Author: DarkOwl Content Team

August 25, 2026

Cybersecurity might as well have its own language. There are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security field or have a keen interest, one may not know. Understanding what these acronyms and terms mean is the first step to developing a thorough understanding of cybersecurity and in turn better protecting yourself, clients, and employees. 

In this blog series, we aim to explain and simplify some of the most commonly used terms. Previously, we have covered bullet proof hosting, CVEs, APIs, brute force attacks, zero-day exploits, doxing, data harvesting, IoCs, credential stuffing, ransomware as a service, push bombing, web application attacks, man-in-the-middle attacks, and ransomware leak sites. In this edition, we dive into the CIA Triad.

CIA Triad 101 

Despite sharing an acronym with a famous intelligence agency, the CIA Triad has nothing to do with government espionage. In cybersecurity and information security, the CIA Triad represents the foundational model used to guide policies and security controls within an organization. The three core principles that organizations should consider when protecting information and systems: Confidentiality, Integrity, and Availability:

• Confidentiality: Is sensitive information only accessible to authorized users?
• Integrity: Is information accurate, complete, and protected from unauthorized modification?
• Availability: Are systems, networks, and information accessible to authorized users when they need them?

Together, these three principles provide a simple way for security teams to identify risks, evaluate security controls, and understand the potential impact of a cyberattack. Let’s dive into each in more detail.

Confidentiality

Confidentiality is about keeping information away from unauthorized individuals. Confidentiality ensures that sensitive data is accessible only to authorized individuals, entities, or processes.

Organizations store enormous amounts of sensitive information, including customer data, financial records, intellectual property, employee information, credentials, and proprietary business information. If the wrong person gains access to that information, the consequences can range from financial loss and reputational damage to regulatory penalties. Threat actors break confidentiality via Data breaches, unauthorized database access, credential stuffing, insider threats, and eavesdropping via man-in-the-middle attacks. When threat actors infiltrate a corporate network and exfiltrate customer personal identifiable information (PII) or proprietary trade secrets to sell on darknet marketplaces or publish on ransomware leak sites, confidentiality is severely breached.

Common ways organizations protect confidentiality include:

• Access controls and least-privilege policies
• Multi-factor authentication (MFA)
• Encryption
• Data classification
• Identity and access management
• Security awareness and phishing training

Integrity

Integrity refers to maintaining the accuracy, consistency, and trustworthiness of information. Integrity guarantees that data has not been tampered with, altered, or destroyed by unauthorized parties or system failures. Unauthorized database manipulation, malware infection, unauthorized registry modifications, or supply chain attacks that alter legitimate software source code. If a threat actor alters medical records in a hospital network, modifies financial transactions in a banking database, or tampers with software updates before they reach end users, the data can no longer be trusted. The problem is not necessarily that the information was exposed—the problem is that it was changed.

Common ways organizations protect data integrity include:

• Access controls
• File and system monitoring
• Hashing and digital signatures
• Audit logs
• Version control
• Data validation
• Change management processes

Availability

Availability means that authorized users can access information, systems, and services when they need them. High availability requires maintaining operational hardware, network capacity, and system redundancies. Even if information remains confidential and accurate, it is not very useful if employees or customers cannot access it.

Availability can be affected by both malicious attacks and everyday technical problems. Common threats include:

• Distributed denial-of-service (DDoS) attacks
• Ransomware
• Hardware failures
• Software failures
• Network outages
• Natural disasters
• Power outages

Organizations can improve availability through redundancy, backups, disaster recovery plans, load balancing, system monitoring, and resilient infrastructure.

Balancing the Triad in the Real World

The three components of the CIA Triad are not independent. A strong cybersecurity strategy needs to consider all three. Security professionals must assess risk tolerance and business requirements to determine the right balance across the triad for their specific environment. The CIA Triad is best viewed as an interconnected model rather than three separate security objectives. Organizations should ask three specific questions:

1. Is our information protected from unauthorized access?
2. Can we trust the information we have?
3. Can authorized users access it when they need it?

These questions can help organizations identify gaps in their security strategy and determine where additional controls may be necessary.

The CIA Triad can also be useful during incident response. After a security incident, security teams can evaluate what happened and determine whether confidentiality, integrity, availability, or a combination of the three was affected. This provides a common framework for communicating the scope and impact of an incident across technical and non-technical teams.

The CIA Triad and the Darknet

Threat actors operate continuously across darknet forums, Telegram channels, and ransomware leak sites, actively hunting for ways to breach all three components of the triad:

• Protecting Confidentiality: Monitoring darknet markets for stolen employee credentials, leaked API keys, or corporate databases before they can be exploited.
• Protecting Integrity: Tracking discussions around zero-day exploits, unauthorized access sales (Initial Access Brokers), and malicious code injection techniques targeting your industry.
• Protecting Availability: Identifying early indicators on darknet channels where threat actors plan coordinated DDoS campaigns or advertise specialized ransomware-as-a-service (RaaS) tools aimed at operational disruption.

By leveraging proactive darknet threat intelligence, organizations can detect early indicators of compromise and address vulnerabilities long before an attack impacts their data or operations.

---

Curious to learn more about dark web monitoring? Contact us.

August 13, 2026

Cybersecurity is no longer a concern confined just to IT departments. It is a fundamental business issue that should touch every layer of an organization. Attacks against organizations can have far reaching implications. For instance, a single breach can result in devastating financial losses, regulatory fines, operational downtime, and irreparable damage to brand reputation and customer trust.

Business leaders, boards, and executives must recognize that cyber risk is business risk, the decisions made about data governance, vendor partnerships, employee access, and digital infrastructure all carry security implications that directly impact the bottom line.

Confusion Area

Although IT departments are responsible for protecting systems through implementing cybersecurity strategies and tools, this does not mean that it is their sole responsibility to guard against cyber risks. This misunderstanding can lead to confusion within an organization.  IT teams must ensure that their respective organization meets mandatory privacy and security standards – this is often mistaken for or confused as cybersecurity. The reason we hear these terms used interchangeably is because the world is becoming more digitalized, and with that comes more sensitive information in the cloud instead of filing cabinets.

So, how do we differentiate between the two fields? Cybersecurity is the practice of safeguarding computer systems, networks, and programs sensitive information from damage, theft or unauthorized use. While Information Technology is the practice of ensuring an organization’s systems stay online and accessible through both software and hardware issues.

How Business’s Benefit from Cybersecurity

Whether you operate a small business or enterprise-level organization, cybersecurity can have similar positive impacts. With more data being stored every day, and most businesses operating at least partially online, the effect a cyberattack can have on business operations cannot be understated. Attackers also understand this as just cyber data breaches alone have seen a 70% increase since 2023.

There is an extensive list of reasons as to why a business needs to invest in cybersecurity; protection of sensitive information, maintaining business operations, compliance, building customer trust, are among some of the most important. A successful cyberattack against an organization can impact all these issues at the same time, but the primary target for an attacker is usually sensitive information. Information like emails, passwords, and financial records can be ransomed or used by an attacker for their own benefit or indeed to conduct further attacks.

