DarkOwl, LLC

[DEVELOPING] Impacts of Ukraine Invasion Felt Across the Darknet

Written by DarkOwl Content Team on August 26, 2022. Posted in Blog.

Last updated: April 18 18:30 UTC

The DarkOwl team are actively tracking the fallout from Russia’s invasion of Ukraine. The effects of the kinetic military operation are causing ripples across the global cyber space including critical underground ecosystems across the deep and darknet.

18 April 2022 – 01:12 UTC

DDoSecrets Leaks 222GB of Data from Gazregion Collected by Anonymous Hacktivists

Three different hacktivist groups (Anonymous, nb65, and DepaixPorteur) submitted archives consisting of emails and sensitive corporate files from Gazregion, a Russian supplier specializing in gas pipelines construction with direct support to Gazprom.

There have been numerous claims of attacks against Gazprom since invasion of Ukraine by Anonymous and other cyber offensive groups. nb65 posted to social media they compromised SSK Gazregion on April 3rd with their version of CONTI ransomware.

18 April 2022 – 01:12 UTC

nb65 Claims Attack Against Russian JSC Bank PSCB with CONTI Ransomware

The Hacktivist group, Network Battalion 65 had claimed they successfully attacked JSC Bank PSCB in Russia and successfully encrypted their network with their version of CONTI ransomware.

The group stated they managed to exfiltrated over 1TB of data including financial statements, tokens, tax forms, client information, and sensitive databases before deleting all backups to prevent data and functionality restoration.

The hacktivists further taunted the bank stating how grateful they were the stored so many credentials in Chrome – a browser for which several emergency security patches have been recently released.

We’re very thankful that you store so many credentials in Chrome. Well done. It’s obvious that incident response has started. Good luck getting your data back without us.

15 April 2022 – 21:59 UTC

GhostSec Leaks Data from domain[.]ru Hosting Provider

The Hacktivist group, GhostSec claimed to target Russian internet domain registration provider, domain[.]ru in a cyberattack. The group managed to exfiltrate over 100MB of data including screenshots of sensitive files and excel spreadsheet data.

According to the README file in the data leak, during the breach, GhostSec identified over 4TB of SQL databases, but in all the excitement the team’s presence was caught by the company’s intrusion detection systems and kicked off the network before the SQL data could be harvested.

15 April 2022 – 17:52 UTC

nb65 Confirms Attack on Continent Express; DDoSecrets Leaks 400 GB of Russian Travel Agency’s Data

The attack on a Russian travel agency occurred several days ago and was shortly after confirmed by the organization. DDoSecrets assisted nb65 in leaking over 400GB of sensitive files and databases from the travel agency. The details of the leak have not been confirmed.

15 April 2022 – 14:32 UTC

Anonymous Takes Over Pro-Russian Discord Accounts

Hacktivists from the Anonymous Collective have successfully taken control of several pro-Russian accounts on the chat platform, Discord, and are now using these accounts to circulate pro-Ukrainian messaging. An Anonymous member @v0g3lsec – who has been extremely active in the #opRussia campaign – shared an image of a hacked account where they posted links and information about the information operations group, squad303 to share truths about the invasion via SMS, WhatsApp, and email with random Russian citizens.

14 April 2022 – 20:02 UTC

DDoSecrets Leaks Unprecedented Amount of Email Data from Russian Organizations

In the last three days, DDoSecrets uploaded archives for five (5) different organizations across Russia totaling 1.97 Million emails and 2 TBs of data.

230,000 emails from the Blagoveshchensk City Administration (Благове́щенск) – 150GB
230,000 emails from the Ministry of Culture of the Russian Federation (Министерство культуры Российской Федерации) responsible for state policy regarding art, cinematography, archives, copyright, cultural heritage, and censorship – 446 GB
250,000 emails from the Deptartment of Education of the Strezhevoy (Стрежево́й) City District Administration – 221GB
495,000 emails from the Russian firm Technotec, which has provided oil and gas field services along with chemical reagents used in oil production and transportation – 440GB
768,000 emails from Gazprom Linde Engineering, which specializes in designing gas and petrochemical processing facilities and oil refineries – 728GB

13 April 2022 – 17:09 UTC

CISA Issues Alert About Destructive Malware Targeting US Critical Infrastructure

A joint advisory issued by the Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) details how nation state actors (likely sponsored by the Russian government) have demonstrated the capability to gain full system access to multiple industrial control system (ICS) and affiliated supervisory control and data acquisition (SCADA) devices. The critical alert indicated there is an immediate HIGH cybersecurity risk to critical infrastructure around the US. The devices include:

Schneider Electric programmable logic controllers (PLCs);
OMRON Sysmac NEX PLCs; and
Open Platform Communications Unified Architecture (OPC UA) servers.

