Underground Intelligence

From The Dark Side

Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.

Updated 3× daily via automated OSINT feeds monitoring 15+ clearnet sources that track dark web forum activity, Telegram criminal channels, and ransomware leak sites.

Live Ransomware Victims

refreshed hourly

Active ransomware gang postings from public leak sites. Updated hourly. For awareness and defensive intelligence only.

Threat GroupVictimSectorCountryDiscovered
krybitasesoriauriel.comBusiness ServicesMXApr 14, 2026
krybitunipest.co.thConsumer ServicesTHApr 14, 2026
krybitpalladium.gen.trNot FoundTRApr 14, 2026
krybitsecran.com.brBusiness ServicesBRApr 14, 2026
krybitSome 0APT false claimsNot FoundApr 14, 2026
dragonforcetulsachamber.comBusiness ServicesUSApr 14, 2026
dragonforcebreslinbuilders.comConstructionApr 14, 2026
dragonforceje-nyc.comNot FoundApr 14, 2026
dragonforceppiplastics.comManufacturingGBApr 14, 2026
dragonforcenovafp.comBusiness ServicesBRApr 14, 2026
dragonforceadvprograms.comTechnologyUSApr 14, 2026
dragonforceimadesign.comBusiness ServicesUSApr 14, 2026

Underground Intelligence Feed

No reports in this category yet.

New intelligence is added automatically three times daily.

← View all intelligence

Frequently Asked Questions

Is Your Organization in the Underground?

Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.