Ransomware attacks continue to be on the rise, causing not only financial devastation to companies but huge reputational damage as well. Even if the data is not shared, ransomware leak sites advertise to all that a threat actor has been able to gain access to an organization and information has been stolen. This can have implications for partnerships in the future which may deem an organization too risky to do business with.

To give an example of the scale of victims of ransomware, the below image from DarkOwl Vision shows the number of posted victims in the last year as collected by DarkOwl – 22,354,572 documents with victims.

The sites/sources you see here are just the tip of the iceberg when it comes to groups ransoming information on the dark web.

Penetration Testing

Penetration testing can be a useful tool for organizations seeking to identify and patch vulnerabilities. Penetration testers, or pen testers operate much like hackers, although they are given permission by the company to try as many methods as possible to find possible vulnerabilities in their systems before an attacker does. Pen testing is an important aspect of cybersecurity and plays a critical role in keeping business operations running smoothly.

There are many different methods of penetration testing and they don’t all need to be technical in nature, with social engineering pen testing, internal/external network pen testing, web application pen testing, and cloud pen testing being the most relevant for most businesses. Social engineering pen testing can take place face-to-face or on the phone with either an employee or executive at the given organization. Someone posing as an executive leader, for example, might ask an employee to give up sensitive information like a username and password to access systems under their account. This type of test can determine if employees have been trained properly on this topic.

Ideally, a company should have pen testing done once a year depending on the organization’s industry. For example, HIPAA expects healthcare entities to maintain a strong security posture due to the sensitivity and the amount of information that is stored within their system. Therefore, the healthcare industry has regular testing of their systems. Other frameworks like PCI DSS (Payment Card Industry Data Security Standard) which is a globally recognized security standard, mandate penetration tests at least annually or after a significant system change.

Long story short, pen testing connects a cybersecurity practice with the security of business systems. These tests can provide a first alert for a business’s systems and decrease the likelihood of an attacker gaining access to sensitive information.

Financial Impact

While securing systems requires a significant investment of time and money, the benefits far outweigh the costs. Take the Zero Trust framework, for example. By limiting user access to only the resources necessary for their role, organizations reduce the potential impact of security breaches. Implementing Zero Trust takes time, as development and IT teams must carefully assign and manage user permissions. However, once established, the framework can save organizations more than $1 million per cloud-related security incident. This is just one example of how cybersecurity investments deliver measurable value, demonstrating that even a single security initiative can have a substantial financial impact.

As mentioned earlier, ransomware remains one of the most significant cybersecurity threats facing businesses today. In a ransomware attack, malicious actors encrypt an organization’s files and systems, making them inaccessible until a ransom is paid, often in Bitcoin or another cryptocurrency. A notable example occurred in July 2020, when CWT Global paid approximately $4.5 million in Bitcoin to regain access to its systems after a ransomware group compromised a large portion of the company’s computers. The attackers initially demanded $10 million, but the parties ultimately reached a lower settlement. This incident highlights the severe operational and financial consequences that ransomware attacks can have on organizations.

Conclusion

Cybersecurity is no longer just an IT concern; it is a critical business issue that affects every aspect of an organization. As businesses continue to rely on digital systems, cloud services, and online operations, the potential consequences of a cyberattack extend far beyond technical disruptions. Data breaches, ransomware attacks, regulatory penalties, and reputational damage can all have significant financial and operational impacts. While IT teams are responsible for implementing and managing security controls, protecting an organization requires support from leadership, employee awareness, and ongoing investment in cybersecurity initiatives. Whether through penetration testing, Zero Trust frameworks, or employee training, proactive cybersecurity measures help organizations reduce risk and maintain customer trust. In today’s digital environment, cybersecurity is not simply a technology expense—it is a strategic business investment that protects an organization’s people, operations, and future success.

---

Don’t miss anything – follow us on LinkedIn.

August 11, 2026

Pricing Data Is Threat Intelligence, Start Treating It That Way

Dark web market pricing is one of the more useful leading indicators of threats available to enterprise security leaders. It shows where attacker investment is concentrating, which sectors are being actively targeted, and which gaps in your control framework the criminal market has already priced in. The organizations ahead of this curve treat dark web pricing intelligence the way they treat CVE feeds: as actionable signal, not academic trivia. Here is what the 2025-2026 price data says.

Commodity Collapse and What It Signals Operationally

Prices at the low end of the stolen data market have fallen to near-throwaway levels. Individual US Social Security numbers trade at roughly $1 to $6. Minimal PII (a name paired with an email address) sells for under $15, while a full identity kit runs about $20 to $100. That kit, known as a “fullz” package, bundles a name, address, SSN, and date of birth. A standard US payment card with CVV trades between $10 and $40.

The volume behind those prices is staggering. KELA’s State of Cybercrime 2026 report identified 2.86 billion compromised credentials circulating through criminal channels in 2025 alone. Flashpoint’s midyear analysis found 1.8 billion credentials stolen in just the first half of 2025, an 800% increase over the previous six months, driven largely by infostealer malware.

The operational implication is direct: at these volumes and prices, a correct username and password is no longer meaningful evidence of identity. If your authentication architecture still treats it that way, your controls have not caught up to where the market already is.

The Premium Tier: Where Attacker Capital is Concentrating

While commodity prices deflate, the top of the market is moving the other way, though the headline number needs careful reading.

Rapid7’s research on Initial Access Brokers (IABs), the criminals who sell verified footholds inside corporate networks, found the average listing price across five major forums jumped from roughly $2,726 in 2024 to $113,275 in 2025. That is an increase of about 4,055%. The average is heavily skewed by a small number of very large listings claiming access to high-revenue victims, concentrated on the DarkForums marketplace. Typical access still sells for hundreds to a few thousand dollars, and Cyberint’s independent data put the 2024 average listing at about $1,295. The honest read: the median IAB sale stayed cheap, but 2025 saw the emergence of a new ultra-premium tier for access to large enterprises. It was also a year of major market disruption, including the BreachForums shutdown after a law-enforcement compromise in April 2025 and the arrest of the alleged XSS.is forum administrator in Kyiv that July.

Elsewhere in the premium tier, the pattern is steadier. Healthcare records held at roughly $250 to $310 per record in 2024-2025, about ten times the price of a stolen payment card, because medical history (unlike a card number) cannot be cancelled and reissued. Verified cryptocurrency exchange accounts top the consumer financial chart: a verified Kraken account has listed at up to $1,170 and a verified Binance account around $410. Coinbase accounts, once anchored near $610, have fallen to roughly $107 to $250 as stealer logs industrialized account takeover.

For security leaders in financial services, healthcare, and critical infrastructure, elevated pricing for access to your sector is a market signal of active targeting. It warrants a review of your external attack surface and lateral-movement detection coverage.