For more information read the advisory along with recommended security mitigation measures here: https://www.cisa.gov/uscert/ncas/alerts/aa22-103a

12 April 2022 – 15:31 UTC

ATW | Blue Hornet Announces That They are a “State-Sponsored” Group

The “GOD” account representing AgainstTheWest (APT49) on the new BreachedForums (with many users from the now officially seized RaidForums) announced moments ago that they are indeed a “state-sponsored” cyber group with “direct instructions to infiltrate, attack and leak the country of China, Russia, Iran, North Korea & Belarus.” The group’s Twitter account was also blocked by Russia’s Kremlin account earlier this week and the notification of this block was included in the post.

There is no way to verify the accuracy of the statement posted and it’s unclear whether or not the group will continue their operations in support of Ukraine.

11 April 2022 – TIME UNKNOWN

CONTI Claims Responsibility for Cyberattack Against German Wind Turbine Company

On the 31st of March, Nordex wind turbine manufacturing company in Germany suffered a significant cyberattack. CONTI has claimed responsibility for the attack (over 10 days later) posting the company’s name to their public-facing Tor service of victims. We anticipate that sensitive corporate data will be leaked by the RaaS gang shortly.

11 April 2022 – 20:58 UTC

Anonymous Compromises Regional Government of Tver, Russia; Leaks 130,000 Emails from Governor’s Mail Server

Hacktivists from the Anonymous Collective using the monikers DepaixPorteur and wh1t3sh4d0w0x90 have compromised the domain tverreg[.]ru believed to be associated with the Regional Government of Tver, Russia. Tver is located 110 miles (180km) northwest of Moscow on the banks of the Volga River. The archive is over 116GB in size and consists of over 130,000 emails exfiltrated from Governor Igor Rudenya’s email system dating from 2016 through 2022. The governor was appointed by President Putin in 2016.

Anonymous shared a leak consisting of Russian regional governors on the darknet on 23 March 2022.

11 April 2022 – 14:35 UTC

Finland Suffers Cyberattack; Announces They Will Expedite Application for NATO Membership

On April 8th, the Finnish government confirmed many of its military, defense, and foreign affairs webservers experienced unsophisticated, yet concerted DDoS attacks likely originating from Russian threat actors. The cyberattacks coincidentally occurred just as Ukraine President Zelenskyy started to address the Finnish Parliament on the status of the war in Ukraine around 10:30 GMT.

On the same day, the Finnish Minstry of Defense confirmed, hours earlier, Russia state-owned aircraft also breached Finland’s airspace off Porvoo in the Gulf of Finland – the first time in over 2 years. The aircraft, an Ilyushin IL-96-300 cargo transport airplane, was traveling east to west and landed in Berlin.

Both Finland and Sweden have signaled they will be submitting applications to join NATO. According to open-source reporting, Finland will likely finalize their application during the month of May in time for a NATO summit scheduled in Madrid, Spain in June.

Kremlin spokesman, Dmitry Peskov stated that Russia would have to “rebalance the situation ” with its own measures should Sweden and Finland choose to join NATO.

09 April 2022 – 03:39 UTC

ATW | BH Group Leaks Data Stolen from Russian Temporary Work Agency and Recruitment Firm: Rabotut

AgainstTheWest (Blue Hornet) announced on their Telegram channel they have successfully targeted the domain (rabotut[.]ru) for Rabotut, a “federal scale service” supplier in Russia. According to the threat actor, the archive includes the organization’s entire backend and front end source code, API keys, and SSL keys. According to open-sources, Rabotut is a temporary workers agency and provides contract employees to a number of critical government and corporate businesses around the country.

Contents of leak are in the process of verification by Darkowl analysts.

08 April 2022 – 21:41 UTC

KelvinSecurity Team Targets Russian Cryotcurrency Scam Website: alfa-finrase

KelvinSec released data reportedly from the domain (alfa-finrase[.]com) known for trading in fraud data, e.g. passports, driver’s license, and other sensitve PII. The group claims to have exploited the website, shutdown a cryptocurrency scam, deleted 400GB from the site’s server, and exposed 1.4GB of customer data from the deep web store.

07 April 2022 – 19:30 UTC

DDoSecrets Leaks Over 400,000 Russian Organization Emails Exfiltrated by Anonymous Operations

The leak site, DDoSecrets once again assists Anonymous hactivist collective in distributing sensitive data exfiltrated from companies and organizations in Russia. Three archives were leaked – within minutes of each other – for three organizations: Petrofort, Aerogas, and Forest. The data from these corporate email archives date back over decades of commercial activitiy.

