February 02, 2026

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. ‘Bad actor’ hijacks Apex Legends characters in live matches – BleepingComputer

Over the weekend of January 09, players in Apex Legends, a battle royale shooter game, reported game disruptions caused by threat actors hijacking characters, disconnecting users, and changing nicknames. Respawn, the publisher of the game, confirmed the security incident claiming “bad actor is able to control the inputs of another player remotely in Apex Legends”. The company does not believe threat actors were able to exploit or infect malware, nor execute code. Read full article.

2. 27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials – The Hacker News

On December 23, 2025 the Socket Threat Research Team announced the discovery of a 5 month long spear-phishing operation that turned 27 npm packages “into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in”. The campaign targeted 25 organizations across the U.S. and Allied nations focusing on manufacturing, industrial automation, plastics, and healthcare. Specializing in focusing on sales and commercial personnel, the operation repurposed npm and package CDN’s “into durable hosting infrastructure, delivering client-side HTML and JavaScript lures that the threat actor embeds directly in phishing pages.” Following initial interaction, the script redirects the browser to threat-actor controlled infrastructure. Article here.

3. Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading – The Hacker News

ReliaQuest’s Threat Research team has discovered a new phishing campaign using private messages to deliver malicious payloads with the intent to deploy remote access trojan (RAT). The attack began with a message sent via LinkedIn that contained a “malicious WinRAR self-extracting archive”. Once opened, the archive extracts four components, mainly a PDF disguised with names that align with the victim’s industry. The final payload attempts to communicate with an external server that can grant persistent remote access. Read more here.

4. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware – The Hacker News

Recent activity shows Chinese threat actor, Silver Fox, has begun using income tax themed lures to distribute ValleyRAT. The group has focused on Indian entities, using phishing emails containing decoy PDFs claiming to be from India’s Income Tax Department. Opening the attachment leads victims to download files that injects ValleyRAT into the system and communicates with external servers. Read here.

6. North Korea-Linked Hackers Target Developers via Malicious VS Code Projects – The Hacker News

The Contagious Interview campaign, which has been linked to North Korean threat actors, has been observed leveraging a version of Microsoft Visual Studio Code (VS Code) to deploy a backdoor on compromised systems. First discovered in December 2025, the attack involves instructing targets to clone a repository “on GitHub, GitLab, or Bitbucket, and launch the project in VS Code as part of a supposed job assessment.” The overall goal is for payload to run every time a file in the folder is opened, which eventually leads to deployment of malwares like, BeaverTail and InvisibleFerret. Read full article.

7. Hackers claim to hack Resecurity, firm says it was a honeypot – BleepingComputer

Scattered Lapsus$ Hunters (SLH) announced via Telegram that they had breached systems belonging to Resecurity and stole internal data. To prove their claims SLH posted screenshots of the data which revealed communications between employees and Pastebin personnel. Resecurity published a report in December 2025 disputing the claims and stated after identifying threat actor probing activity in November 2025, they deployed a “honeypot” account. The account was in an isolated environment that contained fake information and was being monitored. Read full article.

8. China-linked hackers exploited Sitecore zero-day for initial access – BleepingComputer

The China-linked threat actor UAT-8837 has been observed attempting to compromise North American infrastructure by exploiting both known and zero-day vulnerabilities. The attacks begin with leveraging compromised credentials or by exploiting server vulnerabilities. Recent attacks include zero-day flaw in Sitecore products, CVE-2025-53690. Researchers claim UAT-8837 uses “open-source and living-off-the-land utilities, continually cycling variants to evade detection.” Learn more.

---

Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.

January 29, 2026

Figure 1 – RAMP4U.io seizure notice

Introduction

On 28 January 2026 a seizure notice appeared on the notorious darknet forum RAMP4U. The notice stated the FBI had seized the site. Both the clear net and onion domains showed this notice.

RAMP4U

In July 2021, Russian-speaking threat actors on the darknet forums XSS and exploit.in began advertising a new ‘ransomware’ specific discussion forum called RAMP. This appeared to be in response to XSS and Exploit banning the advertising of ransomware on their respective sites. RAMP was advertised to be a ‘safe space’ where ransomware-related discussions and coordination could freely and openly be discussed.   

Figure 2 – Post on XSS banning the advertising of ransomware

DarkOwl assess that RAMP originated with members or affiliates of the Babuk ransomware gang. Babuk launched their operation in January 2021 and quickly received notoriety for their cyber campaigns. In early April 2021, the group successfully compromised and allegedly exfiltrated over 250GB of sensitive data from the Washington, DC Metropolitan Police.

Figure 3 – Historic view of RAMP4u forum

Seizure

While the FBI are yet to make a formal statement in relation to the seizure of RAMP4U, the domains now point to domain servers which are used by the FBI when seizing infrastructure.

Figure 4 – NS look up

Furthermore, the alleged administrator of RAMP4U appeared to confirm the seizure on a post via XSS.

Figure 5 – DarkOwl Vision post on XSS confirming seizure of RAMP4U

This current activity highlights a continued trend in Law Enforcement seizure of darknet forums, with BreachForums and XSS being notable takedowns in the last 6 months. However, it remains to be seen the effect that this will have, where will the users of RAMP4U move to and or will the site reappear under a new guise. Time will tell.

---

Make sure to register for our weekly newsletter to get the latest updates.

January 29, 2026

Every January, organizations roll out security initiatives, refresh slide decks, and announce new tools. This happens every year because breaches continue to happen every year. More often than not through the same well-known traps.

The uncomfortable truth is that most cyber incidents aren’t caused by a lack of technology or understanding of said technology. They are caused by inconsistent or poor habits.

