July 30, 2026

Overview

As tensions between the United States and Iran continue to escalate, DarkOwl researchers have observed a marked increase in online threats targeting the life of President Donald Trump. These threats span multiple layers of the internet — from dark web onion sites and encrypted Telegram channels to mainstream Iranian state-aligned media — and reflect both grassroots extremist sentiment and coordinated state-adjacent messaging. This post details DarkOwl’s findings.

The Dark Web Fundraiser: “8647 Kill Donald Trump”

DarkOwl researchers identified an onion site operating under the name “8647 Kill Donald Trump”, claiming to have allegedly gathered over $300,000 USD and actively promoting a $1 million fundraising campaign. The site describes its operators as a team of “highly qualified professionals united by a single goal: to eliminate the threat and protect the world from those who create danger.”

The site is published in three languages — English, Arabic, and Chinese — suggesting an intent to reach a broad international audience. Two QR codes are displayed on the site: one linked to a Bitcoin (BTC) wallet address, and one to a Monero (XMR) wallet address, providing anonymous payment channels for potential donors.

The number “8647” embedded in the site name carries specific significance. Multiple sources report that Republicans have flagged the number as split into two parts — 86 and 47 — read as a call for the assassination of President Trump, the 47th president. In American slang, “86” means to remove or get rid of someone, making “8647” a thinly veiled reference to eliminating him.

IRGC-Aligned Channels Amplify the Campaign

DarkOwl researchers observed IRGC-associated Telegram channels actively promoting the hashtag “کشتن ترامپ” — translating directly to “Kill Trump” — across multiple platforms.

Sabereen News, a pro-Iranian Telegram channel closely aligned with Iran’s “Axis of Resistance” narrative and considered to have close ties to the IRGC, posted on March 19th, 2026, that the offer for killing President Trump was being raised to $100 million USD, sharing a clearnet website alongside the announcement.

The same campaign was subsequently amplified by two additional IRGC-tied channels — the IRGC Quds Force News Channel and another pro-regime outlet — with posts published on March 21st and March 23rd, 2026, respectively.

KillTrump.info: Iranian Infrastructure

Researchers identified a domain — killtrump.info — that was promoted across these channels. While the domain is no longer online at the time of writing, WHOIS records reveal it was registered through an Iranian hosting company, Netmihan Communication Company Ltd, a finding that points to Iranian infrastructure underpinning the campaign.

The campaign was seeded on Iranian domestic social media platforms Eitaa and Rubika — both widely used inside Iran — days before being promoted on the above-mentioned Telegram channels, suggesting a deliberate domestic-first promotion strategy. A further Eitaa post was also identified as part of the same seeding activity.

IRGC-Affiliated FarsNews Covers the Campaign

FarsNews — the pro-Iranian news agency directly and formally affiliated with the IRGC, widely described as the cornerstone of the IRGC’s disinformation and propaganda apparatus, and designated by the U.S. Treasury under Executive Order 13553 in September 2023 — published a report on March 17th, 2026 covering the emergence of the Kill Trump campaign and its $100 million USD reward, sharing the fundraising website used to collect donations for it.

The fact that an IRGC-affiliated news agency was covering — and effectively amplifying — the campaign underscores how far this narrative has been normalized within Iran’s information ecosystem.

Some members of the Iranian diaspora community also reported that Iranian citizens residing inside Iran were receiving unsolicited SMS messages promoting the Kill Trump fundraising campaign and calling on recipients to participate, as documented by IranWire on X.

Handala Hacking Group Enters the Picture

On March 24th, 2026, the Iranian news agency Mehr News reposted a statement from the Handala hacking group. In direct response to a $10 million USD bounty placed on Handala members by the U.S. Department of Justice, the group announced a $50 million USD reward for the killing of both President Donald Trump and Israeli Prime Minister Benjamin Netanyahu.

This $50 million USD reward for Trump and Netanyahu remains active on Handala’s most prominent domain as of the time of writing, with the original post dated March 24th, 2026.

Handala’s entry into this campaign is significant: it represents a named, organized threat actor with established cyber capabilities formally attaching itself to a targeted assassination bounty — and one that has directly responded to U.S. law enforcement pressure with an escalatory public threat.

KillTrump.me: The Campaign Continues

On March 31st, 2026, Sabereen News introduced yet another domain — killtrump[.]me — which was found to be hosted on an IP address based in Iran, again belonging to Netmihan Communication Company Ltd.

The same site was shared across Iranian websites on March 30th, 2026 — one day prior to the Telegram announcement — again suggesting pre-seeding on domestic platforms before broader promotion.

KillTrump.ir: A Country-Code Domain and Iranian Hosting

On April 5th, 2026, a further domain — killtrump[.]ir — was introduced and shared via a post in the Sabereen News channel on the Iranian social platform Eitaa. This domain uses Iran’s country-code top-level domain (.ir) and was not available at the time of writing.

The site was hosted on an Iranian IP address — 185.143.234.235 — belonging to subnet 185.143.232.0/22, AS 205585, operated by Noyan Abr Arvan Co. (Private Joint Stock), a major Iranian cloud infrastructure provider. The latest archived records of the domain suggest the title translates to English as “Kill Trump.”

A clear and deliberate pattern emerges across all these domains: the “KillTrump” brand remains consistent, with only the TLD rotating — .info, .me, .ir — suggesting an operational strategy to maintain the campaign’s online presence even as individual domains are taken down.

Claimed Donations and State-Media Validation

A report published by Iran International on March 25th, 2026 cited pro-Iranian regime media claiming that more than $25 million USD had been donated toward the Kill Trump campaign reward fund. While these figures cannot be independently verified by DarkOwl, their amplification by state-adjacent media lends the campaign a degree of institutional visibility that goes well beyond fringe activity.

Senior Regime Voices Echo the Sentiment

The campaign extends well beyond anonymous dark web actors and fringe Telegram channels into the highest levels of Iranian political commentary.

On June 28th, 2026, Hossein Shariatmadari (حسین شریعتمداری) — an Iranian journalist and political commentator best known as the editor-in-chief of the conservative newspaper Kayhan (کیهان), a representative of the Supreme Leader, and a hardliner with significant influence in Iranian decision-making — published an article addressing three points on negotiations with the United States. The final point read: “And finally, the effort and expense to take revenge on the murderer of our martyred Imam, in that very land of America” — widely read as a thinly veiled reference to retaliatory action against President Trump on U.S. soil.

On July 11th, 2026, Hamshahri Online — a major Persian-language national daily newspaper owned and operated by the Tehran Municipality — published a report citing Iran’s new Supreme Leader stating that revenge is “a definite demand of the nation,” and listing 13 named individuals including Donald Trump and Benjamin Netanyahu as targets.

On July 16th, 2026, the Islamic Resistance in Iraq (Arabic: المقاومة الإسلامية في العراق) — an Iran-backed umbrella coalition of Shia militant factions operating under the strategic direction of the IRGC Quds Force — promoted a $10 million USD reward for anyone who kills President Trump or provides assistance toward his assassination.

Legal Precedent: A Foiled Plot Already on Record

These findings do not exist in a vacuum. On March 6th, 2026, the U.S. Department of Justice announced the conviction of Asif Merchant, also known as Asif Raza Merchant — an Iranian intelligence agent found guilty of terrorism and murder-for-hire charges in connection with a foiled plot to assassinate U.S. politicians and government officials, including President Trump, on American soil. The conviction confirms that Iranian-linked assassination plotting against the U.S. president has already moved from online rhetoric to operational planning.

Assessment

The findings documented above reflect a multi-layered, persistent, and escalating campaign spanning anonymous dark web infrastructure, IRGC-affiliated Telegram channels, Iranian domestic social media platforms, state-adjacent and state-owned news agencies, named hacking groups, and senior regime voices. Several indicators are worth highlighting:

Iranian hosting infrastructure — specifically Netmihan Communication Company Ltd and Noyan Abr Arvan Co. — is used consistently across multiple killtrump domains, pointing to organizational coordination rather than spontaneous grassroots activity.