Session Cookies: The Gap the Market has Already Priced

Among credential types, listings that demonstrably bypass MFA carry a significant price premium, and stolen session cookies are chief among them. The reason is simple: when a user logs into a corporate application, the system issues a session token that keeps them authenticated. An attacker who steals that token impersonates an already-authenticated user with no password or MFA prompt required. The longer your organization lets tokens live, and the fewer device bindings placed on them, the more exploitable (and valuable) they become. That premium is the market telling you precisely where your authentication architecture is exposed. Read the signal: shorten session lifetimes, bind tokens to devices, and monitor for session replay.

AI is Creating a Quality Tier That Did Not Previously Exist

AI tooling has split the market into grades. Bulk credential dumps keep deflating on oversupply, while AI-curated datasets, sorted and precision-targeted against specific organizations or roles, command premiums reflecting their operational value to buyers.

The performance gap explains the pricing. In a controlled study by Harvard researchers, generic phishing emails achieved a 12% click-through rate, while fully AI-automated spear phishing achieved 54%. That matched human experts at a fraction of the cost. Resilience’s Midyear 2025 Cyber Risk Report cites the same comparison and found social engineering behind 88% of material insurance losses. Attackers with AI capability are producing a measurably better product, and the market is pricing it accordingly. Expect the commodity-to-premium gap to keep widening.

Key Takeaways

• Credentials are a commodity: 2.86 billion compromised in 2025 alone. Passwords plus SMS codes are no longer a meaningful identity control; move toward phishing-resistant MFA and continuous verification.
• A new ultra-premium tier for corporate network access emerged in 2025. If you operate in a highly priced sector, assume active targeting and test your external attack surface accordingly.
• Session cookies carry an MFA-bypass premium. Shorten token lifetimes, bind sessions to devices, and detect replay.
• Healthcare and financial records hold value because they are permanent. Prioritize data-loss prevention where the data cannot be reissued.
• Treat dark web pricing as a continuous intelligence input to control prioritization and board reporting, not a once-a-year curiosity.

Further Reading

• TechTarget — Data After the Breach: Economics of the Dark Web — https://www.techtarget.com/searchsecurity/feature/Data-after-the-breach-Economics-of-the-dark-web
• Aon — 2025 Global Cyber Risk Report: Ransomware Payouts Decline Despite Growing Cyber Claims Frequency — https://www.aon.com/cyber-risk-report/ransomware-payouts-decline-despite-growing-cyber-claims-frequency
• HIPAA Journal — Cyber Insurance Claims Fall but Ransomware Losses Increase — https://www.hipaajournal.com/cyber-insurance-claims-fall-ransomware-losses-increase/
• S&P Global — Cyber Insurance Market Outlook 2026 — https://www.spglobal.com/ratings/en/regulatory/article/cyber-insurance-market-outlook-2026-resilient-earnings-tougher-competition-pockets-of-growth-s101658506

---

Make sure to stay up to date. Follow us on LinkedIn.

August 6, 2026

Overview

ExfilSquad is a newly emerged threat actor in the cybercriminal landscape, claiming responsibility for alleged breaches of 15 high-profile victims across multiple countries as of the time of writing this report. The alleged victims span the United States (9 victims), the United Kingdom (3 victims), Sweden (1 victim), and Nigeria (1 victim). The group maintains a dedicated onion-based Data Leak Site (DLS) where victims are listed alongside ransom deadlines, claimed breach sizes, revenue figures, country of origin, and sample files in .7z format or torrent links as proof of compromise (POC).

Notably, all listed victims share an identical ransom payment deadline of 05.08.2026, suggesting a coordinated and simultaneous extortion campaign rather than a series of independent intrusions.

ExfilSquad can be identified and monitored through DarkOwl Vision, as captured in Screenshot below.

Alleged Victims

The following entities are listed on ExfilSquad’s DLS as of the time of writing:

• Microsoft
• Wesco International
• UK Department for Education (education.gov.uk)
• Police National Legal Database
• Allstate
• TaylorMade & Sun Day Red Golf
• Frontier Airlines
• Zenith Bank Plc
• District of Columbia Public Schools (dcps.dc.gov)
• Newcastle University (ncl.ac.uk)
• Viavi Solutions
• City of Houston (houstontx.gov)
• City of Atlanta (atlantaga.gov)
• Bonava, the Swedish residential real estate development company headquartered in Stockholm, Sweden.

A Confirmed Breach: UK Police National Legal Database

What elevates several of these claims beyond typical unverified dark web listings is that the UK Police National Legal Database (PNLD) has publicly confirmed that police, government, and customer contact information was compromised and published by the ExfilSquad group, with over 100,000 UK police officers and staff affected. This confirmation lends credibility to the group’s broader list of claimed victims and warrants serious consideration by all allegedly affected entities.

Contact Infrastructure

The group listed two contact methods on their DLS, an onionmail and a QTOX ID:

OnionMail — a free, anonymous email service designed for privacy, featuring automatic PGP encryption, native Tor network access (.onion), and requiring no personal data or phone numbers to register.

QTox — a free, open-source, and secure instant messaging and video calling client that uses the decentralized Tox Protocol, featuring end-to-end encryption, zero central servers, and no advertisements.

The use of both OnionMail and qTox reflects a deliberate operational security posture, leveraging decentralized and encrypted communication channels to minimize attribution risk.

Dark Web Forum Activity

Beyond their dedicated DLS, DarkOwl researchers observed an actor operating under the same handle “exfilsquad” promoting two of the alleged breaches — both from the United Kingdom — across two dark web forums: Spear and PwnForums.

Spear Forum

Spear is an English-language dark web forum that emerged in early 2026 and has gained traction among cybercriminal communities as a platform for advertising sensitive data, network access, and geopolitically motivated listings. The forum operates on both a clearnet domain and an onion domain. On July 25, 2026, at 04:06 AM, the actor operating under the handle “exfilsquad” initiated a thread on Spear titled “UK POLICE NATIONAL LEGAL DATABASE”, sharing sample data and a link to their DLS.

The actor’s claim on Spear forum was crawled the same day on July 25, 2026 and was accessible on DarkOwl ‘s Vision.

Three minutes later, on July 25, 2026, at 04:09 AM, the same actor initiated a second thread titled “UK DEPARTMENT FOR EDUCATION”, again sharing sample data and the same DLS link.

DarkOwl researchers identified that the ExfilSquad account on Spear, joined the forum on July 15, 2026, has initiated 2 threads and 2 posts since joining, and listed the ExfilSquad DLS onion address in the website section of their profile. The account has remained inactive since July 27, 2026, at 12:56 PM as of the time of writing this report.

PwnForums

PwnForums is an English-language cybercriminal forum that serves as a platform for a broad range of illicit activities, including the advertisement and sale of stolen databases, network access, and sensitive government and military data. The forum operates on both a clearnet domain and an onion domain.