As we head further into 2026, the most effective cybersecurity resolution isn’t by signing up for or buying another platform, it is institutionalizing repeatable behaviors that reduce risks every day.

Below are five cyber habits that can combat how attackers operate today.

Habit 1: Threat Identity as the Primary Security Perimeter

The network perimeter is gone. The device perimeter is shrinking. Making ‘Identity’ what attackers target first. Credential theft.

Credential theft through infostealers, phishing kits, MFA fatigue, and token hijacking remains the fastest path to initial access. If identity controls fail, everything else becomes irrelevant. A safer 2026 begins by treating authentication as critical infrastructure rather than a convenience feature.

That shift means moving beyond basic MFA (multifactor authentication) toward phishing-resistant options such as FIDO2 keys, WebAuthn, and passkeys, particularly for privileged and external-facing accounts. It requires eliminating shared credentials and reducing service account sprawl that quietly accumulates over time. OAuth grants and long-lived tokens must be reviewed regularly, as attackers increasingly rely on them for persistence that survives passwords resets. Most importantly, authentication monitoring needs a focus on behavioral anomalies rather than simple success failure.

Attackers don’t need to waste their time with malware if they can use your credentials to log in. Make authentication harder to abuse than to bypass.

Habit 2: Assume Logs are Evidence, Not Telemetry

Most organizations have gotten the memo to collect logs, however, few treat them like the forensic evidence they are.

When an incident occurs, defenders often discover too late that critical data has already been overwritten, was never retained, or lacks the context required to reconstruct attacker activity. These gaps don’t just slow investigations, they make accurate timelines impossible.

A mature security habit is logging with intent. That means deliberately retaining the artifacts you may need, because if you can’t quickly answer What happened first?, attackers already have the advantage.

At a minimum, that includes:

• Identity and authentication logs retained long enough to reconstruct timelines
• Endpoint telemetry with process linage and command execution context
• DNS, proxy, and network logs that reveal how systems communicate
• Cloud control plane and audit logs that are enabled to centrally stored
• Normalized timestamps and identity fields across all sources

Without this foundation, even well-detected incidents turn into partial stories rather than defensible investigations.

Habit 3: Patch What Attackers Actually Exploit

Not all vulnerabilities are equal, and attackers know it… even if organizations don’t.

While many organizations still prioritize patching based on severity scores alone, real-world threat actors focus on systems that provide leverage and persistence. Edge devices, exposed management interfaces, and internet-facing services continue to dominate initial access pathways, particularly when public proof-of-concept exploits accelerated attacker timelines.

A safter approach isn’t patching everything immediately but patching the right things first. Perimeter and identity infrastructure should be treated as endgame assets, with exploit availability and evidence of active abuse prioritized over theoretical risk. In some cases, the most effective remediation is not another compensating control, but the removal of legacy services altogether. Attackers move faster than patch cycles, and defensive prioritization must reflect that reality.

Habit 4: Reduce Signal-to-Noise Before an Incident

Burned-out analysts miss early warning signs just as overloaded detection systems bury real threats.

Many security programs accumulate alerts and tools without revisiting whether those signals still provide value. Over time, if everything becomes high priority then genuine threats blend into the background noise.

Operational discipline is a security habit, in its own right. Alerts should map cleanly to response actions, detections should be tuned to the environment they protect, and enrichment should be automated, so analysts spend their time making decisions rather than gathering context. Security teams rarely fail because they lack data, they fail because they cannot prioritize data effectively under pressure.

Habit 5: Practice the Boring Parts of Incident Response

Many incident response plans look excellent on paper but collapse like a house of cards under real-world pressure.

Teams often understand what they are supposed to do, but they don’t always understand who is supposed to do it, how to quickly make decisions, or what authority is required to act. Organizations that recover faster teat response as a practiced skill, not a “theoretical” exercise.

That practice includes realistic tabletop exercises, rehearsing difficult trade-offs between containment and continuity, and pre-approving actions that would otherwise stall response efforts while leadership is looped in. Clear escalation paths outside normal business hours matter just as much as technical controls. When something goes wrong, muscle memory matters more than documentation.

The Takeaway

Cybersecurity resolutions in 2026 won’t be met by throwing around buzzwords or buying new tools. Resolutions will be met by organizations that turn good security theory into daily practices.

Identity-first controls, intentional logging, threat-informed patching, operational clarity, and practiced responses aren’t flashy. However, they are effective.

Make these five habits your new year’s resolution and keep them long after January fades into a distant memory.

---

Follow us on LinkedIn for all our tips, tricks and research.

January 27, 2026

As we enter 2026, the story of cyber risk continues to evolve. At the same time, there are consistencies we have seen growing for some time. Attackers don’t need unique or specialized skills anymore – the world of hacking is much more accessible, especially when they [threat actors] can log in like you or convince you to log in on their behalf. Automation is making that easier, faster, and cheaper than ever, especially with the development of AI.

Here we explore some of the cyber security and crime trends that look most defining for 2026, based on what major incident and law-enforcement reporting has been showing through 2024–2025.

Identity is the “New” Perimeter

Identity-based attacks have been on the rise for some time, and we expect this to continue throughout 2026. These types of attacks remain one of the primary paths attackers take to compromise corporate networks. This is due to the fact that credential information is readily available on the dark web, and it remains one of the simplest ways to gain access, not requiring specialized hacking skills. Therefore, expect 2026 to be the year more organizations stop treating identity as a feature of IT and start treating it as a core security control.

Verizon’s 2025 DBIR notes that Basic Web Application Attacks commonly involve stolen credentials, and credential abuse remains a dominant initial access method across multiple attack patterns.

Because of this, you should expect to see more phishing-resistant authentication being implemented across systems as well as continuous verification.

