From The Dark Side
Intelligence from the criminal underground — ransomware gang activity, credential markets, initial access brokers, data breach tracking, and emerging attack tooling. Curated by Security Arsenal analysts so your team has what it needs to stay ahead.
Updated 3× daily via automated OSINT feeds monitoring 15+ clearnet sources that track dark web forum activity, Telegram criminal channels, and ransomware leak sites.
Live Ransomware Victims
refreshed hourlyActive ransomware gang postings from public leak sites. Updated hourly. For awareness and defensive intelligence only.
| Threat Group | Victim | Sector | Country | Discovered |
|---|---|---|---|---|
| krybit | asesoriauriel.com | Business Services | MX | Apr 14, 2026 |
| krybit | unipest.co.th | Consumer Services | TH | Apr 14, 2026 |
| krybit | palladium.gen.tr | Not Found | TR | Apr 14, 2026 |
| krybit | secran.com.br | Business Services | BR | Apr 14, 2026 |
| krybit | Some 0APT false claims | Not Found | — | Apr 14, 2026 |
| dragonforce | tulsachamber.com | Business Services | US | Apr 14, 2026 |
| dragonforce | breslinbuilders.com | Construction | — | Apr 14, 2026 |
| dragonforce | je-nyc.com | Not Found | — | Apr 14, 2026 |
| dragonforce | ppiplastics.com | Manufacturing | GB | Apr 14, 2026 |
| dragonforce | novafp.com | Business Services | BR | Apr 14, 2026 |
| dragonforce | advprograms.com | Technology | US | Apr 14, 2026 |
| dragonforce | imadesign.com | Business Services | US | Apr 14, 2026 |
Intelligence Categories
Underground Intelligence Feed
No reports in this category yet.
New intelligence is added automatically three times daily.
← View all intelligenceFrequently Asked Questions
Is Your Organization in the Underground?
Security Arsenal monitors dark web markets, ransomware leak sites, and criminal forums for your domains, IP ranges, and executive identities. We'll tell you if you're already being sold — before the attack begins.