On July 25, 2026, at 02:56 AM, the actor operating under the handle “exfilsquad” initiated a thread on PwnForums titled “UK POLICE NATIONAL LEGAL DATABASE”, sharing sample data and a link to the ExfilSquad DLS.

The actor’s claim on Pwnforums was crawled the same day on July 25, 2026, and was accessible on DarkOwl ‘s Vision.

On July 25, 2026, at 03:41 AM, the same actor initiated a second thread titled “UK DEPARTMENT FOR EDUCATION”, sharing sample data, details of the alleged breach, and the onion address of their DLS.

DarkOwl researchers identified that the ExfilSquad account on PwnForums, joined the forum on July 24, 2026, has initiated 2 threads and 2 posts since joining, and listed the ExfilSquad onion address in the Homepage section of their profile.

Notably, the actor holds a GOD member status on PwnForums — a paid membership tier available for €50 lifetime, which grants the holder +30 reputation, +120 credits, the ability to edit and delete their own posts for 3 months, and additional forum features.

Assessment

ExfilSquad represents a notable new entrant in the data extortion landscape, distinguishing itself through a simultaneously broad victim portfolio, a confirmed breach of a sensitive law enforcement database, and active cross-platform promotion across multiple dark web forums. The group’s operational security posture — leveraging OnionMail, qTox, and a dedicated onion DLS — reflects a degree of technical sophistication consistent with an actor seeking to establish credibility and longevity within the cybercriminal ecosystem.

The confirmation by the UK Police National Legal Database of a genuine compromise lends material weight to ExfilSquad’s broader claims and warrants urgent attention from all allegedly affected organizations. DarkOwl will continue to monitor ExfilSquad’s activity across dark web and open-source channels as the situation develops.

DarkOwl does not endorse, promote, or amplify the content of any threat actors referenced herein. The authenticity of all advertised breach claims referenced in this report, beyond those independently confirmed by affected entities, has not been verified by DarkOwl.

August 06, 2026

Cybersecurity might as well have its own language. There are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security field or have a keen interest, one may not know. Understanding what these acronyms and terms mean is the first step to developing a thorough understanding of cybersecurity and in turn better protecting yourself, clients, and employees. 

In this blog series, we aim to explain and simplify some of the most commonly used terms. Previously, we have covered bullet proof hosting, CVEs, APIs, brute force attacks, zero-day exploits, doxing, data harvesting, IoCs, credential stuffing, ransomware as a service, push bombing, web application attacks, and man-in-the-middle attacks. In this edition, we dive into ransomware leak sites.

Ransomware Leak Sites 101 

A ransomware leak site—also called a data leak site (DLS), name-and-shame site, or extortion site—is a website operated by ransomware groups that publishes information about victims who refuse or delay paying a ransom.

Historically, ransomware attacks relied almost exclusively on encrypting a victim’s systems and demanding payment for a decryption key (single extortion). However, as organizations improved their backup and disaster recovery strategies, attackers evolved their tactics. Now we see double extortion. Before encrypting network files, threat actors exfiltrate sensitive corporate data, employee PII, intellectual property, or financial records. If the victim restores from backups and refuses to pay the decryption ransom, the operators publish the company’s name and proof of exfiltration on their dedicated leak site, threatening to make the full dataset public.

Most ransomware leak sites are hosted on anonymous networks such as Tor, making them difficult to identify, seize, or remove.

The Role of Leak Sites

Leak sites serve several strategic purposes for cybercriminals:

• Create Urgency: Publishing a victim’s name publicly increases pressure on the victim. Organizations must now consider not only business disruption but also the potential exposure of customer records, employee information, intellectual property, financial documents, and other sensitive data. Beyond threatening the victim company, threat actors use published leak site data to contact affected customers, vendors, or regulators directly, pressuring the primary victim from multiple angles. In addition, some threat groups create searchable indices of stolen files on clearweb mirrors or public messaging channels (like Telegram) to make stolen data indexable by search engines, compounding the victim’s reputational risk.
• Increase Reputation: Successful ransomware groups rely on reputation within the cybercriminal ecosystem. By consistently publishing stolen data when victims refuse payment, they reinforce the perception that their threats are legitimate. This reputation can increase the likelihood that future victims will negotiate rather than risk public disclosure.
• Attract Criminal Buyers: Some leak sites offer partial data samples while advertising complete datasets for sale. If a victim fails to pay, some ransomware groups offer the exfiltrated data for sale or auction on their leak site to third-party cybercriminals enabling other threat actors to exploit the information for phishing campaigns, identity theft, business email compromise (BEC), or additional attacks.
• Promote Affiliate Programs: Many Ransomware-as-a-Service (RaaS) operations use leak sites as marketing platforms. In addition to listing victims, they advertise affiliate opportunities, publish attack statistics, and showcase successful operations to recruit additional partners.

What Leak Sites Include

While each cyber criminal group maintains its own branding and interface, most leak sites share common components:

• Victim Listings: Profiles for each target, including company name, website, country, industry, and a summary of the alleged compromise.
• Countdowns & Timers: Publicly visible countdown clocks setting a deadline before data is made available for download.
• Proof Files: Sample documents, passport scans, financial spreadsheets, or directory listings released early to prove the legitimacy of the breach.
• Data Dumps & Torrents: Downloadable compressed files or magnet links containing the full exfiltrated database once a deadline expires without payment.
• Press Releases & Media Notes: Group statements targeted at journalists, security researchers, and stakeholders to maximize public shame and reputational damage.

Ransomware Leak Sites in the Wild

Ransomware leak sites have become a standard component of many major ransomware operations. While each group maintains its own branding and publishing practices, their overall goal is the same: pressure victims into paying by threatening—or carrying out—the public release of stolen data. To understand how threat groups leverage public exposure, it helps to look at real-world operations. While dozens of active darknet leak sites exist today, several prominent groups demonstrate how varied these platforms can be:

LockBit

At its peak, LockBit operated one of the most active ransomware leak sites on the dark web. LockBit’s Tor-based leak site pioneered feature-rich extortion platforms. Their site famously included search functions, victim categorization, extortion countdown timers, and options for victims to pay a fee to extend deadlines or destroy stolen data. Even following international law enforcement takedowns, LockBit’s infrastructure has repeatedly re-emerged under updated mirrors.

Akira

Emerging in 2023, Akira quickly became one of the more active ransomware groups targeting businesses across multiple industries. Demonstrating a distinct visual aesthetic, Akira operates a leak site styled after retro 1980s green-on-black terminal interfaces. Beyond the visual design, Akira’s platform is notable for its selective double-extortion listings and direct integration with custom payment portals, targeting organizations across healthcare, education, and commercial sectors.

Cl0p

Rather than relying exclusively on ransomware encryption, Cl0p became known for large-scale data theft campaigns that exploited vulnerabilities in widely used file transfer software. Victims who refused to negotiate often found their names listed on the group’s leak site alongside samples of stolen information.