Social Engineering

Threat actors don’t only have the ability to steal credentials; they can also coerce them from unwitting employees through social engineering. A common target in 2025 was to trick the help desk into resetting MFA and it is expected this will continue into 2026.

With the continued development of AI, it is likely that social engineering attacks will improve with the ability to create deepfakes to fool people into believing they are providing a legitimate person access. DarkOwl analysts started exploring this trend in 2024 here.

Infostealers Keep Feeding the Credential Economy

Infostealer malware isn’t new but in the last year they have appeared to be more widespread and relied upon to conduct real-world intrusions.

Mandiant highlights infostealers as an ongoing pipeline for initial access, where stolen creds from “logs” enable follow-on compromises that end in data theft and extortion.

In 2026 we expect more stealer log compromises that start outside the enterprise – meaning employee personal devices, unmanaged browsers, and reused passwords. As well as the use of stolen cookies/tokens, not just passwords.

As Telegram continues to be a source for both free and paid stealer log subscriptions, they remain relatively easy for threat actors to access, again lowering the threshold for the sophistication that actors need to have to gain access to systems.

Ransomware Keeps Evolving into “Extortion-as-a-Service”

Ransomware has been around for a long time, and it doesn’t show any signs of slowing down as we head into 2026. However, it has developed over the years with ransomware groups operating like mature businesses with specializations, supply chains, affiliate programs, PR, and negotiation playbooks.

In addition, their techniques have also developed, although we commonly refer to these attacks and groups as ransomware, data theft is common, and data theft extortion events where no ransomware is deployed are becoming increasingly common.

In 2026 we expect more “no-encryption” extortion attacks where actors steal data, threaten to leak on a dark web site and do so if the extortion payment is not paid – without ever encrypting the data.

AI

In 2026, AI isn’t just “writing better phishing emails” – it’s enabling highly targeted, multilingual scams at scale, voice cloning for “CEO fraud” and synthetic identities, and deepfake-driven coercion.

European law enforcement has been explicit that AI is accelerating organized crime and enabling impersonation and scalable fraud. ENISA’s 2025 Threat Landscape also notes criminal abuse around AI tooling, including fraudulent AI tool sites used to deliver malware and concerns about AI supply chain risks.

Generative AI will also make it cheap to produce high quality lures for cyberattacks, and it can do this at scale meaning that threat actors can use AI to industrialize phishing attacks as well as other methods of attack.

As highlighted above, social engineering is an attack vector which is likely to increase in 2026, and AI will be at the forefront of enabling that growth. AI-assisted social engineering will include voice cloning for “urgent CFO calls,” fake candidates in hiring funnels, vendor payment diversion among many other techniques – some probably not yet thought of.

However, AI can and will also be a useful tool in defending against threat actors. AI can be used to automate and triage vulnerabilities and risk indicators for faster detection and investigation.

Online Fraud Keeps Growing

Cybercrime isn’t only “breaches.” In raw victim impact, fraud dominates, and it’s increasingly industrialized. The FBI’s Internet Crime Report for 2024 reported record losses and flagged investment fraud, often crypto-related, as a major driver of dollar losses. This is likely to continue to rise.

Dark web marketplaces continue to be a hot bed of activity when it comes to financial crime, with credit cards, bank account information, and access to payment apps being traded routinely.

Geopolitics, Hacktivism, and Disruption Campaigns Stay Loud

Since the invasion of Ukraine by Russia in 2022, hacktivist groups have been particularly vocal and active. This only grew after the October 7 attacks in Israel. The groups primarily conduct DDOS (distributed denial of service) attacks but have also conducted many defacement attacks and in recent times have been more likely to leak data and dox individuals.

This threat is not likely to diminish in 2026, with geopolitics continuing to remain strained throughout the world. It is likely that more groups will emerge in response to real world events and political affiliations.

Conclusion

Many of the cybercrime and cyber security trends of 2025 will continue into 2026, but it is likely to become more difficult to keep up with the speed and scale of attacks due to the use of AI.

It is important for organizations and individuals to remain vigilant and ensure that they are using appropriate precautions to protect themselves.

---

Contact us to learn how we can help.

January 20, 2026

The Start

Scattered Lapsus$ Hunters, is reported to be a hybrid threat actor group forged from three separate groups, who collectively emerged onto the scene in 2025 and quickly made their mark on the cybersecurity world. Announcing their existence following ShinyHunters alleged social engineering campaign that purportedly resulted in the theft of 1.5 billion Salesforce records, the group consists of threat actors from ShinyHunters, Scattered Spider, and Lapsus$ extortion members.

The three factions were all heavily active in 2024, resulting in a series of arrests of members of the group Scattered Spider in 2024. The group remerged in April 2025 with an attack on UK retailers Marks and Spencer. Due to the significant attacks carried out by the individual groups in recent years, the convergence of their members has introduced even greater chaos into an already volatile landscape.

Salesforce October Deadline

On October 03, 2025,Scattered Lapsus$ Hunters launched a data leak site extorting 39 companies that were impacted by the Salesforce breaches. The companies extorted in the link include Disney/Hulu, FedEx, Google, McDonald’s and more. A separate entry on the site requested that Salesforce pay a ransom to prevent impacted customers (approximately 1 billion records containing personal information) from being released. The group set an October 10 deadline for Salesforce to pay the ransom, or for potentially affected companies to contact the group to secure their data. Salesforce refused to negotiate with the threat actors, believing their threats were unsubstantiated and offered support to any of their affected clients.