TLDs rotate deliberately as domains are taken down, an operational resilience that suggests continuity of intent and a structured effort to maintain the campaign’s online presence.

The Handala hacking group’s involvement adds a cyber threat dimension to what might otherwise appear to be a purely rhetorical campaign, particularly given its direct response to U.S. DOJ pressure with an escalatory $50 million bounty.

Content is pre-seeded on domestic Iranian platforms — namely Eitaa and Rubika — before international Telegram amplification, pointing to a structured dissemination strategy rather than organic spread.

Senior regime-aligned voices have amplified the campaign, including a representative of the Supreme Leader, a Tehran Municipality-owned newspaper, and the Iran-backed Islamic Resistance in Iraq, elevating the campaign from fringe extremism to something with demonstrable institutional backing.

---

DarkOwl will continue to monitor developments across dark web and open-source channels as the situation evolves. Stay up to date.

July 28, 2026

The Call That Fooled Everyone

“Hey John, it’s Jamie. I’m locked out of my email and I left my cell at the office. If I don’t get this spreadsheet over to finance by COB tonight, Bill is going to melt down for sure. Can you help me get into my email to send this one thing???”

Jamie sounds like Jamie, Bill is indeed the department head, and the company’s financial quarter is set to close within the next day.

Jamie sounds stressed, even close to tears, and John of course wants to help her out.

The problem is that Jamie is being impersonated using AI deepfake tech, and once John resets the MFA (multi-factor authentication), attackers will be inside the network within minutes.

Social Engineering Isn’t New — But AI Just Changed the Game

As long as humans are part of any workflow, security is vulnerable to human error. Social engineering, the attack method utilizing convincing pretext to deceive and manipulate, is nothing new. However, AI has intensified the threat landscape.

Deepfakes, voice cloning, and synthetic identities mean human judgement defenses are more vulnerable now than they were a few years ago.

The Help Desk Is a Key Targeted Entry Point

Help desks are valuable targets for threat actors using these tactics.

Muddled Libra (one alias for this group is Scattered Spider) is one such threat group utilizing these tactics, as outlined by Palo Alto Networks in June 2025, where they saw evidence of the group identifying key personnel, using publicly available information to build a profile and then use this to impersonate the employee, thus allowing them to gain access to systems and monetize attacks quickly.

Personal relationships which may exist between help desk and other company staff are often exploited, using deepfake tech to impersonate not only voice, but also cadence, inflection, and keyword peculiarities specific to the chosen individual.

Who is Behind Hacks — The Players You’ve Never Heard Of

Threat actor methods and tracking can be time consuming. It is important to note threat actors often share scripts, refine techniques, and trade stolen data on the dark web. Leaving threat actors un-investigated means leaving behind key defensive intel crucial for your business.

The NY Times identified threat actor Scattered Spider as being investigated for the 2025 Marks & Spencer cyberattack in Britain.

DarkOwl Vision offers intel and dossiers on threat actors. Scattered Spider is one such entity whose methods, aliases, tools, and other information are available. The identified alias of “Muddled Libra” is seen below for threat actor “Scattered Spider” in Dark Owl Vision:

Additional details for this threat actor include other targeted industries, Telegram accounts, and known tactics:

Social engineering defense is key, however, knowing specific attack methods can increase network defenses.

Three CVE’s have been identified as in use by Scattered Spider in DarkOwl Vision:

A known enemy is always better than fighting blind. Monitoring dark web content as part of proactive security measures can help defend against emerging attack vectors.

Pre-Attack Intelligence and Defense

Network defenders can also watch for signals before an attack. To catch adversary reconnaissance from darknet sources, monitoring and subsequent alerting are key.

DarkOwl Vision’s Alerting function can ensure keywords specific to your company can be monitored, with alerts generated from any findings. Identified corporate keyword chatter on dark forums can be utilized as an advanced warning to all company staff in anticipation of social engineering attacks. If any are discovered, security passphrases can be refreshed, and additional social engineering prevention trainings issued.

What Attackers Need to Pull This Off (And Where They Get It)

Remember, the attackers already have enough data points to pull off a convincing pretext against your staff. The United States is by default opted IN, not opted out, of data brokers. The personal and specific details of your staff are already public. Names, roles, manager’s role, and other details are easily found.

Adding AI impersonations with deepfake technology, and you’ve got a recipe for disaster. Methods discussed online quickly turn into real world intrusion attempts.

Visibility is the Real Defense

Go back to John for a second. By the time “Jamie” called, the attacker had already done the hard part of research and preparation including details, urgency, voice, etc. That’s the uncomfortable truth about this kind of attack: the call itself is just the final step in a process that’s been visible, in pieces, for days or weeks beforehand. The organizations that get ahead of this are the ones who were watching the early signals closely enough that the call never had a chance to work in the first place. AI has made the pretext better. It hasn’t made the playbook any less visible to the people willing to look for it.

---

Learn more about DarkOwl’s features mentioned throughout this blog. Contact us.

July 23, 2026

What Is a Stealer Log?

A stealer log is not merely a log file. It is a structured, compressed archive of everything a piece of stealer malware has silently harvested from an infected device usually before the victim had any idea anything was wrong, if they ever did. Unlike ransomware, which announces itself with locked screens and ransom notes, infostealer malware operates without disrupting normal device function and therefore can be difficult to detect. The infected machine keeps running. The user keeps working. Meanwhile, the malware is methodically copying credentials from every browser, extracting active session cookies, reading cryptocurrency wallet files, and sometimes even photographing the desktop — then packaging everything into a neat archive and transmitting it to an attacker-controlled server.

Each log, in the language of underground markets, represents one “bot” — one compromised device, one victim’s complete digital footprint, ready for purchase and exploitation.

What’s Inside a Stealer Log?

The value of a stealer log to a criminal depends heavily on what it contains. Logs with bank credentials, for instance, will be more valuable than other types of credentials. However, there are a lot of other data types withing a stealer log which can be very advantageous to criminals. Logs are typically organized by data type within the archive, making it simple for buyers to locate specific categories of value. The standard contents break down into six main categories:

• Browser Credentials — Every saved username and password from any browser used on the infected machine such as Chrome, Edge, Firefox, Brave, and Opera, sorted by domain. One infection compromises dozens of accounts simultaneously.
• Session Cookies & Auth Tokens — Active session tokens that bypass MFA entirely. An attacker importing a valid session cookie can access accounts without triggering any new authentication prompt.
• Autofill & Payment Data — Names, addresses, phone numbers, dates of birth, and payment card details stored in browser autofill, enabling identity fraud beyond credential abuse. Think about this next time your browser asks you if you want to save your information for the future.
• Cryptocurrency Wallets — Wallet files, browser extension data, seed phrases, and private keys for Bitcoin, Ethereum, and other cryptocurrencies. Funds can be drained within minutes of purchase.
• System & Device Information — Hardware IDs, OS version, installed software, IP address, geolocation, and a desktop screenshot taken at infection time.
• VPN, FTP & Application Tokens — Remote access credentials, FTP configs, and tokens for Slack, Discord, GitHub, and cloud services which can provide direct network footholds for corporate intrusions.

One particularly dangerous aspect of a stealer log infection is its attack on session persistence. When a user logs into a website and completes multi-factor authentication, the browser stores a session cookie confirming that the device has already authenticated. An attacker who imports that cookie can access the same account with no password required, and no MFA challenge triggered. Microsoft’s own documentation confirms that certain session cookies can persist until explicit logout or token expiration, potentially enabling weeks of undetected access with a single stolen log.

Analyst Note

Sellers routinely re-package the same log multiple times — as a cheap raw dump, a premium corporate set, and a crypto-only slice — reselling the same victim data to multiple buyers. Underground market research suggests tens of billions of stolen cookies were circulating in 2025.