Petrofort: 244GB archive consisting of over 300,000 emails between employees and clients. Petrofort is one of the largest office spaces and business centers in Saint Petersburg.
Aerogas: 145GB archive consisting of over 100,000 emails between employees and clients. Aerogas is an engineering company supporting Russia’s critical oil and gas infrastructure and supports such as: Rosneft, NOVATEK, Volgagaz and Purneft.
Forest (Форест): 35GB archive consisting of over 37,000 emails between employees and clients. Forest is a Russian logging and wood manufacturing company associated with many high-valued construction projects across the company.

A representative from DDoSecrets earlier shared thoughts about the extraordinary volume of leak data coming out of Russia earlier this week in a social media post.

06 April 2022 – 21:42 UTC

Anonymous Claims to Attack Russian MAUK Cinema, Mirkino Belebey

Members of Anonymous using the aliases ShadowS3c and Anonfearless3c have allegedly targeted servers for the Russian cinema and movie theatre, Mirkino Belebey (domain:mirkino-belebey[.]ru). The Mirkino theatre is also known as the MAUK Cinema a.k.a. “World of cinema” in the Belebeevsky District of Russia.

The hacktivists have leaked screenshots with credential data from the breached database containing hundreds of usernames, email adresses, and passwords.

This entry will be updated if/when the leak contents can be confirmed.

06 April 2022 – 20:42 UTC

Hajun Project Identifies Russian Soldiers Who Sent Parcels from Belarus Back to Russia

On April 3rd, the Hajun Project published three hours of surveillance camera footage from a CDEK delivery service located in Mazyr, Belarus. The video shows several soldiers from the Russian Armed Forces sending, among other things, items stolen from Ukrainians, during their “special military operation.”

Using leaked personal data available across the darknet and deepweb, the Hajun Project further confirmed the identities of the Russian military consignors and have released the names and phone numbers for at least 50 of the servicemen that sent parcels around the same time as the published camera video.

The Hajun Project maintains a Telegram channel and Twitter account monitoring and tracking the movement of military land and air assets in Belarus.

05 April 2022 – 16:22 UTC

Ukraine’s Defense Intelligence Agency (GURMO) Conduct SCADA Attacks on Gazprom

Due to the sensitivities of on-going military operations, there is limited detail available on the nature of the attack, but it appears that offensive cyber units under the direction of Main Director of Intelligence for the Ministry of Defense of Ukraine conducted SCADA cyberattacks against Gazprom pipelines. The attacks began within 48 hours of a fire at an oil depot in Russia’s Belgorod region last Friday, that western media reported was the first time Ukrainian helicopters had been spotted going across the border.

The cyberattacks likely triggered an underground gas leak from a highly pressurized gas pipeline in the village of Verkhnevilyuysk; the leak was reported in Russian open sources. Shortly after this, an explosion occurred in a main gas pipeline “Urengoy-Center-2” that civilians captured on Russian social media platform, VK as a large fire occurred in the Lysvensky district of the Kama region near the village of Matveevo.

Over pressurizing gas lines through disrupting infrastructure industrial control systems (ICS) is a documented method for using cyber to cause kinetic damage to pipeline critical infrastructure. The Congressional Research Services detailed such security risks to ICS in their 2021 report.

05 April 2022 – 14:21 UTC

Anonymous Leaks Data from Russian Rations Supplier, Korolevskiy

The company, Korolevskiy (korolevskiy[.].ru) appears to supply Russian companies and organizations with grain, nuts, and confectionaries in addition to rations for the military. This cyberattack could impact the availability of some food ingredient supplies, such as sugar, which is already in short supply and skyrocketing in price across the country due to sanctions.

The data leak includes an 82GB archive containing thousands of emails exfiltrated from the company’s mail servers.

05 April 2022 – 12:29 UTC

nb65 Claims to Hack Civilian Travel Service in Retaliation for Bucha Massacre

Anonymous and hacktivists around the world step up their offensive against Russia after images of Russian soldiers’ war crimes and atrocities against civlians in Bucha emerged on Monday.

Network Battalion 65 (nb65) reportedly targeted Continent Express (continent[.]ru), a Russia-based travel and supply company, with Conti’s ransomware variant in retaliation for the crimes.

Continent Express is one of the largest agencies for travel in Russia and helps arrange tickets and accomodations. As of time of writing the public facing website for continent[.] is operational.

Details of the group’s threatening message posted to social media called out the company’s CEO Stanislav Kostyashkinis in the image below.