While the group had threatened to release all information if their demands were not met, eventually they only leaked data from six companies. The victims included Albertsons, Engie Resources, Fujifilm, Gap, Qantas, and Vietnam Airlines. Qantas and Vietnam Airlines each had more than five million customer records exposed. The group later announced on its Telegram channel that it would not release any additional information until 2026, stating that it was unable to leak further data, though no specific reason was provided. The limited amount of victim information leaked during the October extortion attack led some individuals to question the extent of the data the group possesses. This behavior appears to indicate the group believes it can still extract a substantial payment from Salesforce or the affected individuals.

Following the partial leak, Scattered Lapsus$ Hunters posted a Telegram announcement threatening the remaining victims and Salesforce. The statement urged Salesforce to “put down your pride/ego” or their next campaign will be more “destructive” and they have the time and resources to ensure this fate. They warn against policies that mirror Australia’s “Cyber Security Act of 2024” which introduced mandatory reporting of ransomware and cyber extortion payments, as well as strongly discouraging complying with threat actors demanding ransom.  The group identified themselves as businesspeople and rejected the label of terrorists or attackers.

The post was signed “We will never stop, see you all in 2026” indicating the group will return with further activity in the new year.

Forecast

In November 2025, the group announced the development of a Ransomware-as-a-Service (RaaS) platform named, ShinySp1d3r. On a Telegram channel used by the group, they claimed the ransomware was in development and will be led by ShinyHunters but operated under the “Scattered Lapsus$ Hunters” brand. Previously, these threat actors have used ransomware encryptors such as Qilin, RansomHub, and DragonForce. Victims of ShinySp1d3r will receive a note that they have “three days to begin negotiations before the attack is made public on the data leak site”.

Samples of the ransomware have been uploaded to VirusTotal and show a mix of common features and new features developed by the group. The encrypted files will contain “information on what happened to a victim’s files, how to negotiate the ransom, and a TOX address for communications”.

ShinyHunters claims that organizations in the healthcare sector, including pharmaceutical companies, hospitals, clinics, and insurance providers, are excluded from being targeted by its encryptor. However, researchers report that many groups have made similar assurances in the past, only for those self-imposed restrictions to be routinely ignored or violated.

Conclusion

Scattered Lapsus$ Hunters are expected to remain active this year, leveraging both new and familiar tactics to cause disruption across the cyber landscape. The combination of the three groups demonstrates the shift for cybercriminal branding, appearing to highlight credibility and visibility. Given their broad range of targets, effective information sharing between organizations will be critical to countering this threat actor. To mitigate the risks posed by Scattered Lapsus$ Hunters and similar groups, organizations must prioritize monitoring these dark web activities.

---

To ensure your organization is taking the necessary steps to mitigate threats from these groups, contact us.

XSS, BreachForums, and the Age of Exit Scams

January 15, 2026

If you watched the dark web ecosystem in 2025, like DarkOwl does, you may have noticed that it seemed very unstable. While the dark web is notorious for being unstable with onion sites often going up and down, this year felt different – with more permanent changes to mature and established sites and a seemingly revolving door of admins.

Long-running drug markets vanished overnight in coordinated international operations. Fraud and hacking forums were seized and marked with law enforcement seals. Others simply went dark in classic exit scams, taking millions in crypto with them.

The most notable sites to be impacted this year were XSS – a long-standing Russian-language hub for exploits, access, and ransomware affiliates and BreachForums – the English-language epicenter of data breach leaks and credential trading, which has been subject to changes over many years but always seems to come back.

But they were only part of a much larger story that included major markets like Archetyp and Abacus, plus “shadow markets” on platforms like Telegram.

As 2026 begins, we wanted to delve into what happened in 2025: XSS, the ongoing BreachForums saga as well as review some of the major marketplace hits and exit scams, how exit scams and takedowns reshape trust in the underground and what all of this means for defenders and analysts.

XSS

For years, XSS (formerly DaMaGeLaB) was one of the most influential Russian-language cybercrime forums. It served as a marketplace for exploits, stolen access, and malware as well as a recruiting ground for ransomware crews. A well-established site, it fostered a high-trust environment among its users, who were able to trade tools and services. The site had been operating since 2013 and was estimated to have over 50,000 registered users.

However, in mid-2025, the XSS era effectively ended. Law enforcement agencies in France and Ukraine, supported by Europol, targeted XSS after a multi-year investigation which began in 2021. This led to the arrest of a 38-year-old suspect alleged to be the main XSS administrator in Kyiv. Shortly after, the XSS domain displayed a classic law enforcement seizure banner, signaling that authorities had taken control of infrastructure and likely obtained access to backend data and communications. This marked a change for law enforcement who have typically targeted English-speaking sites on the dark web with Russian sites usually being more difficult to infiltrate.

Figure 1: XSS Seizure Notice

For a forum that catered to serious actors, including affiliates of major ransomware groups, this was a significant blow. The value of the takedown wasn’t just the shutdown, but the potential intelligence gathered, thought to include database content, private messages, transaction details, and operational. It also initially appeared to leave a void of where these actors could interact and advertise.

However, as usual, the community did not vanish with the domain, which did reappear. Some members migrated to other Russian-language forums such as Exploit or RAMP. Exploit another well-established forum appeared to be the primary forum of choice. Others attempted to relaunch XSS under slightly different branding, trying to keep the reputation and user base intact. However, the registration for new users proved challenging, and many commentators online felt that XSS was now a honeypot run by law enforcement. It appeared that many in the community were reticent to continue using the updated site.

The net effect, XSS as a brand is fractured, but the underlying actors remain active and mobile on other forums. For cyber security analysts, the center of gravity moved, but the threat did not disappear. The game of wack-a-mole continues.

BreachForums

On the English-speaking side, BreachForums has been the high-profile home for many years, having launched around 2022 in the aftermath of the RaidForums seizure. The site was known primarily for selling and sharing data breach leaks, trades and giveaways of credential dumps as well as the discussion of hacks, access sales, and “clout” postings.