The Most Common Infostealer Families

The infostealer malware ecosystem operates as a commercially organized, subscription-driven marketplace. Most major variants are sold as Malware-as-a-Service (MaaS), with developers offering monthly subscriptions, customer support forums, update bulletins, and affiliate programs. According to IBM X-Force’s 2025 threat intelligence report, the following families dominated dark web forum activity throughout 2024 and into 2025:

The broader pattern is consistent across every law enforcement disruption: when one major infostealer family is taken down, market share migrates to alternatives within days to weeks, or the malware is updated on new C2 servers run by other affiliates. This resilience stems from the structural nature of the ecosystem. Low development barriers, open-source code availability, and persistent criminal demand ensure that neutralizing any single actor creates an immediate commercial opportunity for others.

Where Stealer Logs Are Sold?

The underground market for stealer logs operates across several parallel channels, each serving different buyer profiles and transaction volumes. Understanding where logs are distributed is central to understanding how quickly stolen data can be weaponized after an infection.

Following the Genesis Market seizure in April 2023, SecureWorks documented a 670% increase in Russian Market activity as buyers and sellers migrated. This pattern has repeated across every major marketplace takedown: the criminal ecosystem absorbs the disruption rapidly, and within weeks, activity consolidates on surviving platforms or new entrants.

How are Stealer logs used by criminals?

Stealer logs are usually the first step in an often more sophisticated attack. Information that can be found in logs is often used as part of other attacks, usually against organizations rather than against the individuals that were initially infected.

Initial Access Brokers (IABs) will sift through millions of logs, which they may control themselves or have purchased, looking specifically for corporate VPN credentials, SSO tokens, and domain admin access. Qualifying logs are re-packaged and sold on dark web forums for significantly higher prices.

Ransomware affiliates purchase verified corporate access from IABs and or have access to their own logs containing this information and use it to log directly into target networks which allows them to bypass perimeter defenses entirely. According to Verizon’s 2025 DBIR, 54% of ransomware victims had domain credentials in stealer logs before the attack. This makes it a lot less effort for ransomware groups to infiltrate organizations but can cause massive financial and reputational damage.

Account Takeover and Financial Fraud is another attack type which benefits from data included within stealer logs.  Session cookies enable immediate account takeover without triggering MFA. Buyers can drain linked payment methods, redirect wire transfers, access cryptocurrency exchanges, and commit identity fraud without ever needing to use a credential or use sophisticated hacking techniques. This significantly lowers the barrier to entry for unsophisticated or “script kiddie” threat actors.  Account takeover fraud totaled nearly $13 billion in 2023-2024.

Emerging Threats in 2026

The infostealer landscape shifted substantially in the second half of 2025 and into 2026, driven by a series of major law enforcement takedowns and the resulting scramble to fill vacated market share. But despite the takedowns, it has only grown with new stealer log families circulating all the time.

Following the disruption of LummaC2 in May 2025, established families moved quickly to absorb displaced activity. Rhadamanthys led through the summer until its own infrastructure was taken down by law enforcement in November 2025. By January 2026, Vidar 2.0 had emerged as the most widely used infostealer among threat actors, according to Flashpoint’s 2026 Global Threat Intelligence Report. As of early 2026, AhnLab ASEC’s February trend data identifies four families as dominating active distribution: LummaC2 (partially recovered), ACRStealer, StealC, and Vidar.

ACRStealer, also referred to as Acreed, is one of the most significant new entrants of 2025–2026, it rapidly ascended to become one of the top four most actively distributed infostealer families by early 2026

The macOS infostealer market has grown significantly from a niche concern into one of the fastest-expanding segments of the credential theft ecosystem. Atomic macOS Stealer (AMOS) dominated the macOS market through most of 2025, disappearing in October before returning in February 2026. MacSync (formerly Mac.C) emerged as the primary commodity macOS infostealer by year-end 2025. Poseidon and Odyssey are also active macOS-targeting families tracked in current reporting.

Current Families as of June 2026

The table below highlights the most commonly observed stealer log families as of June 2026, including families that have rebranded or have been disrupted.

Key Intelligence Takeaways

• Infostealer malware stole 1.8 billion credentials in 2025, with IBM reporting an 84% year-over-year increase in phishing delivery of stealers.
• Over half of ransomware victims in 2024-2025 had domain credentials in stealer logs prior to the attack, often with as little as a 48-hour window between log sale and intrusion.
• Russian Market has emerged as the dominant venue for stealer log transactions, listing over 180,000 logs in H1 2025 and demonstrating consistent resilience to law enforcement pressure.
• Session cookie theft renders MFA ineffective — 77% of logs on Russian Market contained SSO tokens in ReliaQuest’s analysis, making credential-only defenses insufficient.
• Law enforcement operations against major infostealer families produce real but temporary disruption; the ecosystem reconstitutes rapidly due to low barriers to entry and consistent criminal demand.
• Credential exposure from older logs carries persistent risk; stolen credentials remain valid and tradeable indefinitely unless explicitly revoked and rotated.

---

DarkOwl collects Stealer Log information from across the dark web and Telegram and makes this available through Vision so organizations can identify any credential exposure which may lead to further attacks. Contact us to learn more.

July 16, 2026

C-suite executives are prime targets for cybercriminals because they hold the keys to an organization’s most valuable assets: sensitive data, financial authority, and strategic decision-making power. Their visibility inside and outside the company also makes them easier to identify and profile. As a result, executive-focused attacks such as business email compromise (BEC), often referred to as “whaling,” have become one of the most costly forms of cybercrime, resulting in billions of dollars in losses each year. The threat is amplified by executives’ growing digital footprints. Research from ZeroFox found that 75% of executives already have exposed credentials available online, providing threat actors with a rich source of information to fuel targeted attacks.

Darknet monitoring serves as a critical early warning system for organizations seeking to stay ahead of emerging threats. While it is often impossible to prevent stolen credentials, sensitive data, or other compromised information from appearing on the dark web once it has been exposed, early detection can significantly reduce the potential impact. By identifying risks before they are weaponized, organizations can take proactive steps—such as resetting credentials, strengthening access controls, and enhancing monitoring—to prevent financial loss, data breaches, and reputational damage.

C-Suite Members Make Perfect Targets

The dark web hosts a wide range of stolen and compromised information that can be exploited for fraud, cybercrime, and further attacks. Commonly traded data includes personally identifiable information (PII) such as names, addresses, identification documents, and medical records; login credentials for email, social media, and business systems; financial information including credit card and banking details; intellectual property such as source code, research, and product designs; corporate network access credentials; and customer databases containing contact information and purchasing histories. These datasets are often used to facilitate identity theft, phishing campaigns, account takeovers, financial fraud, and unauthorized access to corporate environments.

C-suite executives are frequent targets of cyberattacks, yet many organizations still do not provide additional cybersecurity protections for their leadership teams. This gap leaves executives and organizations at increased risk.

According to SOCRadar, executive identity fraud has become a widespread security concern, with more than half of U.S. companies reporting incidents involving executive impersonation. Identity-based attacks targeting senior leaders are no longer isolated events – they are an ongoing challenge for security teams.

Credential exposure is also a significant issue. Research shows that most executives have had at least one cleartext credential exposed in a data breach, often involving passwords reused across personal and professional accounts. These exposures can create easy entry points for attackers. Additionally, executive and corporate credentials are commonly found on the dark web, where stolen passwords, personal information, and access credentials are bought and sold. Without proactive monitoring and executive protection measures, these exposures can lead to phishing attacks, account takeovers, executive impersonation, and broader organizational risk.

Why Darknet Monitoring Is Important

Darknet monitoring involves continuous scanning and intelligence gathering across hidden areas of the internet that are not indexed by traditional search engines, including networks such as Tor, I2P, ZeroNet, and encrypted communication channels. Cybercriminals frequently use these platforms to buy and sell stolen data, discuss vulnerabilities and exploits, share attack techniques, and coordinate malicious activities.