Why Tracking Leak Sites is Critical for Threat Intelligence

Although leak sites are operated by cybercriminals, they provide valuable intelligence for defenders. Security teams monitor these sites to:

• Early Exposure Detection: Allows investigators to identify newly disclosed victims and stolen organization data. Leak site postings often represent the first public confirmation that a vendor, partner, or competitor in your supply chain has suffered a major breach.
• Threat Actor Profiling: Track emerging ransomware groups, victim volume, targeted verticals, and posting frequency across active leak sites helps analysts track the rise, rebrand, or demise of major RaaS syndicates.

Because ransomware groups frequently create new infrastructure, rebrand, or migrate between domains, monitoring requires continuous visibility across both the surface web and anonymous networks. Organizations often discover their data has been published only after journalists, customers, or third parties report it. Threat intelligence platforms that continuously monitor ransomware infrastructure can help organizations identify emerging threats faster, correlate leaked data with broader threat activity, and prioritize response efforts before incidents escalate.

For security teams, understanding how these sites operate—and maintaining visibility into the data they publish—is an increasingly important part of modern cyber defense. Organizations that proactively monitor ransomware leak sites alongside broader threat intelligence are better positioned to detect exposures early, respond more effectively, and reduce the long-term impact of ransomware incidents.

Protection and Mitigation

While no organization can eliminate ransomware risk entirely, several best practices can significantly reduce exposure:

• Implement multi-factor authentication across all remote access points.
• Regularly patch internet-facing systems and critical applications.
• Segment networks to limit lateral movement.
• Maintain secure, offline backups and routinely test restoration procedures.
• Monitor for stolen credentials and exposed sensitive information.
• Develop and regularly exercise an incident response plan.
• Conduct employee security awareness training focused on phishing and social engineering.

Preparation before an incident remains one of the most effective defenses against ransomware.

---

Curious to learn more about dark web monitoring? Contact us.

August 03, 2026

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. JadePuffer ransomware used AI agent to automate entire attack – Bleeping Computer

Sysdig researchers have identified a ransomware operation, named JadePuffer, that appears to have been conducted entirely by a large language model (LLM) agent. The autonomous AI agent carried out the full attack lifecycle, including target reconnaissance, credential theft, lateral movement, persistence establishment, privilege escalation, and data encryption. Much like a human operator, the agent adapted to setbacks encountered during the intrusion, refining its approach and adjusting parameters to overcome failures and continue the attack. JadePuffer gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, a widely used open-source framework for building large language model (LLM) applications. Read full article.

2. U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case – The Hacker News

Leaked negotiation transcripts show that a U.S. government entity paid Kairos a $1 million ransom after a credential-based attack in May 2025. Kairos claimed it gained access through a brute-force attack, and the victim was added to the group’s leak site on 21 May 2025. Instead of encrypting systems, Kairos focused on stealing data and threatening to publish it. The group claimed to have stolen 2 TB of data, including more than 1.6 million files. Kairos also shared security recommendations and a claimed list of deleted files after the payment. Read More.

3. U.S. offers $10 million for hackers targeting WhatsApp, Signal users – Bleeping Computer

Through its Rewards for Justice program, the U.S. Department of State is offering up to $10 million for information leading to the identification or location of members of the UNC5792 and UNC4221 hacking groups, which are linked to Russia’s intelligence and military services. Officials said UNC5792 has conducted widespread phishing campaigns targeting Signal and WhatsApp accounts belonging to U.S. government officials, military leaders, and allied personnel. As part of its effort, the U.S. government is requesting information on the identities, locations, biographies, and affiliations of UNC5792 members and their support personnel, as well as any links to Russian intelligence services, contractors, or third-party service providers. Information regarding operational infrastructure could also be valuable to officials. Read more here.

4. Spanish Police take down €140 million cyber fraud ring, arrest four – Bleeping Computer

Following an investigation, the Spanish Police have announced the dismantling of a “cybercrime and money-laundering organization that made €140 million ($160 million) from investment fraud and business email compromise (BEC) attacks”. Authorities arrested four people in Spain, Portugal, and Panama as part of the international law enforcement operation. Additionally, authorities acquired 15 computers and 170 smartphones believed to have been used in the operations. Investigators described the network as operating on an industrial scale, using more than 800 bank accounts, 120 business accounts, and 67 external accomplices who served as “money mules” to move and conceal illicit funds. Read here.

6. New Ghost Phishing Wave Is Breaking Traditional Email Security – The Hacker News

An EvilTokens campaign has been observed exploiting a blind spot in email security through a technique known as “ghost phishing.” The campaign has targeted businesses across the United States and Europe by keeping the malicious phishing page concealed until it is decrypted and rendered within the victim’s browser. The phishing kit leverages Microsoft Device Code Phishing to trick victims into completing a legitimate Microsoft sign-in flow and unknowingly granting attackers access to their accounts, eliminating the need to steal passwords directly. Because the phishing page remains encrypted until it is opened in the browser, traditional email security controls are unable to inspect its contents. The page’s HTML is protected with AES-GCM encryption and is only revealed after the browser decrypts it and renders the phishing content in the Document Object Model (DOM). Read full article.

7. Blackfield ransomware asks Nidec Corporation for $2 million ransom – Bleeping Computer

The Blackfield ransomware gang has asked Nidec Corporation for $2M ransom following an alleged breach of their network. Nidec has acknowledged the possibility of a data breach but has not confirmed that any personal or confidential information has been leaked online. As for the operational impact, Nidec said it is assessing whether the incident could affect production, shipping, or other business activities. At this stage, the company does not expect the disruption to spread to other Nidec Corporation or Nidec Group companies. Meanwhile, the Blackfield ransomware group has claimed responsibility for the attack, giving Nidec more than 15 days to respond and enter negotiations. The group has threatened to publish or sell the allegedly stolen data if its demands are not met. Generating annual revenue of $17.2 billion and employing roughly 100,000 people across manufacturing facilities and subsidiaries in more than 40 countries, Nidec is a global leader in electric motor manufacturing. Read full article.

8. DHS confirms hackers breached HSIN info-sharing platform – Bleeping Computer

The Department of Homeland Security is investigating a cyberattack that compromised the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by government and private-sector partners. The intrusion is believed to have occurred between late May and early June and targeted both HSIN servers and a SharePoint collaboration system. It remains unclear whether any data was exfiltrated or who was responsible for the attack. The Department’s Office of Intelligence and Analysis has conducted a damage assessment to evaluate the scope and potential impact of the breach. Learn more.

---

Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.

July 30, 2026

Overview

As tensions between the United States and Iran continue to escalate, DarkOwl researchers have observed a marked increase in online threats targeting the life of President Donald Trump. These threats span multiple layers of the internet — from dark web onion sites and encrypted Telegram channels to mainstream Iranian state-aligned media — and reflect both grassroots extremist sentiment and coordinated state-adjacent messaging. This post details DarkOwl’s findings.