Since then, BreachForums has been stuck in a loop.

BreachForums v1 (breached / breached.vc, etc.) – launched after RaidForums was seized, was itself later taken offline after the arrest of its founder “Pompompurin” (Conor Fitzpatrick). Fitzpatrick was subsequently charged, and rumors swirled that the site was operating as a honeypot.

In September 2025, founder Conor Fitzpatrick was re-sentenced to a longer prison term after an appeals court deemed the original sentence too lenient. That move signaled that U.S. courts view BreachForums as a serious, high-impact cybercrime platform, not just a “kids swapping databases” site.

Subsequent versions of BreachForums followed the same pattern. New domains and infrastructure spun up (e.g., breachforums[.]st) quickly, claiming to be the successor and controlled by affiliates of previous versions. The community reconvened, often with familiar staff and leak actors (including groups like ShinyHunters). However, law enforcement seized infrastructure again, posting FBI banners on front-end domains and, in some cases, gaining access to backend data and user logs.

However, in 2025, a few milestones stood out as different to the pattern, and the activity appeared to occur much more rapidly than it had with previous iterations.

One BreachForums instance announced it was closing after operators claimed law enforcement had exploited a 0-day in MyBB (their forum software) to gain access. Whether this was accurate or an excuse, the result was the same: another dead forum, more scattered users. Yet another BreachForums-branded domain displayed an FBI seizure notice, underscoring that law enforcement was tracking the brand as much as the infrastructure.

Honeypot or Home?

Every new BreachForums revival faces the same dilemma, If it’s real, it’s a prime target. If it’s not real, it might be a honeypot or undercover operation. This creates a deep trust problem inside the community.

So, while BreachForums keeps coming back in some form, each iteration is more paranoid, more fragmented, and less trusted than the last. Because of that, similar to XSS we have seen the community seek other sites as refuge from the law enforcement action and fear of honeypots. In 2025, a clear front runner has been Dark Forums. However, this site has also already experienced changes in management as well as technical issues leading to downtime as well as changes in domains.

Seizures vs. Slow-Motion Exit Scams

Beyond forums, darknet marketplaces remain a central pillar of the underground economy, especially for drugs, fraud services, and stolen data. In 2025, they were hammered from both sides.

Archetyp Market

Archetyp Market was first seen in May 2020 and quickly became one of the largest drug markets operating. It specialized in the sale of drugs, including high risk substances such as fentanyl. The site required registration and accepted funds via the “privacy” cryptocurrency Monero. With over 600,000 users and 3,200 vendors, the market facilitated transactions involving cocaine, meth, MDMA, and other narcotics. By its final days, it had moved an estimated $250–290 million in illicit goods, making it a titan among darknet marketplaces.

From June 11–13, 2025, Operation Deep Sentinel, led by Germany’s BKA and supported by Europol, Eurojust, Homeland Security Investigation (HSI) and law enforcement from five other countries, executed a coordinated takedown. Servers were seized in the Netherlands, digital assets frozen, and the suspected site administrator, a 30-year-old German, was arrested in Barcelona. In addition, authorities confiscated millions in cryptocurrency, luxury vehicles, phones, and drugs in sweeping raids.

This followed a familiar pattern from earlier eras: Silk Road, AlphaBay, Hansa, Hydra. Each time, a flagship market becomes large and visible enough international law enforcement teams invest the time and resources to take it down.

Abacus Market

In contrast to Archetyp’s law enforcement takedown, Abacus Market appears to have chosen the exit-scam route. An exit scam occurs when the administrators of a site close it down and, in the process, steal funds that they are holding in escrow from their customers and vendors.

Abacus had, by many accounts, become one of the highest-earning Western darknet markets in 2025. Then the warning signs started; users began reporting withdrawal delays and stuck balances. At the time admins blamed technical problems, DDoS attacks (distributed denial of service attack), and onboarding chaos from refugees fleeing other shut-down markets.

However, over time, more evidence pointed to a classic rug pull: no seizure banner, no official statement—just vanished infrastructure and a lot of missing crypto.

By mid-2025, most analysts agreed Abacus had exit-scammed, likely taking a substantial share of user balances and escrowed payments with it.

Takedowns vs. Exit Scams

From the average user’s perspective, the result of both scenarios looks the same; one day the site works, the next day it doesn’t—and your coins are gone. However, the implications are very different.

In a Law enforcement takedown scenario. Agencies aim to identify operators, seize servers, and collect evidence. This means that you will often see official seizure banners on the site, indicating that it has been taken down and by who. Law enforcement wants the users of the site to know that they have acted and view it as a warning to others. Increasingly, law enforcement has accessed the registered users of these sites to warn them that they are participating in criminal activity to try and dissuade users from continuing this activity.

For participants, that means risk doesn’t end when the site goes down; it may only be starting. Data recovered in 2025 can fuel cases and investigations for many years.

In an exit scam, the admins’ primary objective is to take as much money as possible and disappear. Early warning signs can include:

• “Temporary” withdrawal freezes
• Sudden policy changes around escrow and wallet management
• Increasingly vague or aggressive communication from staff

Unlike with law enforcement action, there is no public banner and usually no immediate arrests—just silence.

Legally, the admin’s exposure doesn’t change much: they were already running an illegal market. But for users, the fallout is more about financial loss and fractured trust, rather than immediate deanonymization through seized databases.

In both cases though, the users of the sites will have to find a new home to conduct their illegal trades and communities.

Beyond Tor: Platform Crackdowns and Shadow Markets

While Tor-based marketplaces and forums grab headlines, 2025 also highlighted another front, shadow markets built on mainstream platforms. DarkOwl will often refer to these sites as dark web adjacent, as they are used by the same actors for illegal activity but don’t actually exist on the dark web technology.