By monitoring these environments, organizations can identify potential threats before they develop into full-scale incidents. Effective dark web surveillance provides early warning of compromised credentials, leaked corporate information, and other indicators of malicious activity. This allows security teams to take proactive measures—such as resetting passwords, notifying affected users, strengthening access controls, and increasing monitoring—before attackers can exploit the information.

Not all data discovered on the dark web presents the same level of risk, but much of it can be highly sensitive. Common findings include stolen credentials such as email and password combinations or VPN logins, breached corporate databases containing financial, human resources, or customer information, identity documents such as Social Security numbers and passports, and leaked internal communications or proprietary intellectual property. Even seemingly minor exposures can provide attackers with the information needed to launch more sophisticated attacks or gain unauthorized access to critical systems. As a result, organizations increasingly rely on data leak monitoring and dark web alerting capabilities to detect and respond to threats before they escalate.

Dark web monitoring also plays an important role in identifying social engineering and account takeover risks. Threat actors often use phishing campaigns, credential theft, social engineering tactics, and brute-force attacks to gain control of legitimate social media, email, and business accounts. In other cases, they invest significant time and resources into creating convincing fake online personas designed to establish trust with employees, partners, or executives. For example, attackers may build fraudulent professional profiles complete with fabricated work histories, endorsements, certifications, and conference participation records. Advances in artificial intelligence and digital content generation are making these impersonation efforts increasingly realistic, allowing threat actors to create more persuasive identities and making it more difficult for organizations to distinguish legitimate contacts from malicious actors.

Ways to Protect Executives from Cyber Threats

Effective executive protection begins with understanding the threat landscape itself. Organizations must develop a clear picture of the malicious terrain, the actors operating within it, and the security tools available to counter emerging risks. By leveraging threat intelligence, security teams can identify executive exposure across the surface, deep, and dark web, enabling proactive detection and mitigation of potential threats. To fully understand the risks facing senior leaders, organizations must first understand the environment in which those threats originate.

A comprehensive executive cyber protection strategy should include the following measures:

• Continuously Assess Executive Exposure: Executives are often targeted through both personal and professional channels. Regular assessments of digital exposure across public, deep-web, and dark-web sources can uncover sensitive information, impersonation attempts, credential leaks, and other indicators of risk before they are exploited.
• Deliver Executive-Focused Security Awareness Training: Traditional security training can fail to resonate with senior leaders. Instead, organizations should provide concise, engaging learning sessions that incorporate real-world phishing simulations and executive-specific threat scenarios. Regular, targeted training helps executives recognize and respond to evolving attack techniques.
• Formalize and Measure Security Programs: Executive protection should be integrated into a broader cybersecurity framework that aligns with business objectives. Establishing key performance indicators (KPIs), implementing controls such as multi-factor authentication, and regularly measuring security outcomes help create a mature and accountable security program.
• Provide Ongoing Threat Intelligence Updates: The threat landscape evolves rapidly, making regular executive briefings essential. Security leaders should deliver concise updates on emerging threats, attack trends, and organizational risk exposure using business-focused metrics and contextualized reporting that supports informed decision-making.
• Communicate Risk in Business Terms: Cybersecurity discussions are most effective when framed around business impact. Executives should understand how cyber incidents can affect revenue, operations, regulatory compliance, and brand reputation. Sharing lessons learned from high-profile breaches can help reinforce the real-world consequences of inadequate security practices.
• Conduct Executive Cyber Crisis Simulations: Preparation is critical during a cyber incident. Executive Breach Attack Simulations (BAS) and tabletop exercises help leadership teams understand their roles during a cyber crisis, improve decision-making under pressure, and strengthen coordination between business and security stakeholders.

By combining threat intelligence, executive education, governance, and continuous monitoring, organizations can significantly reduce cyber risk to their leadership teams while building a stronger overall security posture.

---

Learn how DarkOwl can help. Contact us.

July 16, 2026

A look at new capabilities, platform improvements, and notable darknet intelligence collected across April, May, and June. 

This quarter centered on three themes: less manual reading, thanks to new AI summarization; more context on the leaks already indexed in the platform; and clearer, more navigable views into how DarkOwl’s dataset breaks down across industries and time. Keep an eye out for enhanced data structuring for our Leak and Stealer Log data in the coming quarters! 

Generate Summaries with AI  

Forum threads can run for hundreds of posts, and market listing reviews pile up fast — reading through all of it to find the signal is one of the more time-consuming parts of darknet research. New generative AI features, now in beta, automatically summarize forum threads and market listing reviews, distilling long-running conversations and vendor reputations into a concise, readable summary in a fraction of the time it would take to read the original thread. 

Leak Explore: Industry Insights and Filtering 

Understanding how leaks are distributed — across industries and over time — matters for prioritization, trend analysis, and benchmarking against peers. New Industry Insights in Leak Explore visualize how DarkOwl’s leak dataset breaks down by sector and time period, surfacing patterns that are hard to see one leak at a time. Alongside those insights, three new filters — Associations, Industries, and Stealer Logs — make it faster to narrow the dataset down to exactly what’s relevant to an organization or sector. 

Enhanced Usage and Activity Reporting 

For teams managing licenses and tracking platform usage, reporting got more flexible this quarter. Date range options now include 180-day and 365-day lookback periods alongside existing ranges, giving users a longer view into usage trends. Logins have been added to the Activity display for better visibility into who’s accessing the platform and when, and Usage Reports can now be downloaded as a PDF, making it easier to share usage data with stakeholders outside the platform. 

Data and API Updates: Leak Context and Enrichment 

Knowing a leak exists is only half the picture; knowing who it targeted, and what that target does, is usually the more urgent question. We’ve significantly expanded the enrichment attached to a leak’s Target, adding descriptions, associated domains, countries, and industry classification. Analysts now get the context needed to assess relevance at a glance. The enrichment now covers all historical leaks indexed in DarkOwl Vision. 

Collection Stats 

Our data collection team continues to astonish us with the quantity of data made available across all DarkOwl products, including year over year growth for the number of email addresses, domains, credit card numbers, IP addresses, and crypto addresses.

Notable Content Collected 

Our collection and research teams had a busy quarter. Here’s a snapshot of some of the most significant data leaks and original research that happened in Q2. 

Original Research: Mapping Darknet Drug Markets and Vendors 

Beyond the platform itself, DarkOwl’s Data Science team published new original research this quarter: “From Listings to Lineage: Mapping Darknet Drug Markets and Vendors in Early 2026.” The report traces how darknet drug marketplaces and vendor networks have shifted heading into 2026, offering a data-driven look at market structure, vendor migration, and lineage across the current darknet drug trade landscape. 

Leaks of Interest 

ShinyHunters Leaks

DarkOwl has ingested a number of leaks this quarter from the ShinyHunters extortion site. These leaks span multiple industries – Healthcare, Finance, Insurance, Transportation, Retail, and more – and have had a global impact due to the high volume exposure of corporate data. These leaks not only include PII but also extensive customer data, internal documents, vendor information and other intellectual property. DarkOwl has observed a high return rate of actionable intelligence within these leaks. 

proactivemedical.com

Data purported to be from Proactive Medical Inc. was posted on Cl0p, on May 12, 2026. Data exposed includes Customer information, Email addresses, Physical addresses, Account information, Device information, SSNs, Messages, User IDs, Website mentions, Phone numbers, IP addresses, Credit cards, Source code, Medical information, Company names, Internal emails, Names, Expiration dates, Internal documents, and Product data.

B1acks Stash 8 Million CVV2

A post on b1ack’s Stash, a dark web marketplace, linked to a series of files containing credit card “freebies” between May 18 and 21, 2026. Data exposed includes Credit cards, Full Names, Company names, Email addresses, Expiration dates, Phone numbers, IP addresses, and Physical addresses.

