mightykingdom.com	Technology	AU	Aug 17, 2026	Details
Panzer	Castilla La Mancha	—	Government & Defense	ES	Aug 17, 2026	Details
Panzer	Doimo Cucine	—	Manufacturing	IT	Aug 17, 2026	Details

Showing latest 10 victims. Full searchable database available.

View All & Search

Intelligence Categories

Click a category for full archive + SIGMA rules

Ransomware

364

Gang campaigns, RaaS operations, victim disclosures, double-extortion activity. SIGMA rules for every active family.

View archive →

Credential Leaks

326

Infostealer campaigns — Lumma, RedLine, Vidar. Combo list releases and enterprise credential exposure tracking.

View archive →

Underground Markets

IAB network access listings, dark web marketplace trends, tool sales, and criminal forum intelligence.

View archive →

Data Breaches

Data sales on Tor markets, breach disclosures, exposure scope analysis, and affected sector reporting.

View archive →

Criminal Tooling

117

New malware families, loaders, droppers, RATs, and stealers emerging from criminal underground channels.

View archive →

APT & Nation-State

224

Nation-state actors — Lazarus, Sandworm, Volt Typhoon. Campaign TTPs, MITRE mapping, KQL/SIGMA rules.

View archive →

Telegram Intel

Criminal Telegram channels: malware drops, C2 announcements, stolen data dumps, and initial access postings.

View archive →

Underground Intelligence Feed

APT & Nation-State

Blind Eagle (APT-C-36) Evolving Toolkit: AsyncRAT, njRAT & LimeRAT Campaign Targeting Colombian Finance — OTX Detection Pack

Blind Eagle (APT-C-36) is targeting Colombian finance with an evolved toolkit: AsyncRAT, njRAT, LimeRAT, RunPE AutoIt loader, JS AES obfuscation, DuckDNS C2. Hunt now.

Aug 17, 2026

Credential Leaks

Blind Eagle (APT-C-36) Evolved Toolkit: AsyncRAT, njRAT & LimeRAT via AutoIt RunPE and DuckDNS C2 — OTX Detection Pack

Blind Eagle (APT-C-36) fields evolved AsyncRAT/njRAT toolkit — VBScript droppers, AutoIt RunPE loaders, DuckDNS C2 — targeting Colombian finance. High urgency.

Aug 17, 2026

Ransomware

BLACKWATER Ransomware Gang: 2 New Victims Posted on Leak Site — India & Argentina Targeting Analysis with Detection Rules

BLACKWATER posted 2 victims (IN, AR) to its dark web leak site on 2026-08-15. Healthcare & professional services orgs should hunt for VPN exploitation and pre-encryption staging now.

Aug 17, 2026

Ransomware

PANZER Ransomware Gang: 3 New Victims Posted — Central European Targeting, Sector Analysis & Detection Rules

PANZER posted 3 victims in 72 hours, hitting manufacturing and technology firms in CZ/DE. European industrials must harden VPN and RDP edges now.

Aug 17, 2026

Ransomware

QILIN Ransomware Gang: 28 New Victims Posted in 24 Hours — Cross-Sector Campaign Analysis, Initial Access CVEs & Detection Rules

QILIN posted 15+ victims in a single day spanning manufacturing, financial services, transportation, and education across 8 countries. Enterprise defenders must patch Check Point, ConnectWise, and Exchange CVEs now.

Aug 17, 2026

Ransomware

LOCKBIT5 Ransomware Gang: 5 New Victims Posted in 48 Hours — European Campaign Analysis, CVE Exploitation Links & Detection Rules

LOCKBIT5 posted 5 victims in 48 hours across Germany, Italy, and France, hitting technology, energy, agriculture, and professional services. Patch Check Point, ScreenConnect, and Exchange now.

Aug 16, 2026

Ransomware

MEDUSALOCKER Ransomware Gang: 5 New Victims Posted — Cross-Sector Campaign Analysis, Pre-Encryption Hunt Logic & Containment Playbook

MEDUSALOCKER posted 5 victims across tech, retail, manufacturing and transport in GB/DE/FR/ZA. Patch edge CVEs, hunt PsExec/WMI staging, isolate backup paths now.