A notable example was the crackdown of channels associated with the underground ecosystem on Telegram. After the arrest of Telegram’s CEO in late 2024, the platform began to increase its moderation of the app, actively banning and suspending channels which it alleged were breaking their terms and conditions. This was not solely focused on markets on Telegram but was wide ranging.

These bans have had an impact on the market side of telegram particularly fraud services, laundering, and illicit financial services which were run via channels and bots.

Telegram’s enforcement actions—including mass bans and account purges—disrupted what analysts described as a multi-billion-dollar illicit economy.

This illustrates a broader trend – crime is platform-agnostic. When Tor markets are unstable, actors move to, encrypted messaging apps (Telegram, Signal, Threema), private Discord servers and niche forums and invite-only groups or even surface web sites. As TOR becomes more unstable and more likely to be disrupted by law enforcement action many actors favor a simpler way of setting up their businesses.

For cyber security analysts, focusing solely on .onion sites risks missing a big slice of activity that’s happening on “regular” platforms. This is why DarkOwl monitors not just the dark web but also dark web adjacent sites.

Is the Dark Web Still Important?

Given all the takedowns and scams, is the dark web actually shrinking?

The short answer is no, not really. There is still a huge amount of criminal activity taking place on the dark web and it is important to track and monitor this activity to protect yourself and your organization and to combat crime. However, it is also important to acknowledge that the dark web is becoming more fragmented, less stable, and much harder to trust and therefore harder to track.

Some key trends DarkOwl noted in 2025:

Shorter Lifespans

Long-lived giants like XSS and Archetyp are being removed or compromised. New markets and forums:

• Launch quickly
• Hit critical mass
• Either get seized or exit-scam once the risk feels too high

That constant churn makes it harder to operate large-scale, long-term criminal infrastructure.

Exit Scams Are “Priced In”

Vendors and buyers increasingly assume every market will die. Meaning that they

• They keep smaller balances in market wallets.
• They distribute activity across multiple platforms.
• They rely more heavily on out-of-band communication (e.g., direct contact over Telegram) and reputation that travels across sites.

Exit scams hurt, but they are no longer surprising.

Forums Are Critical—and Dangerous

Forums like XSS and BreachForums played a key role in:

• Announcing new markets
• Arbitrating disputes
• Establishing trust and reputations

But this made them and sites like them prime targets for:

• Seizure and infiltration
• Undercover operations
• Intelligence collection on active and prospective offenders

By 2025, many actors treat high-profile forums as necessary but risky.

Investigators Are Playing the Long Game

The XSS takedown and BreachForums sentencing are reminders that investigations often span multiple years before going public. Sentencing can be revisited and made harsher as courts and prosecutors recalibrate how serious digital crimes are. And that Law-enforcement agencies are increasingly comfortable with crypto tracing, infiltration, and complex international joint operations.

The underground can adapt quickly, but investigators are learning and iterating too.

Takeaways for Investigators, Researchers, and Policy Makers

If you follow this space for security, research, or policy, 2025 offers some clear lessons:

1. Follow Actors, Infrastructure and Money, Not Just Sites

Names like “XSS,” “BreachForums,” or “Abacus” come and go. But what does persist is the actors that are active on these sites, they are often working on multiple sites, and it is important to track how and if they continue to operate and what networks the operate within. One way of doing this is following the money and monitoring any wallet addresses shared and how these transactions operate across the blockchain. It is also possible to identify new an upcoming site by monitoring other sites and adjacent sites for chatter from actors, as well as identifying infrastructure patters such as hosting choices and tools used.

2. Treat Every Major Seizure as an Intelligence Event

Takedowns come with positives and negatives for investigators; on the one hand a source of intelligence has been removed. Sometimes we lose access to sites for which we have good access and are able to obtain a large amount of information that can assist with our investigations. Furthermore, the users of these sites tend to scatter, and it is a race to find the next site and where the actors we are most interested in have moved to.

On the other hand, it is great that illegal activity has been thwarted, usually leading to arrests and the seizure of infrastructure which decreases the activity. While we sometimes have to scramble to maintain oversite, the actors also have to scramble to find a new home which can really slow them down, plus they have the fear that they are now on the radar of law enforcement which may deter them fully from the activity. Furthermore, newly unsealed indictments can reveal OPSEC failures and tradecraft which can assist in future investigations, seizure notices and infrastructure details can feed your detections, and you can update risk assessments for actors tied to seized forums and markets.

3. Understand How Exit-Scam Risk Shapes Behavior

As exit scams become more common offenders tend to gravitate toward smaller, more “community-focused” markets. More trading moves into semi-closed spaces like invite-only Telegram channels and some actors may experiment with more robust escrow, multisig, and reputation mechanisms—but trust remains fragile. This means it can be more difficult to infiltrate and track the activity that is occurring. That has implications for everything from undercover operations to intelligence collection.

4. Look Beyond Tor

Serious illicit trade often uses a mix of different platforms, and it is important to have oversight of all of them which can include:

• Tor markets and forums
• Clearnet infrastructure (CDNs, bulletproof hosts, compromised servers)
• Encrypted messaging platforms

A defensive strategy that stops at Tor is going to miss much of the real activity.

Conclusion

2025 didn’t “end” the dark web. But it did accelerate a shift that’s been visible for years:

• Big, stable, centralized markets and forums are increasingly unsustainable.
• Law enforcement is better at seizing infrastructure and tracing crypto.
• Admins are quicker to pull the plug and disappear with user funds.
• Users are more paranoid, more fragmented, and more willing to move between platforms.