---

Curious how these features and data can make your job easier? Get in touch! 

July 15, 2026

Background: What Is FortiBleed?

In mid-June 2026, security researchers identified a large-scale credential compromise campaign targeting Fortinet FortiGate firewalls, quickly dubbed FortiBleed. Unlike a traditional zero-day, FortiBleed is not tied to a single new vulnerability. Instead, threat actors systematically extracted configuration files from internet-facing FortiGate devices and cracked the stored password hashes — exploiting the fact that many organizations running older FortiOS versions continued to store administrator credentials as legacy SHA-256 hashes rather than the more secure PBKDF2 format Fortinet introduced in FortiOS 7.2.11, 7.4.8, and 7.6.1. Devices upgraded from earlier versions retain SHA-256 hashes until each administrator logs in post-upgrade, leaving a window of exposure that the campaign actively exploited at scale.

The result: verified working administrator credentials for between 73,932 and 86,000 devices across 21,632 organizations in 194 countries — roughly half of all internet-facing FortiGate firewalls at the time of discovery. The United States, India, and Mexico were among the most heavily affected countries. CISA issued an advisory on June 18, 2026 urging organizations to rotate credentials, enforce MFA, and restrict management interface access.

About Darkforums

Darkforums is currently the fastest-growing English-language cybercrime forum on the darknet. Originally launched as “DARK4RMY Forums” by a hacking group called DarkArmy, it rebranded following the April 2025 collapse of BreachForums and rapidly absorbed much of that platform’s displaced user base — recording a 600% surge in activity between April and June 2025. Now operated by administrators AnonOne and Knox, the forum hosts over 12,700 registered members and offers a tiered membership model (VIP, MVP, and GOD ranks) alongside a full range of cybercrime content: leaked databases, stealer logs, combo lists, malware tools, and access listings. It is on this forum that DarkOwl researchers identified the threat actor Dark_Alpha advertising FortiGate access tied to the FortiBleed campaign.

Dark_Alpha: Threat Actor Profile

On June 20th, 2026, a threat actor using the handle “Dark_Alpha” — an MVP-tier member of Darkforums — posted a thread titled “[ FortiBleed ] FortiGate / Fortinet Access 35k ip”.

This content was identified and captured by DarkOwl Vision during routine dark web collection.

DarkOwl analysts identified a corroborating listing on the Russian-language Exploit forum, posted by an actor operating under a distinct handle but sharing an identical TOX ID — suggesting a high likelihood of the same underlying threat actor. The following screenshot was captured via DarkOwl Vision.

“Dark_Alpha” is an MVP member of Darkforums. On Darkforums, MVP membership is available to any user for a one-time fee of €40, granting elevated privileges such as the ability to change usernames (twice), +60 forum credits, a higher daily post limit of 10, and the ability to edit or delete posts for up to two months — as detailed in Screenshot.

Dark_Alpha is advertising FortiGate/Fortinet access to 35,000 corporate targets for $25,000. According to the actor, the dataset spans 194 countries — a geographic footprint that aligns precisely with the confirmed scope of the FortiBleed campaign as documented by Arctic Wolf and CISA, lending the listing a degree of credibility. The data is structured in the format “url:user:pass:domain:revenue.” The actor provided a TOX ID for contact.

According to the actor’s profile, Dark_Alpha joined Darkforums on February 28, 2025, and has since created 6 threads and 11 posts, accumulating a forum reputation score of 6. The profile signature reads “ALPHA-GROUP”.

The actor also lists a QTOX ID on their profile and can be reached via the forum’s private messaging feature.

Dark_Alpha’s Darkforums Activity

Beyond the FortiBleed listing, Dark_Alpha has been actively posting access listings targeting organizations across Bolivia, Vietnam, India, the United States, and Brazil — including at least two alleged government entities. DarkOwl researchers identified the following threads attributed to this actor on Darkforums:

• On June 9th, 2026, Dark_Alpha listed administrator-level GitLab access to a Bolivian government entity — identified by the thread title as AGETIC (Bolivia’s national e-government agency) — with reported revenue of $69.6 million, priced at $1,000

• On June 11th, 2026, the actor listed admin-level GitLab access to a Brazilian government entity for $2,000. The target’s revenue is claimed at $50 million. The actor claims the access was obtained via a zero-day exploit — a claim DarkOwl cannot independently verify and which predates the public FortiBleed disclosure, suggesting this may be a separate intrusion vector. The listing includes tokens, APIs, database keys, source code, and environment variables.

• On June 12th, 2026, Dark_Alpha listed FortiGate VPN access to a Vietnamese entity with over 90 hosts, super-admin rights, and claimed revenue of $22 million, priced at $1,000 . As with the Brazil listing, the actor claims access was obtained via a zero-day exploit. Given that this listing also predates the public FortiBleed disclosure, whether it is related to FortiBleed or an independent intrusion is unclear.

• Later that same day, the actor posted a second listing: FortiGate VPN/portal access to an Indian entity in the Medical Devices & Equipment sector, with claimed revenue of $3 billion and 1,193 hosts.

• On June 21st, 2026 — three days after CISA’s FortiBleed advisory — Dark_Alpha listed 6,355 valid FortiGate device accesses from U.S.-based entities, explicitly citing the FortiBleed vulnerability as the acquisition method. Given that India, the U.S., and Mexico collectively account for a significant share of the 73,000+ compromised devices identified by researchers, a U.S.-focused subset of that scale is plausible. Targeted organizations span a revenue range of $1 million to $200 billion. The bulk price is $7,000, with individual access also available. Notably, the actor accepted payment via the forum’s escrow system — a mechanism that may indicate a higher degree of transactional credibility.

Note on escrow: An escrow system acts as a trusted intermediary, holding payment until the buyer confirms receipt of the promised goods — a mechanism designed to reduce fraud between anonymous parties and one that more established actors tend to offer.

While Dark_Alpha has been active on Darkforums since February 2025, some earlier threads are no longer accessible due to the forum’s repeated TLD changes. DarkOwl maintains historical records across all known Darkforums domains, enabling researchers to track actor activity across those domain transitions.

DarkOwl analysts identified a corroborating finding wherein a network access broker operating on the Russian-language forum XSS, who shared a Telegram contact, utilized the identical handle “Dark_Alpha.” While this handle overlap suggests a potential link to the actor discussed above, attribution across forums cannot be confirmed with certainty, and the possibility of handling reuse by a distinct threat actor cannot be ruled out at this time.

Conclusion

The activity attributed to Dark_Alpha illustrates how rapidly IABs capitalize on newly disclosed — and in this case, still unfolding — credential exposure events. In under two weeks following the public emergence of FortiBleed, this actor posted listings spanning six countries, two alleged government entities, and thousands of compromised devices across critical sectors including government IT and medical devices. The listing of 6,355 U.S. FortiGate accesses posted the same week as the CISA advisory underscores how quickly the darknet economy responds to public disclosures: rather than dampening activity, news coverage appears to have been used as a sales tool.

The “ALPHA-GROUP” signature warrants further monitoring. Whether this represents a larger team or a solo actor cultivating a brand, the pace and breadth of Dark_Alpha’s listings in such a compressed timeframe — and the actor’s apparent access to data that aligns with the confirmed FortiBleed scope — suggests an established and operationally capable presence in the access brokering ecosystem.

It is also worth noting that separate research linked the original FortiBleed data exposure to a threat actor operating under the handle “SantaAd” on a Russian-language cybercrime forum. Whether Dark_Alpha is independently operating, reselling data obtained from SantaAd, or represents a separate arm of the same operation is an open question and a thread worth pulling.

Organizations running FortiGate or Fortinet devices should treat FortiBleed as an active, exploited threat and verify patch status immediately. Rotating credentials, enforcing MFA, and removing management interfaces from the public internet remain the highest-priority mitigations per CISA’s guidance. DarkOwl’s Vision UI enables security teams to monitor darknet forums for mentions of their organization, IP ranges, and credentials in near real-time — providing early warning of exposure before it can be operationalized by threat actors like Dark_Alpha.