Aug 16, 2026

Ransomware

XPL0ITRS Ransomware Gang: 3 New Victims Posted — Retail & Tech Sector Targeting Analysis with Detection Engineering

XPL0ITRS posted 3 new victims to its dark web leak site on 2026-08-15, spanning AU retail and US technology. Enterprises running Check Point, ScreenConnect, or Exchange must act now.

Aug 16, 2026

Credential Leaks

NadMesh Botnet: Go-Based AI Infrastructure Credential Harvester — OTX Pulse Analysis & Enterprise Detection Pack

NadMesh, an industrial-grade Go botnet, is autonomously exploiting AI/cloud infrastructure (Redis, Docker, Kubernetes, MCP) across 90+ cloud provider ranges. Immediate IOC blocking and credential rotation advised.

Aug 16, 2026

Ransomware

DIREWOLF Ransomware Gang: 6 Victims Posted in 48 Hours — Healthcare & Tech Targeting Analysis with Detection Rules

DIREWOLF posted 6 victims in a single burst across healthcare, tech, and financial services in GB/US/BR/IN. Detection rules and IR priorities for defenders inside.

Aug 16, 2026

APT & Nation-State

HelloNet APT Campaign: ViPNet Supply Chain Compromise Deploys HelloInjector/HelloBackdoor Against Russian Critical Infrastructure — OTX Detection Pack

Active APT campaign abuses ViPNet update system via DLL sideloading to deploy 5-stage Rust-based tooling against Russian government, energy, and aerospace orgs. Hunt now.

Aug 15, 2026

Ransomware

PAYLOAD Ransomware Gang: 4 New Victims Posted in 5 Days — DACH/Levant Targeting Analysis & Detection Engineering

PAYLOAD posted 4 new victims across Jordan, Germany, and Switzerland, hitting financial services, manufacturing, professional services, and tech. Mid-market orgs in DACH and the Levant should harden VPN/RDP perimeters now.

Aug 15, 2026

Ransomware

CISA KEV Flash: 3 CVEs Added — Cisco Firewalls, Windows WinSock & Metabase Under Active Attack

CISA confirms active exploitation of Cisco ASA/FTD heap flaw, Windows WinSock use-after-free, and Metabase unauthenticated SQLi. Patch per CISA deadlines now.

Aug 15, 2026

APT & Nation-State

GoSerpent RAT + HelloNet ViPNet Supply-Chain Campaign: OTX Pulse Analysis — State-Sponsored Intrusion Detection Pack

Two state-linked campaigns hit government networks: GoSerpent RAT targets SE Asia diplomatic entities; HelloNet hijacks ViPNet updates in Russia. CRITICAL — hunt now.

Aug 15, 2026

Credential Leaks

Lua Loader Infostealer Campaign + GoSerpent APT Backdoor: OTX Pulse Analysis — Agent Tesla, XWorm & Southeast Asia Government Targeting Detection Pack

OTX pulses expose a global Lua-loader phishing campaign dropping Agent Tesla, Remcos, XWorm, and Snake Keylogger, plus TetrisPhantom's GoSerpent RAT hitting SE Asian governments. High urgency.

Aug 15, 2026

APT & Nation-State

Starland RAT + WLDR PowerShell Implant: UAT-11795 ClickFix Campaign — OTX Pulse Analysis & Enterprise Detection Pack

UAT-11795 deploys novel Starland RAT and WLDR C2 implant via ClickFix lures and trojanized installers. US/EU users targeted for credential and crypto theft. Hunt now.

Aug 15, 2026

Credential Leaks

Starland RAT + WLDR Implant & Spirals Ransomware: OTX Pulse Analysis — UAT-11795 ClickFix Campaign and Rust-Based Double Extortion Detection Pack

OTX pulses reveal UAT-11795's Starland RAT/WLDR ClickFix campaign targeting US/EU credentials and crypto, plus novel Rust-based Spirals ransomware hitting Asian IT firms. Act now.

Aug 15, 2026

Ransomware

THEGENTLEMEN Ransomware Gang: 15 Victims in a Single-Day Surge — Sector Analysis, CVE Correlation & Detection Rules

THEGENTLEMEN posted 15 victims in 24 hours spanning healthcare, manufacturing, retail and technology across 8 countries. Technology, healthcare and SMB-sector orgs must patch exposed gateways and hunt for pre-encryption staging now.

Aug 15, 2026

View All Intel Articles

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.

Get a Dark Web Exposure Report Incident Response Services