For analysts, this is both good and challenging news. The chaos slows down some criminal operations—but it also pushes activity into smaller, harder-to-observe corners of the ecosystem. DarkOwl can assist in making sure you are able to monitor all areas where illicit activity is occurring and help you track actors as they react to takedowns and exit-scams. The dark web will continue but it will evolve and to mitigate risk it is important to closely track these changes.

---

Curious how DarkOwl can help? Contact us.

January 13, 2026

Thanks to our analyst and content teams, DarkOwl published over 100 pieces of content last year. DarkOwl strives to provide value in every piece written, highlighting new darknet marketplaces and actors, trends observed across the darknet and adjacent platforms, exploring the role the darknet has in current events, and highlighting how DarkOwl’s product suite can benefit any security posture. Below you can find 10 of the top pieces published in 2025.

Don’t forget to subscribe to our blog at the bottom of this page to be notified as new blogs are published.

1. Telegram’s Crackdown: Why Accounts Are Getting Banned and What You Need to Know

The founder and CEO of Telegram, Pavel Durov, was arrested on August 24, 2024, at Paris-Le Bourget Airport. French authorities detained him as part of an investigation into Telegram’s alleged insufficient moderation of illegal activities on its platform, including child exploitation and drug trafficking. Following his arrest, Durov was indicted on multiple charges on August 28, 2024. He was placed under judicial supervision, prohibited from leaving France, and required to post bail of €5 million. As of February 2025, Durov remains under judicial supervision in France, awaiting further legal proceedings where he must appear at a police station twice a week. Should he be found guilty the most serious charge complicity in the administration of an online platform to enable organized crime and illicit transactions carries a maximum penalty of 10 years’ imprisonment, and a €500,000 ($521,000) fine.

In response to their CEO’s arrest Telegram announced plans to enhance its moderation policies and has expressed a willingness to cooperate more closely with law enforcement. They have been seeking to ensure that they are co-operating with authorities while claiming to continue to prioritize users’ privacy.

In this blog, we will explore what changes Telegram have said they have made, what effect DarkOwl analysts are seeing in response to these changes and what impact we expect to see in the future. Read blog here.

2. The State of Darknet Marketplaces in 2025: Trends, Metrics, and Insights

The darknet is a hidden part of the internet that operates beyond the reach of traditional search engines and mainstream platforms. Within this space, darknet marketplaces have emerged as virtual bazaars where anonymous buyers and sellers trade goods and services, often illicit, using privacy-focused technologies like Tor and cryptocurrencies such as Monero and Bitcoin. These markets are structured much like legitimate e-commerce sites, featuring product listings, vendor ratings, customer reviews, and even dispute resolution systems.

DarkOwl collects data from a wide range of marketplaces, capturing the breadth of listings, vendor activity, and community interactions. In this blog, we explore the state of darknet markets in 2025, highlighting which platforms lead in listings and vendor count, how products are distributed across categories, the flow of shipments around the world, and patterns of user engagement through reviews.

By examining these factors, we aim to provide a window into the scale, structure, and dynamics of this hidden economy, revealing both the major players and the underlying trends shaping the market landscape. Full blog here.

3. Extra! Extra! Read all about it! Archetyp Marketplace Takedown! 

In a major blow to the online drug trade, law enforcement agencies across Europe and the U.S. have taken down Archetyp Market, one of the most active and profitable dark web drug markets of the past five years. 

Launched in 2020, Archetyp wasn’t just another black market, it was the market. With over ~600,000 users and ~3,200 vendors, the platform facilitated transactions involving cocaine, meth, MDMA, and other narcotics. By its final days, it had moved an estimated $~250–290 million in illicit goods, making it a titan among darknet marketplaces. Read blog here.

4. BreachForums Disruption Sparks Copycat Domains and Darknet Chaos

BreachForums abruptly went offline, prompting a wave of opportunistic copycat domains and widespread confusion within the dark web community. The shutdown—now allegedly confirmed via a PGP-signed statement by former administrators—was attributed to a zero-day exploit targeting the MyBB forum software. This vulnerability was reportedly exploited either by law enforcement or rival threat actors. Read more.

5. Dark Web Pharmacy and Illegal PX Medication Sales 

Dark web “pharmacies” have become a global black market for prescription medications and counterfeit drugs. These underground vendors operate on hidden parts of the internet, accessible only with special software like Tor, and sell everything from opioid painkillers and anxiety meds to fake pills. Recent international crackdowns have led to hundreds of arrests across multiple continents, showing just how far-reaching and organized this trade has become. By using encryption and anonymous networks, dark web drug sellers connect with buyers around the world while evading traditional law enforcement. This blog looks at where these rogue pharmacies are found and the platforms they use to move drugs outside the law. Check it out.

6. Threat Actor Spotlight: The Terrorgram Network: Origins, Operations, and Downfall

In April 2024 the UK took the unprecedented step to sanction a group known as Terrorgram as a terrorist organization.  The UK was the first country to take this step, proscribing the group which consists of various Telegram channels which have been used to share and encourage extremist ideologies and methodologies. This marked the first time a group that is primarily organized on a messaging app has been declared a terrorist organization.  

In this blog we will explore the origins of the group, how they operated and the current status of the organization. Read more.

7. Whistleblower Sites 101

In this blog, DarkOwl analysts provide a summary of the digital whistleblower landscape, outlining the role of the dark web and examining some noteworthy whistleblower platforms. Read blog here.

8. What is Doxing?

This blog aims to provide a comprehensive overview of doxing, its implications, and strategies to safeguard against it. Learn more.

9. Major Threats and Trends to Look Out for in 2025

As we entered 2025, we predicted what would be the major trends of the year. The ever-shifting landscape of cybercrime continues to evolve, with the darknet remaining a significant hub for illicit activities. From emerging technologies to shifting criminal tactics, understanding these trends is critical for cybersecurity professionals, law enforcement agencies, and the general public alike. Drawing on industry expertise, this post identified seven major threats and trends expected to shape the darknet.
Full blog here.