---

Keep up with us. Follow us on LinkedIn.

July 8, 2026

It is estimated that over three billion people play video games. That is nearly 43% of the worlds population! Cybercriminals know that — and they’ve spent years turning the platforms gamers trust most into infrastructure for malware, money laundering, and stolen credential markets.

Gaming has a cybercrime problem that goes way beyond cheaters and griefers. The same platforms where players organize raids, share mods, and trade rare skins have become genuine darknet-adjacent ecosystems, hosting criminal marketplaces, command-and-control servers, and sophisticated money laundering pipelines. Two platforms in particular sit at the center of this, Discord and Steam.

Why Gamers Are Such Easy Targets

Gaming environments are built on trust. Players routinely download mods from strangers, click invite links from people they’ve never met, and hand over login credentials to access new servers or betas. That culture of openness is exactly what attackers exploit.

In 2025, security researchers documented millions of malicious files disguised as mods, cheat tools, and cracked games for titles like GTA, Minecraft, and Call of Duty. Behind every fake cheat was the same payload: infostealer malware designed to harvest saved browser passwords, Steam session cookies, Discord tokens, and crypto wallet keys — all in one hit, from one infected machine.

The Malware-as-a-Service (MaaS) economy has turbocharged this. New stealers like Katz and Bee (the latter priced at just $300/month on criminal forums) were built with explicit focus on Discord and gaming platforms. Katz even injected malicious JavaScript directly into Discord’s own application files to establish a persistent backdoor. Low barrier to entry, high-value targets: it’s a formula that’s working.

Discord: Built for Gaming, Weaponized for Crime

Discord was designed to be a gaming community tool, built with persistent servers, voice channels, file sharing, bots, invite links, fine-grained permissions, and the option to make servers completely private. However, it has also become widely used as a criminal infrastructure tool for exactly the same reasons. Fake Steam, PlayStation, and Xbox login pages were widely distributed through Discord in 2025 which were promoted via messages promising free skins, beta access, or exclusive item drops. Classic social engineering, delivered through a trusted platform.

The Black Market in Your Gaming App

As law enforcement took down major darknet markets through the early 2020s, a lot of criminal communities migrated to Discord, trading the anonymity of Tor for Discord’s ease of use and real-time collaboration. DarkOwl monitors a large number of servers and channels hosted on Discord that are used to discuss and share malicious activity. These aren’t amateur operations. They’re organized by commodity, with dedicated channels for combolists (username/password pairs from breached databases), fraud tutorials, stolen session tokens, and cracking tools. They maintain mirror servers specifically to survive takedowns and reconstitute banned communities within hours.

Discord as a Malware Delivery Network

When you upload a file to Discord, it gets hosted on Discord’s own content delivery network (CDN) and generates a permanent direct link. Attackers exploit this constantly. They upload malicious payloads to Discord’s CDN, then distribute the links through phishing campaigns, fake gaming community invites, or DMs. Because Discord’s infrastructure is trusted, often explicitly allowlisted by enterprise security tools, the malicious traffic can blend in with normal activity.

In mid-2025, researchers uncovered a campaign exploiting a flaw in Discord’s invite link system to redirect victims through silent redirection chains ending in multi-stage malware. Payloads included AsyncRAT, Skuld Stealer, and ChromeKatz — all designed to drain credentials, browser cookies, and active Discord session tokens. The attack worked because users trusted the Discord branding.

Nation-States Are Using Discord Too

This isn’t just criminal-grade activity. Nation-state actors have adopted Discord as command-and-control (C2) infrastructure because it’s so hard to detect. When malware communicates over Discord’s API, the traffic is encrypted, globally distributed, and indistinguishable from a developer’s legitimate bot.

In late 2025, the Rust-based ChaosBot malware was discovered inside a financial services firm’s network, using Discord to create a private text channel named after the victim’s computer and receive commands through it. Separately, the China-aligned APT group Webworm deployed a backdoor called EchoCreep specifically engineered to use Discord for C2, targeting government institutions and enterprises across Europe and Asia. Another China-linked group, GopherWhisper, used Discord for data exfiltration in attacks on Mongolian government entities. Discord isn’t just a gaming platform anymore — it’s part of the nation-state toolkit.

Steam

Valve’s Steam platform is the world’s largest PC gaming store, with over 130 million registered accounts and stored payment data for most of them. That makes it an extremely attractive target and an effective vehicle for financial crime.

Steam Accounts for Sale

In May 2025, a threat actor listed what they claimed was a database of 89 million Steam accounts on a dark web forum, asking $5,000 to start. The gaming world panicked. Valve investigated and determined the dataset was mostly expired SMS authentication codes, not passwords or payment data, likely sourced from a supply chain compromise of Twilio, the communications provider that delivers Steam’s SMS verification messages, a useful reminder that your platform’s security is only as strong as its weakest third-party vendor.

The more common Steam account compromises are lower-tech: credential stuffing with passwords reused from other breaches, phishing via fake login pages promoted on Discord, and infostealer malware that captures active Steam session tokens from infected PCs bypassing two-factor authentication entirely.

Virtual Items as a Money Laundering Vehicle

Steam’s virtual item economy has been systematically exploited for money laundering. Criminals will use stolen credit cards to buy tradeable in-game items or currency and then sell those items on secondary markets for real money.

The most documented case: Counter-Strike: Global Offensive container keys. These were freely tradeable on the Steam Community Market until Valve shut it down in 2019 after discovering that worldwide fraud networks had taken over, at the time of the shutdown, Valve acknowledged that nearly all significant key purchases on the market were fraud-sourced. A Vice investigation had found that 90% of CS:GO loot box transactions globally were being used to launder illicit funds.

Fortnite’s V-Bucks saw the same pattern: stolen cards used to bulk-buy currency, then sold at a discount on dark web markets and grey-market platforms. Academic analysis of Steam Marketplace transaction data has since confirmed that identifying money laundering patterns is feasible with straightforward detection methods, and found numerous accounts warranting investigation.

The Bigger Picture

It’s tempting to frame gaming cybercrime as a consumer problem, something that affects individual players, not enterprises. That framing is dangerously incomplete. An employee whose personal gaming PC is compromised by an infostealer doesn’t just lose their Steam library. Infostealers harvest everything from an infected machine: every saved browser password, every active session token, every stored credential. A compromised gaming machine is frequently a compromised enterprise access point.

The same Discord servers trading gamer credentials are trading enterprise combolists. The same C2 infrastructure being used to control gaming-targeted malware is being deployed against financial services firms. The overlap between gaming culture and cybercriminal culture, particularly among younger threat actors, means these ecosystems are deeply intertwined, not parallel.

---

DarkOwl monitors dark web forums, Telegram channels, Discord servers, and paste sites continuously — surfacing gaming platform credentials, session tokens, and threat actor activity relevant to your organization’s exposure. Get in touch to learn more about our darknet intelligence capabilities.

July 01, 2026

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. French govt messaging service breached in account hijacking attack – Bleeping Computer

France’s digital affairs directorate (DINUM) disclosed a breach of Tchap, the French government’s encrypted messaging platform, after attackers gained access through a compromised user account. The incident was detected by ANSSI on Sunday, and authorities have notified the CNIL due to potential exposure of personal data. A threat actor claimed the breach resulted from a social engineering attack, alleging they obtained leaked LDAP credentials and exfiltrated over 13.5GB of documents and media files shared by government employees. While DINUM has not confirmed these claims, it has alerted all Tchap users and reminded them that public chat rooms are not encrypted. Read full article.