The Dark Web Fundraiser: “8647 Kill Donald Trump”

DarkOwl researchers identified an onion site operating under the name “8647 Kill Donald Trump”, claiming to have allegedly gathered over $300,000 USD and actively promoting a $1 million fundraising campaign. The site describes its operators as a team of “highly qualified professionals united by a single goal: to eliminate the threat and protect the world from those who create danger.”

The site is published in three languages — English, Arabic, and Chinese — suggesting an intent to reach a broad international audience. Two QR codes are displayed on the site: one linked to a Bitcoin (BTC) wallet address, and one to a Monero (XMR) wallet address, providing anonymous payment channels for potential donors.

The number “8647” embedded in the site name carries specific significance. Multiple sources report that Republicans have flagged the number as split into two parts — 86 and 47 — read as a call for the assassination of President Trump, the 47th president. In American slang, “86” means to remove or get rid of someone, making “8647” a thinly veiled reference to eliminating him.

IRGC-Aligned Channels Amplify the Campaign

DarkOwl researchers observed IRGC-associated Telegram channels actively promoting the hashtag “کشتن ترامپ” — translating directly to “Kill Trump” — across multiple platforms.

Sabereen News, a pro-Iranian Telegram channel closely aligned with Iran’s “Axis of Resistance” narrative and considered to have close ties to the IRGC, posted on March 19th, 2026, that the offer for killing President Trump was being raised to $100 million USD, sharing a clearnet website alongside the announcement.

The same campaign was subsequently amplified by two additional IRGC-tied channels — the IRGC Quds Force News Channel and another pro-regime outlet — with posts published on March 21st and March 23rd, 2026, respectively.

KillTrump.info: Iranian Infrastructure

Researchers identified a domain — killtrump.info — that was promoted across these channels. While the domain is no longer online at the time of writing, WHOIS records reveal it was registered through an Iranian hosting company, Netmihan Communication Company Ltd, a finding that points to Iranian infrastructure underpinning the campaign.

The campaign was seeded on Iranian domestic social media platforms Eitaa and Rubika — both widely used inside Iran — days before being promoted on the above-mentioned Telegram channels, suggesting a deliberate domestic-first promotion strategy. A further Eitaa post was also identified as part of the same seeding activity.

IRGC-Affiliated FarsNews Covers the Campaign

FarsNews — the pro-Iranian news agency directly and formally affiliated with the IRGC, widely described as the cornerstone of the IRGC’s disinformation and propaganda apparatus, and designated by the U.S. Treasury under Executive Order 13553 in September 2023 — published a report on March 17th, 2026 covering the emergence of the Kill Trump campaign and its $100 million USD reward, sharing the fundraising website used to collect donations for it.

The fact that an IRGC-affiliated news agency was covering — and effectively amplifying — the campaign underscores how far this narrative has been normalized within Iran’s information ecosystem.

Some members of the Iranian diaspora community also reported that Iranian citizens residing inside Iran were receiving unsolicited SMS messages promoting the Kill Trump fundraising campaign and calling on recipients to participate, as documented by IranWire on X.

Handala Hacking Group Enters the Picture

On March 24th, 2026, the Iranian news agency Mehr News reposted a statement from the Handala hacking group. In direct response to a $10 million USD bounty placed on Handala members by the U.S. Department of Justice, the group announced a $50 million USD reward for the killing of both President Donald Trump and Israeli Prime Minister Benjamin Netanyahu.

This $50 million USD reward for Trump and Netanyahu remains active on Handala’s most prominent domain as of the time of writing, with the original post dated March 24th, 2026.

Handala’s entry into this campaign is significant: it represents a named, organized threat actor with established cyber capabilities formally attaching itself to a targeted assassination bounty — and one that has directly responded to U.S. law enforcement pressure with an escalatory public threat.

KillTrump.me: The Campaign Continues

On March 31st, 2026, Sabereen News introduced yet another domain — killtrump[.]me — which was found to be hosted on an IP address based in Iran, again belonging to Netmihan Communication Company Ltd.

The same site was shared across Iranian websites on March 30th, 2026 — one day prior to the Telegram announcement — again suggesting pre-seeding on domestic platforms before broader promotion.

KillTrump.ir: A Country-Code Domain and Iranian Hosting

On April 5th, 2026, a further domain — killtrump[.]ir — was introduced and shared via a post in the Sabereen News channel on the Iranian social platform Eitaa. This domain uses Iran’s country-code top-level domain (.ir) and was not available at the time of writing.

The site was hosted on an Iranian IP address — 185.143.234.235 — belonging to subnet 185.143.232.0/22, AS 205585, operated by Noyan Abr Arvan Co. (Private Joint Stock), a major Iranian cloud infrastructure provider. The latest archived records of the domain suggest the title translates to English as “Kill Trump.”

A clear and deliberate pattern emerges across all these domains: the “KillTrump” brand remains consistent, with only the TLD rotating — .info, .me, .ir — suggesting an operational strategy to maintain the campaign’s online presence even as individual domains are taken down.

Claimed Donations and State-Media Validation

A report published by Iran International on March 25th, 2026 cited pro-Iranian regime media claiming that more than $25 million USD had been donated toward the Kill Trump campaign reward fund. While these figures cannot be independently verified by DarkOwl, their amplification by state-adjacent media lends the campaign a degree of institutional visibility that goes well beyond fringe activity.

Senior Regime Voices Echo the Sentiment

The campaign extends well beyond anonymous dark web actors and fringe Telegram channels into the highest levels of Iranian political commentary.

On June 28th, 2026, Hossein Shariatmadari (حسین شریعتمداری) — an Iranian journalist and political commentator best known as the editor-in-chief of the conservative newspaper Kayhan (کیهان), a representative of the Supreme Leader, and a hardliner with significant influence in Iranian decision-making — published an article addressing three points on negotiations with the United States. The final point read: “And finally, the effort and expense to take revenge on the murderer of our martyred Imam, in that very land of America” — widely read as a thinly veiled reference to retaliatory action against President Trump on U.S. soil.

On July 11th, 2026, Hamshahri Online — a major Persian-language national daily newspaper owned and operated by the Tehran Municipality — published a report citing Iran’s new Supreme Leader stating that revenge is “a definite demand of the nation,” and listing 13 named individuals including Donald Trump and Benjamin Netanyahu as targets.

On July 16th, 2026, the Islamic Resistance in Iraq (Arabic: المقاومة الإسلامية في العراق) — an Iran-backed umbrella coalition of Shia militant factions operating under the strategic direction of the IRGC Quds Force — promoted a $10 million USD reward for anyone who kills President Trump or provides assistance toward his assassination.