10. Is Your City on the Dark Web? What Local Agencies Need to Know 

In 2023, investigators in a midsize U.S. city were tipped off to a darknet marketplace vendor offering “same-day delivery” of fentanyl-laced pills within specific zip codes. The listing named street corners and used coded references to local schools. It was not discovered by routine patrols or a community tip. It was found in an online space most local agencies never check: the dark web. 

The dark web is not just a place for global cybercriminal networks. It is a sprawling ecosystem where local-level threats are planned, traded, and discussed. Understanding what is being said about your city, and acting on it, can mean stopping crime before it happens. Read blog here.

2025, That’s a Wrap!

Thank you to everyone who reads, shares and interacts with our content! Anything you would like to see more of, let us know by writing us at [email protected]. Can’t wait to see what 2026 brings! Don’t forget to subscribe to our newsletter below to get the latest research delivered straight to your inbox every Thursday.

January 06, 2026

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. Bloody Wolf Threat Actor Expands Activity Across Central Asia – InfoSecurity Magazine

The threat actor group, Bloody Wolf, has been observed using remote-access software to infiltrate government targets throughout Central Asia. Cybersecurity researchers claim the group has shifted from traditional malware to “a streamlined Java-based delivery method”. Reports claim the group has been operating a sustained campaign in Kyrgyzstan since June 2025 and recently began targeting Uzbekistan. By using counterfeit PDF documents, spoofed web domains, and fraudulent emails to pose as the country’s Ministry of Justice, the group has manufactured an air of legitimacy that has facilitated their access. Once a victim opens the downloaded JAR file, the loader retrieves additional components and installs NetSupport RAT for remote control. Read full article.

2. Poland arrests Ukrainians utilizing ‘advanced’ hacking equipment – Bleeping Computer

Three Ukrainians, claiming to be IT specialists, were arrested by Polish police while traveling through Europe. During a routine traffic stop, officers conducted a search of the threat actor’s vehicle, discovering suspicious items that could be “used to interfere with the country’s strategic IT systems, breaking into IT and telecommunications networks”. The seized equipment included “spy device detector, advanced FLIPPER hacking equipment, antennas, laptops, a large number of SIM cards, routers, portable hard drives, and cameras.” The data seized was encrypted but according to officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) claim to have been able to collect evidence. Article here.

3. Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability – The Hacker News

Hours after CVE-2025-55182 was made public, Amazon Web Services (AWS) observed two different Chinese hacking groups, Earth Lamia and Jackpot Panda, beginning to weaponize the vulnerability. CVE-2025-55182, aka React2Shell, allows unauthenticated remote code execution in React Server Components (RSC). Using automated scanning tools, these threat actors have been observed exploiting additional vulnerabilities including CVE-2025-1338. AWS identified Earth Lamia due to the use of previously used infrastructure the group had demonstrated earlier in the year. This situation highlights threat actors systematic approach in abusing vulnerabilities quickly and learning to scan for common vulnerabilities. Read more here.

4. FCC Warns of Hackers Hijacking Radio Equipment For False Alerts – InfoSecurity Magazine

On November 26, the Federal Communications Commission (FCC) announced threat actors had been hijacking US radio transmission equipment and broadcasting fake emergency tones and offensive material. Several stations in Texas and Virginia were targeted, resulting in broadcasts being disrupted by emergency signals, alert tones, and obscene language. The threat actors targeted Barix network audio devices and reconfigured them to capture attacker-controlled streams. The FCC reports that the incidents stemmed from unsecured equipment, noting that some stations did not discover the compromise until after the attacks and were seemingly unaware as they unfolded. Read here.

6. Glassworm malware returns in third wave of malicious VS Code packages – Bleeping Computer

First emerging in October, the Glassworm campaign, has released 24 new packages distributing malware to OpenVSX and Microsoft Visual Studio. According to Koi Security, Glassworm malwares uses “invisible Unicode characters to hit its code”. Following previous detection, Glassworm evolved technically, using Rust-based implants packaged inside extensions as well as invisible Unicode. Once the malware is installed it attempts to steal GitHub, npm, and OpenVSX accounts, as well as cryptocurrency wallet data from 49 extensions. Additionally, the malware deploys a SOCKS proxy to route malicious traffic and give operators stealthy remote access. Read full article.

7. React2Shell flaw exploited to breach 30 orgs, 77k IP addresses vulnerable – Bleeping Computer

On December 03, React disclosed the vulnerability, CVE-2025-55182 aka React2Shell, detailing “that unsafe deserialization of client-controlled data inside React Server Components enables attackers to trigger remote, unauthenticated execution of arbitrary commands.” React2Shell is a security flaw that allows attackers to run code on a server without logging in. It can be triggered with just one HTTP request and affects any framework that uses React Server Components, including Next.js. Over 77K internet exposed IP addresses are vulnerable to React2Shell and researchers believe 30 organizations are already compromised. Read full article.

8. RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware – The Hacker News

The malware group RomCom has been observed using the JavaScript loader, SocGholish, to target U.S. based civil engineering company. By targeting poorly secured websites, the group injects fake Google Chrome or Mozilla Firefox update alerts into otherwise legitimate but compromised pages. These alerts trick users into downloading malicious JavaScript that installs a loader, which then retrieves additional malware. According to Arctic Wolf researchers, this allowed the threat actors to execute commands on the compromised host through a reverse shell connected to the command-and-control (C2) server, enabling activities such as system reconnaissance and deployment of a custom Python backdoor known as VIPERTUNNEL. Learn more.

---

Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.