2. FBI Warns of Phishing-as-a-Service Platform Compromising Microsoft 365 – ic3

The FBI has issued a warning about Kali365, a phishing-as-a-service (PHaaS) platform used to compromise Microsoft 365 accounts. The platform leverages device code phishing techniques, exploiting OAuth device code authentication to steal session tokens and circumvent multi-factor authentication (MFA). This authentication method lets devices with limited input capabilities such as smart TVs, conference room systems, streaming devices, printers, and IoT devices to sign in using a short code on another device through Microsoft’s device code login portal. Beginning in April, the platform was distributed via Telegram channels for cybercriminals looking for an easier way to compromise Microsoft 365.

3. Silent Ransom Group targets law firms with fake IT support calls – Bleeping Computer

The Silent Ransom Group (SRG) is actively targeting law firms through sophisticated social engineering campaigns. Threat actors typically impersonate IT support personnel via phone calls and phishing emails to gain access to victim systems. Once trust is established, they use legitimate remote access tools to infiltrate networks and exfiltrate sensitive data. In some cases, SRG has reportedly gone a step further by sending individuals to a victim organization’s office to obtain physical access to computers. This activity follows an FBI FLASH advisory issued last week warning that SRG was targeting U.S. law firms through social engineering schemes and in-person data theft operations. Mandiant has released additional technical details describing the group’s intrusion methods. According to Mandiant, SRG targeted dozens of organizations across the legal, financial, and professional services sectors between January and May 2026. Read more here.

4. Spain arrests doxer leaking sensitive data of govt employees – Bleeping Computer

On May 27, the Spanish National Police arrested the individual behind data leaks that published information from the State Attorney General’s Office, National Cybersecurity Institute (INCIBE), the National Police, the Civil Guard, and the National Security Council. In February the INCIBE announced an ongoing doxing operation that targeted collection and publication of data impacting key entities and their employees. Potential sources of this information include historical data breaches, credential dumps, and OSINT tools. The data may have been aggregated and correlated from multiple sources to create curated datasets. Some leaked records reportedly contained outdated information, including the names of individuals who had left INCIBE several years earlier. Read here.

6. FBI warns of in-person data theft attacks from extortion gang – Bleeping Computer

In a recent FBI flash alert, the agency warned that the Silent Ransom Group (SRG) has been targeting U.S.-based law firms through in-person data theft operations. Reports claim that SRG actors employ social engineering tactics by impersonating members of a victim organization’s IT department. These actors either place direct phone calls or send phishing emails instructing employees to contact a fraudulent IT support representative. During the interaction, the SRG actor persuades the employee to grant access through a remote desktop session. If remote access attempts are unsuccessful, SRG may dispatch an individual to the victim’s physical location to obtain direct access and insert a storage device into the victim’s computer. Read full article.

7. China-linked JDY botnet expands targeting of U.S. military networks – Bleeping Computer

The JDY botnet, previously linked to Chinese threat actors such as Volt Typhoon, has significantly expanded its targeting and reconnaissance activities. Researchers at Black Lotus Labs report that JDY remains heavily focused on the United States, particularly military and related networks. The botnet has grown from about 650 active bots in January 2024 to more than 1,500 compromised SOHO and IoT devices today. Analysis of the activity indicates that China-nexus APT actors rapidly operationalize reconnaissance efforts following public vulnerability disclosures, focusing on identifying and targeting vulnerable infrastructure. This activity has been observed across multiple sectors, with U.S. military networks and affiliated organizations representing a primary area of interest. Read full article.

8. Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT – The Hacker News

The Pakistan-aligned threat group SideCopy is believed to be behind a spear-phishing campaign, called Operation XENOFISCAL, targeting Afghanistan’s Ministry of Finance and other government entities. The attack uses a malicious Windows Shortcut (LNK) file that launches “mshta.exe” to retrieve a remote HTA file from a compromised Afghan education website. This file executes obfuscated JavaScript in memory, establishes persistence by impersonating Microsoft Edge through Registry modifications, and deploys Xeno RAT 1.8.7 using a DLL-based loader. A decoy document is also displayed to distract victims. Additional targets include provincial revenue and finance directorates, Pashto-speaking government officials, and other provincial government employees. Learn more.

---

Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.

June 25, 2026

ISS World Europe is one of the biggest dates in the calendar for intelligence agencies and technology vendors. Widely considered the largest of the ISS World Series conferences, which are held elsewhere during the remainder of the year, DarkOwl was busy (re)connecting with customers old and new – from exhibitors to guests.

In what was DarkOwl’s 10^th year exhibiting and speaking at the event, a booth team of 4 DarkOwlers were on hand at the 2026 edition. For three days the team explained DarkOwl’s role in OSINT workflows, demoing a new structured marketplace feature, collecting product feedback, meeting customers and holding a DarkOwl Vision platform workshop for police officers.

Figure 1: DarkOwl Team talking to ISS World attendees

ISS World Europe – held in Prague – is the world’s largest gathering of regional Law Enforcement, Intelligence and Homeland Security analysts, Telecoms, Financial (and Cyber) Crime investigators and electronic surveillance professionals.

Real estate in the exhibitor halls proved to be at a premium, with many exhibitors filling dead space in corridors, entrances and even service areas to meet this year’s unprecedented demand.

In addition to enabling public-private partnerships in the exhibition halls, ISS World runs exclusive workshops for law enforcement guests. DarkOwl is a regular fixture. DarkOwl held a workshop to educate law enforcement and government analysts managing intelligence and investigations in the digital realm. We spoke about the DarkOwl Vision practitioner journey: from using our technology to accelerate criminal investigations, to educating our practitioners about navigating internal procurement for darknet monitoring tools.

Figure 2: A photo of DarkOwl’s ISS Workshop this year

A notable theme from the conference included the application of agentic AI to investigative workflows. Also, lawful interception in the age of encryption and privacy configuration.

The challenge of harnessing OSINT at-scale was another topic. As OSINT becomes relevant across all intelligence disciplines, there’s a choice to be made: Do we upskill the general population of analysts with OSINT tradecraft, or focus on fusion cells and labs to concentrate OSINT expertise in government?

Overall, whether it was listening and learning from the 15+ exhibitors that are already using DarkOwl, to the young LEA analysts from various EU police forces seeking to do so, ISS World Europe was a reminder of why it’s one of our favorite shows.

---

Interested in meeting DarkOwl? See where we will be in-person and virtually and request some time! We would love to meet up.

June 23, 2026

Your files are locked. A countdown timer is ticking. And someone you’ve never met is demanding $2 million in Bitcoin before the clock hits zero.

For thousands of organizations every year, this isn’t a hypothetical; it’s Tuesday morning. And in that moment, the instinct is to panic, pay, and pray. But the organizations that come out ahead aren’t the ones who act the fastest. They’re the ones who act the smartest.

Ransomware negotiation has quietly evolved into a professional discipline, complete with its own playbook, psychology, and practitioners. What looks like a hostage situation is actually a business transaction — one with leverage points, bluffs, and countermoves that most victims never think of using. By employing the right negotiation strategies, organizations may be able to protect critical data, reduce operational disruption, and minimize reputational damage.

Law Enforcement’s Stance

While paying the ransomware may be the individuals first thought, the FBI strongly suggests not paying a ransom in response to an attack. Their reasoning states three separate factors: 

1. No guarantees: Paying does not ensure your network or encrypted files will be successfully restored.
2. Encourages more crime: Submitting to demands funds the perpetrators and incentivizes them to target you and others again.
3. Operational funding: Ransomware payments provide capital for threat actors to grow their criminal enterprises. 

The U.S. Joint Ransomware Task Force (JRTF), co-chaired by the FBI and CISA, represents a coordinated national effort to combat the growing threat of ransomware attacks. The task force brings together government agencies and private sector partners to improve information sharing, strengthen operational coordination, and streamline the federal response to ransomware incidents. Through joint investigations, threat disruption operations, and the development of cybersecurity best practices, the JRTF plays a critical role in helping organizations prevent, respond to, and recover from ransomware attacks. Its creation marks a significant step toward a more unified and proactive approach to defending against evolving cyber threats.