Legal Precedent: A Foiled Plot Already on Record

These findings do not exist in a vacuum. On March 6th, 2026, the U.S. Department of Justice announced the conviction of Asif Merchant, also known as Asif Raza Merchant — an Iranian intelligence agent found guilty of terrorism and murder-for-hire charges in connection with a foiled plot to assassinate U.S. politicians and government officials, including President Trump, on American soil. The conviction confirms that Iranian-linked assassination plotting against the U.S. president has already moved from online rhetoric to operational planning.

Assessment

The findings documented above reflect a multi-layered, persistent, and escalating campaign spanning anonymous dark web infrastructure, IRGC-affiliated Telegram channels, Iranian domestic social media platforms, state-adjacent and state-owned news agencies, named hacking groups, and senior regime voices. Several indicators are worth highlighting:

Iranian hosting infrastructure — specifically Netmihan Communication Company Ltd and Noyan Abr Arvan Co. — is used consistently across multiple killtrump domains, pointing to organizational coordination rather than spontaneous grassroots activity.

TLDs rotate deliberately as domains are taken down, an operational resilience that suggests continuity of intent and a structured effort to maintain the campaign’s online presence.

The Handala hacking group’s involvement adds a cyber threat dimension to what might otherwise appear to be a purely rhetorical campaign, particularly given its direct response to U.S. DOJ pressure with an escalatory $50 million bounty.

Content is pre-seeded on domestic Iranian platforms — namely Eitaa and Rubika — before international Telegram amplification, pointing to a structured dissemination strategy rather than organic spread.

Senior regime-aligned voices have amplified the campaign, including a representative of the Supreme Leader, a Tehran Municipality-owned newspaper, and the Iran-backed Islamic Resistance in Iraq, elevating the campaign from fringe extremism to something with demonstrable institutional backing.

---

DarkOwl will continue to monitor developments across dark web and open-source channels as the situation evolves. Stay up to date.

July 28, 2026

The Call That Fooled Everyone

“Hey John, it’s Jamie. I’m locked out of my email and I left my cell at the office. If I don’t get this spreadsheet over to finance by COB tonight, Bill is going to melt down for sure. Can you help me get into my email to send this one thing???”

Jamie sounds like Jamie, Bill is indeed the department head, and the company’s financial quarter is set to close within the next day.

Jamie sounds stressed, even close to tears, and John of course wants to help her out.

The problem is that Jamie is being impersonated using AI deepfake tech, and once John resets the MFA (multi-factor authentication), attackers will be inside the network within minutes.

Social Engineering Isn’t New — But AI Just Changed the Game

As long as humans are part of any workflow, security is vulnerable to human error. Social engineering, the attack method utilizing convincing pretext to deceive and manipulate, is nothing new. However, AI has intensified the threat landscape.

Deepfakes, voice cloning, and synthetic identities mean human judgement defenses are more vulnerable now than they were a few years ago.

The Help Desk Is a Key Targeted Entry Point

Help desks are valuable targets for threat actors using these tactics.

Muddled Libra (one alias for this group is Scattered Spider) is one such threat group utilizing these tactics, as outlined by Palo Alto Networks in June 2025, where they saw evidence of the group identifying key personnel, using publicly available information to build a profile and then use this to impersonate the employee, thus allowing them to gain access to systems and monetize attacks quickly.

Personal relationships which may exist between help desk and other company staff are often exploited, using deepfake tech to impersonate not only voice, but also cadence, inflection, and keyword peculiarities specific to the chosen individual.

Who is Behind Hacks — The Players You’ve Never Heard Of

Threat actor methods and tracking can be time consuming. It is important to note threat actors often share scripts, refine techniques, and trade stolen data on the dark web. Leaving threat actors un-investigated means leaving behind key defensive intel crucial for your business.

The NY Times identified threat actor Scattered Spider as being investigated for the 2025 Marks & Spencer cyberattack in Britain.

DarkOwl Vision offers intel and dossiers on threat actors. Scattered Spider is one such entity whose methods, aliases, tools, and other information are available. The identified alias of “Muddled Libra” is seen below for threat actor “Scattered Spider” in Dark Owl Vision:

Additional details for this threat actor include other targeted industries, Telegram accounts, and known tactics:

Social engineering defense is key, however, knowing specific attack methods can increase network defenses.

Three CVE’s have been identified as in use by Scattered Spider in DarkOwl Vision:

A known enemy is always better than fighting blind. Monitoring dark web content as part of proactive security measures can help defend against emerging attack vectors.

Pre-Attack Intelligence and Defense

Network defenders can also watch for signals before an attack. To catch adversary reconnaissance from darknet sources, monitoring and subsequent alerting are key.

DarkOwl Vision’s Alerting function can ensure keywords specific to your company can be monitored, with alerts generated from any findings. Identified corporate keyword chatter on dark forums can be utilized as an advanced warning to all company staff in anticipation of social engineering attacks. If any are discovered, security passphrases can be refreshed, and additional social engineering prevention trainings issued.

What Attackers Need to Pull This Off (And Where They Get It)

Remember, the attackers already have enough data points to pull off a convincing pretext against your staff. The United States is by default opted IN, not opted out, of data brokers. The personal and specific details of your staff are already public. Names, roles, manager’s role, and other details are easily found.

Adding AI impersonations with deepfake technology, and you’ve got a recipe for disaster. Methods discussed online quickly turn into real world intrusion attempts.

Visibility is the Real Defense

Go back to John for a second. By the time “Jamie” called, the attacker had already done the hard part of research and preparation including details, urgency, voice, etc. That’s the uncomfortable truth about this kind of attack: the call itself is just the final step in a process that’s been visible, in pieces, for days or weeks beforehand. The organizations that get ahead of this are the ones who were watching the early signals closely enough that the call never had a chance to work in the first place. AI has made the pretext better. It hasn’t made the playbook any less visible to the people willing to look for it.

---

Learn more about DarkOwl’s features mentioned throughout this blog. Contact us.

July 23, 2026

What Is a Stealer Log?

A stealer log is not merely a log file. It is a structured, compressed archive of everything a piece of stealer malware has silently harvested from an infected device usually before the victim had any idea anything was wrong, if they ever did. Unlike ransomware, which announces itself with locked screens and ransom notes, infostealer malware operates without disrupting normal device function and therefore can be difficult to detect. The infected machine keeps running. The user keeps working. Meanwhile, the malware is methodically copying credentials from every browser, extracting active session cookies, reading cryptocurrency wallet files, and sometimes even photographing the desktop — then packaging everything into a neat archive and transmitting it to an attacker-controlled server.

Each log, in the language of underground markets, represents one “bot” — one compromised device, one victim’s complete digital footprint, ready for purchase and exploitation.

What’s Inside a Stealer Log?