“Why, you ask? The answer is simple. We read and watched the coverage of Bucha with horror. The utter lack of humanity in the way Russian soldiers have treated the civilian population of Ukraine left us all in tears. The world has pleased with your country to put an end to this madness drive by the mind of a cowardly tyrant: your president.”

(Update 6 April 2022) Earlier today, Continent Express posted to their news section of the website acknowledging the cyberattack but stated that important data and booking systems were not affected.

04 April 2022 – 12:29 UTC

DDoSecrets Distributes Data Exfiltrated by nb65 From Russian Broadcasting Company

Earlier in the campaign, nb65 leaked a sample of files and emails from All-Russia’s State Television and Broadcasting Company (VGTRK / ВГТРК). The Russian state-owned broadcaster operates five national TV stations, two international networks, five radio stations, and over 80 regional TV and radio networks and has been heralded as essential for the “security of the state.”

According to former VGTRK employees, Kremlin officials have dictated how the news should be covered, and provided incendiary phrases meant to discredit Ukraine. According to the former employees, editors normally have freedom to make decisions, but “where big politics are concerned, war and peace, he has no freedom.”

The 786 GB archive contains over 900,000 emails and 4,000 files spanning 20 years of operations at the broadcaster.

04 April 2022 – 06:24 UTC

Anonymous Leaks List of Russian Soldiers Deployed in Bucha

Anonymous shared a PDF file containing the identities of the members Russia’s 64 Motor Rifle Brigade that was positioned in the Kyiv suburb of Bucha. Since Russia’s withdrawl from the village, the atrocities and war crimes carried out by members of the Brigade have come to light.

The PDF consists of 87 pages detailing the identities of over 1,600 members of the Bridage, including their full name, date of birth, and passport number.

The file most likely originated from the Ukrainian government or intelligence services.

03 April 2022 – 06:16 UTC

Anonymous Shares Data Leaked from Russian Federal Agency for State Property Management

Anonymous shared a single PostGreSQL database, presumably from the domain: rosim.gov.ru, containing over 785MB of logged domain Internet activity available via the domain user: kluser. Much of the data is several years old, including IP addresses, domains, user agents of site vistors. Without further analysis, the value of leaking this data other than psychological operations and information warfare is unclear.

03 April 2022 – 05:07 UTC

nb65 Claims to Compromise Russian Gas Pipeline Supplier: SSK Gazregion

nb65 shared on social media that they have successfully hacked SSK Gazregion LLC (domain: ssk-gaz.ru) – a prominent natural gas pipeline construction company – with an ‘improved’ version of Conti’s ransomware. They taunted the company’s IT department, claiming that they also deleted all backups and restoring services would be an issue for the department.

They also claim to have exfiltrated 110GB of sensitive files, emails, and company data during the operation and trolled the company further stating it took forever to steal the data with the “chincy ass soviet connection” they were using for Internet connectivity.

“Federal Government: This will stop as soon as you cease all activity in Ukraine. Until then, fuck you. Your Preisdent is a coward who sends Russian sons away to die for his own ego. War in Ukraine will gain your country nothing but death and more sanctions. none of your internet facing tech is off limits to us.”

“We won’t stop until you stop.”

03 April 2022 – 04:24 UTC

ATW Release Dox of KILLNET Member

Similar to the personal details shared for various APT cyber groups in China, Russia, and North Korea, ATW targeted the pro-Russian cyber group, KILLNET. They released a dox containing the Russian national’s personal information, his social media, contact information, and familial associations.

KILLNET claimed to launch cyberattacks against Polish government and financial networks in support of Putin’s invasion in Ukraine. Last week, KILLNET also reportedly conducted DDoS attacks against the International Cyber Police agency, CYBERPOL and hacked the ticketing system at Bradley International Airport in Connecticut.

02 April 2022 – 17:28 UTC

Darknet Threat Actor, spectre123 Releases Sensitive Databases for the Indian Government and Military

The threat actor is well-known for targeting governments and defence contractors and has been circulating sensitive government databases for some time. This weekend, they released a “mega leak” of Indian government data for the PM Modi adminsitration’s “turning a blind eye to the humanitarian crisis…. in Ukraine.”

Over 40 GB of data is included in 11 different archived files and includes classified (up to TOP SECRET) and Confidential government documents from the following sectors: ALISDA, DGAQA, MSQAA, DRDO, DDP, Joint Defence Secretary India, BSF, MOD and the Indian Navy.

“The Indian government has a remarkably twisted propensity towards turning a blind eye to the humanitarian crisis in their own nation and now as well in Ukraine. It continues to do business with Russia and refuses to speak on the war, all in an effort to maintain their shallow political interests. These documents have been released to show that there are consequences for taking such foolish decisions.”