However, some victims do choose to pay.

Tactics

If your organization has decided to engage in negotiations with the threat actors, several steps should be taken before and during communications to help ensure the situation is managed as effectively and efficiently as possible. The following are recommended tactics and considerations for organizations that choose to pursue negotiations with threat actors.

Before Contacting the Threat Actor

1. Gather Professional Assistance/a Team: Ransomware response requires coordinated decision-making across security, legal, business continuity, and executive leadership teams, with incident response leads managing containment, forensic analysis, regulatory obligations, and communications. Organizations should never respond to ransomware incidents alone; instead, they should engage cybersecurity experts, CERTs, ransomware recovery specialists, cyber insurance providers, and law enforcement to ensure a structured, legally compliant, and effective response. All communication with attackers should be centralized through a single authorized point of contact, while critical decisions such as ransom payment approval and business continuity actions remain restricted to C-level leadership.
   
2. Begin Forensic Analysis: Forensic analysis should determine the extent of both encryption and potential data exfiltration by examining network logs, endpoint detection telemetry, and threat intelligence related to the ransomware variant involved. Incident response teams should confirm whether exfiltration occurred, identify the affected systems, and assess the types of data that may have been compromised, while preserving evidence for legal and regulatory requirements. Understanding the tactics of the ransomware group, such as RansomHub, can help predict the likelihood and timing of data exposure. 
   
3. Monitor Leak Sites and Extortion Channels Early: Organizations should begin monitoring leak sites and underground channels as soon as there are indications that data may have been stolen. Threat actors increasingly use dedicated leak platforms to apply pressure, damage reputations, and create urgency around payment demands. Monitoring should extend beyond the organization’s primary name to include subsidiaries, brands, executive names, and other identifiable assets. Early visibility into leak activity can help organizations understand the threat actor’s tactics, anticipate public disclosures, and prepare appropriate communications responses.
   
   Many ransomware groups release small samples of allegedly stolen data before publishing larger datasets. Tracking these developments in real time allows organizations to validate claims, assess potential business impact, and make informed decisions without relying solely on information provided by the attacker.

After Initial Contact

1. Establish Controlled Communication: Centralizing communication prevents mixed messages, unauthorized concessions, and tactical mistakes that can weaken the organization’s position. It also ensures that discussions remain consistent and aligned with legal, operational, and business objectives. The initial response typically acknowledges receipt of the ransom demand while requesting additional time for internal review and executive decision-making. Every interaction should be carefully documented to support legal, regulatory, insurance, and post-incident reporting requirements.
   
2. Buy Time and Manage Expectations: Time is one of the most valuable assets during a ransomware incident. Every additional hour allows incident responders to collect forensic evidence, IT teams to validate backup and recovery options, legal teams to conduct sanctions screening, and leadership to evaluate potential courses of action.
   
   Experienced negotiators use legitimate business processes to slow the pace of discussions. Requests for additional approvals, verification of impacted assets, or assessments of operational impact can all create valuable breathing room. Negotiations may pause and resume multiple times as new information emerges, and recovery efforts progress. At the same time, negotiators can begin shaping expectations around what the organization can realistically pay by referencing constraints such as insurance coverage limits, financial approval requirements, or board-authorized spending thresholds.
   
3. Keep Record of all Correspondence: If ransom negotiations are pursued, maintain detailed records of all communications and payment instructions to support law enforcement and investigative efforts. Additionally, request that the attackers demonstrate the validity of the decryption key by successfully decrypting several randomly selected files.

Real Life Examples 

Instructure (2025) – On May 01, 2026, the threat actor group, ShinyHunters, revealed on their data leak site that they had allegedly breached the education technology company Instructure, a cloud-based education technology company best known for its Canvas learning management system, which schools and universities use to manage coursework, assignments, grading, and communication. The group had claimed to have stolen 280 million records connected to students and staff from over 8K colleges, school districts, and online education platforms. Using Canvas data export feature ShinyHunters was able to harvest “hundreds of gigabytes of user records, messages, and enrollment data”. According to the data leak site, ShinyHunters extended their deadline until May 12, claiming some of the affected institutions were engaging with the group.

In a statement on May 11, Instructure, announced they had reached an “agreement” with ShinyHunters to prevent recently breached data from being leaked. The company also disclosed that ShinyHunters had returned the stolen data and provided proof of destruction. ShinyHunters removed the warning from their leak site and posted a press statement saying they had no comment and all data had been destroyed. The FBI has warned against paying ransoms, noting that doing so does not guarantee threat actors will refrain from selling stolen data. However, the company said it acted in what it believed was the best interest of its “community”.

On May 12, the U.S. House Committee on Homeland Security requested Instructure executives to testify on the two cyberattacks by ShinyHunters on the company. The Homeland Security Committee said the repeated breaches raise “serious questions” about Instructure’s incident response practices and its ability to safeguard the data in its possession. The committee asked Instructure to participate in a briefing by May 21 to address both incidents, including the scope of the compromised data, containment and notification measures, and the company’s coordination with federal agencies.

CWT Global (2020) – In July 2020, the ransomware group Ragnar Locker infiltrated U.S. travel management company, CWT’s network, shutting down more than 30,000 computers and exfiltrating sensitive corporate data. After the attack, the threat actors demanded a $10 million ransom in exchange for a promise not to publicly release the stolen information. To demonstrate the credibility of their threat, Ragnar Locker directed CWT to a password-protected press release hosted on a hidden section of the group’s website, detailing the impending data leak.

Facing significant financial challenges caused by the COVID-19 pandemic, CWT reportedly negotiated the ransom demand down to $4.5 million. The payment was ultimately made in Bitcoin, after which Ragnar Locker claimed to honor its agreement by deleting the stolen data. The group provided CWT with credentials to access a cloud storage repository containing the exfiltrated files and removed the prepared leak announcement from its website.

In an unusual ending to the incident, Ragnar Locker also shared recommendations for improving cybersecurity defenses. Among their suggestions were stronger internal security policies and employee awareness measures, arguing that antivirus software alone is often insufficient to prevent sophisticated ransomware attacks.

University of California San Francisco (2020) – In June 2020, the University of California, San Francisco (UCSF) became the victim of a significant ransomware incident when cybercriminals encrypted critical servers and data belonging to the institution. The attack was carried out by operators of the NetWalker ransomware, a notorious malware strain responsible for numerous high-profile extortion campaigns. Although UCSF’s School of Medicine was heavily involved in leading COVID-19 antibody testing research at the time, university officials stated that the attack was not specifically directed at the institution.

After gaining access to UCSF’s network, the attackers encrypted important files and demanded a substantial ransom for their release. Ultimately, the university agreed to pay more than $1 million to the cybercriminals in exchange for a decryption key and assurances that copies of the stolen data would be returned or destroyed.

According to university officials, the payment enabled the restoration of access to critical files and systems. While UCSF declined to disclose the exact nature of the data involved, it emphasized that there was no evidence suggesting that patient medical records had been compromised during the incident.

Conclusion

While negotiating with ransomware attackers may appear to be the quickest path to recovery, organizations should approach that decision with extreme caution. Paying a ransom can fund future criminal operations, incentivize additional attacks, and potentially mark an organization as a willing target for future extortion attempts.

Perhaps most importantly, payment offers no certainty. Threat actors may fail to provide a working decryption key, demand additional payments, or retain stolen data despite receiving the ransom. As a result, ransomware negotiation should never be viewed as a guaranteed solution.

The most effective defense against ransomware remains preparation: maintaining secure backups, implementing strong cybersecurity controls, developing a tested incident response plan, and engaging experienced legal, cybersecurity, and negotiation professionals when an attack occurs. By focusing on resilience rather than reaction, organizations can reduce the impact of ransomware incidents and make informed decisions that align with both their operational needs and long-term security objectives.

---

Learn how DarkOwl can help. Contact us.