The value of a stealer log to a criminal depends heavily on what it contains. Logs with bank credentials, for instance, will be more valuable than other types of credentials. However, there are a lot of other data types withing a stealer log which can be very advantageous to criminals. Logs are typically organized by data type within the archive, making it simple for buyers to locate specific categories of value. The standard contents break down into six main categories:

• Browser Credentials — Every saved username and password from any browser used on the infected machine such as Chrome, Edge, Firefox, Brave, and Opera, sorted by domain. One infection compromises dozens of accounts simultaneously.
• Session Cookies & Auth Tokens — Active session tokens that bypass MFA entirely. An attacker importing a valid session cookie can access accounts without triggering any new authentication prompt.
• Autofill & Payment Data — Names, addresses, phone numbers, dates of birth, and payment card details stored in browser autofill, enabling identity fraud beyond credential abuse. Think about this next time your browser asks you if you want to save your information for the future.
• Cryptocurrency Wallets — Wallet files, browser extension data, seed phrases, and private keys for Bitcoin, Ethereum, and other cryptocurrencies. Funds can be drained within minutes of purchase.
• System & Device Information — Hardware IDs, OS version, installed software, IP address, geolocation, and a desktop screenshot taken at infection time.
• VPN, FTP & Application Tokens — Remote access credentials, FTP configs, and tokens for Slack, Discord, GitHub, and cloud services which can provide direct network footholds for corporate intrusions.

One particularly dangerous aspect of a stealer log infection is its attack on session persistence. When a user logs into a website and completes multi-factor authentication, the browser stores a session cookie confirming that the device has already authenticated. An attacker who imports that cookie can access the same account with no password required, and no MFA challenge triggered. Microsoft’s own documentation confirms that certain session cookies can persist until explicit logout or token expiration, potentially enabling weeks of undetected access with a single stolen log.

Analyst Note

Sellers routinely re-package the same log multiple times — as a cheap raw dump, a premium corporate set, and a crypto-only slice — reselling the same victim data to multiple buyers. Underground market research suggests tens of billions of stolen cookies were circulating in 2025.

The Most Common Infostealer Families

The infostealer malware ecosystem operates as a commercially organized, subscription-driven marketplace. Most major variants are sold as Malware-as-a-Service (MaaS), with developers offering monthly subscriptions, customer support forums, update bulletins, and affiliate programs. According to IBM X-Force’s 2025 threat intelligence report, the following families dominated dark web forum activity throughout 2024 and into 2025:

The broader pattern is consistent across every law enforcement disruption: when one major infostealer family is taken down, market share migrates to alternatives within days to weeks, or the malware is updated on new C2 servers run by other affiliates. This resilience stems from the structural nature of the ecosystem. Low development barriers, open-source code availability, and persistent criminal demand ensure that neutralizing any single actor creates an immediate commercial opportunity for others.

Where Stealer Logs Are Sold?

The underground market for stealer logs operates across several parallel channels, each serving different buyer profiles and transaction volumes. Understanding where logs are distributed is central to understanding how quickly stolen data can be weaponized after an infection.

Following the Genesis Market seizure in April 2023, SecureWorks documented a 670% increase in Russian Market activity as buyers and sellers migrated. This pattern has repeated across every major marketplace takedown: the criminal ecosystem absorbs the disruption rapidly, and within weeks, activity consolidates on surviving platforms or new entrants.

How are Stealer logs used by criminals?

Stealer logs are usually the first step in an often more sophisticated attack. Information that can be found in logs is often used as part of other attacks, usually against organizations rather than against the individuals that were initially infected.

Initial Access Brokers (IABs) will sift through millions of logs, which they may control themselves or have purchased, looking specifically for corporate VPN credentials, SSO tokens, and domain admin access. Qualifying logs are re-packaged and sold on dark web forums for significantly higher prices.

Ransomware affiliates purchase verified corporate access from IABs and or have access to their own logs containing this information and use it to log directly into target networks which allows them to bypass perimeter defenses entirely. According to Verizon’s 2025 DBIR, 54% of ransomware victims had domain credentials in stealer logs before the attack. This makes it a lot less effort for ransomware groups to infiltrate organizations but can cause massive financial and reputational damage.

Account Takeover and Financial Fraud is another attack type which benefits from data included within stealer logs.  Session cookies enable immediate account takeover without triggering MFA. Buyers can drain linked payment methods, redirect wire transfers, access cryptocurrency exchanges, and commit identity fraud without ever needing to use a credential or use sophisticated hacking techniques. This significantly lowers the barrier to entry for unsophisticated or “script kiddie” threat actors.  Account takeover fraud totaled nearly $13 billion in 2023-2024.

Emerging Threats in 2026

The infostealer landscape shifted substantially in the second half of 2025 and into 2026, driven by a series of major law enforcement takedowns and the resulting scramble to fill vacated market share. But despite the takedowns, it has only grown with new stealer log families circulating all the time.

Following the disruption of LummaC2 in May 2025, established families moved quickly to absorb displaced activity. Rhadamanthys led through the summer until its own infrastructure was taken down by law enforcement in November 2025. By January 2026, Vidar 2.0 had emerged as the most widely used infostealer among threat actors, according to Flashpoint’s 2026 Global Threat Intelligence Report. As of early 2026, AhnLab ASEC’s February trend data identifies four families as dominating active distribution: LummaC2 (partially recovered), ACRStealer, StealC, and Vidar.

ACRStealer, also referred to as Acreed, is one of the most significant new entrants of 2025–2026, it rapidly ascended to become one of the top four most actively distributed infostealer families by early 2026

The macOS infostealer market has grown significantly from a niche concern into one of the fastest-expanding segments of the credential theft ecosystem. Atomic macOS Stealer (AMOS) dominated the macOS market through most of 2025, disappearing in October before returning in February 2026. MacSync (formerly Mac.C) emerged as the primary commodity macOS infostealer by year-end 2025. Poseidon and Odyssey are also active macOS-targeting families tracked in current reporting.

Current Families as of June 2026

The table below highlights the most commonly observed stealer log families as of June 2026, including families that have rebranded or have been disrupted.

Key Intelligence Takeaways

• Infostealer malware stole 1.8 billion credentials in 2025, with IBM reporting an 84% year-over-year increase in phishing delivery of stealers.
• Over half of ransomware victims in 2024-2025 had domain credentials in stealer logs prior to the attack, often with as little as a 48-hour window between log sale and intrusion.
• Russian Market has emerged as the dominant venue for stealer log transactions, listing over 180,000 logs in H1 2025 and demonstrating consistent resilience to law enforcement pressure.
• Session cookie theft renders MFA ineffective — 77% of logs on Russian Market contained SSO tokens in ReliaQuest’s analysis, making credential-only defenses insufficient.
• Law enforcement operations against major infostealer families produce real but temporary disruption; the ecosystem reconstitutes rapidly due to low barriers to entry and consistent criminal demand.
• Credential exposure from older logs carries persistent risk; stolen credentials remain valid and tradeable indefinitely unless explicitly revoked and rotated.

---

DarkOwl collects Stealer Log information from across the dark web and Telegram and makes this available through Vision so organizations can identify any credential exposure which may lead to further attacks. Contact us to learn more.