02 April 2022 – 06:13 UTC

ATW | BH Claims to Leak Personal Details of Members of Nation State APT Cyber Groups: ATP3, APT40, APT38, & APT28

The AgainstTheWest group continued their offensive against Chinese, North Korean, and Russian nation state cyber groups. Releasing a dox-style text file on Telegram and the deep web forum, breached.co, the ATW group included the names, email addresses, socials and Github accounts, credit card data, front companies, and other identifying information about the group’s participants along with other shocking revelations. Some include:

APT38: China and North Korea have collaboratively had a mole inside the United States Congress since 2011.
APT3: Threat actors are closely aligned with employees from Tencent – the Chinese technological giant behind WeChat and QQ.
APT38/APT3: The alias “ph4nt0m” appears in information for both groups and is believed to be affiliated with APT17 from China.
APT40: Threat actors are randomly connected to employees of ByteDance, the parent company for TikTok.

We are unfortunately unable to corroberate the veracity of the information shared by ATW (Blue Hornet).

01 April 2022 – 20:13 UTC

Anonymous Attacks Russian S-300 Supplier: Lipetsk Mechanical Plant

Anonymous shared another large archive of data stolen from a prominent Russian defense manufacturing facility. The archive is nearly 27GB total and consists of company emails and sensitive documents.

Russia’s “Lipetsk Mechanical Plant” produces several defense products for the Russian military and industrial defense complex. Today, the plant is one of the leading and main manufacturers of modernized self-propelled tractors for S-300V4 anti-aircraft missile systems in Russia. The S-300 is one of Russia’s premier air-defense platforms.

01 April 2022 – 16:00 UTC

Anonymous Leaks Multiple Data Archives From Critical Moscow-Based Organizations

Coordinating today through DDoSecrets on distribution, Anonymous shared several highly significant archives, consisting of over 500GB total of emails, files, and databases from critical Russian organizations with close ties to the Russian government.

Department for Church Charity and Social Service of the Russian Orthodox Church: Database containing 57,500 emails from the Russian Orthodox Church’s charitable wing.
Capital Legal Services: 200,000 emails exfiltrated from a prominent Russian law firm includes an additional 89,000 emails are located in a “Purges” mailbox, consisting largely of bounced email notifications, cron jobs and other server notifications.
Mosekspertiza: Three archives consisting of a) 150,000 emails b) 8,200 files and c) multiple databases totally over 400GB of data. Mosekspertiza is a state-owned company setup by the Moscow Chamber of Commerce to provide expert services and consultations to Russian businesses.

1 April 2022 – 08:56 UTC

GhostSec Wreaks Additional Havoc on Alibaba

After ATW attacked Alibaba Cloud days before, Ghost Security has allegedly hacked and deleted Alibaba’s UAE branch’s ElasticSearch service database. They included a leak to the database extracted from the company on their Telegram channel.

We have also deleted everything and even cleared the backups so there is no recovery, and we left a little celebration from us <3

31 March 2022 – TIME UNKNOWN

German Wind Turbine Company Impacted by Cyberattack

A German-based wind turbine – Nordex – with over $6 billion dollars in global sales faced a cyberattack that incident responders caught “in the early stages.” It’s likely the attack is retaliation for Germany pausing on the Nord Stream 2 natural gas pipeline deal with Russia.

“Customers, employees, and other stakeholders may be affected by the shutdown of several IT systems. The Nordex Group will provide further updates when more information is available.”

In the early days of the cyberwar, a cyberattack on the satellite communications company Viasat caused 5,800 Enercon wind turbines in Germany to malfunction.

31 March 2022 – 19:43 UTC

Anonymous Leaks 62,000 Emails from Moscow-Based Marathon Group

Anonymous again targets associates of those closest to Putin launching recent cyberattacks against Marathon Group. The Marathon Group is an investment firm owned by Alexander Vinokurov. Vinokurov is the son-in-law of Russian Foreign Minister Sergei Larov and is under heavy sanctions by the EU for providing financial support to Russia. The leaked archive is over 51GB in size and is being distributed via DDoSecrets.

31 March 2022 – 14:31 UTC

Ukraine Government Sets Up Website for Whistleblower Reporting

The Ukrainian Prosecutor General’s Office in coordination with the National Agency on Corruption Prevention and Task Force Ukraine deployed the Whistleblower Portal on the Assets of Persons Involved in the Russian Aggression against Ukraine. The website is setup to provide a secure and anonymous method for the submission of tips and evidence of corruption any activities causing national harm. The website will ideally help in the “tracing, freezing, and confisicating of assets of those involved in Russia’s War Crimes.”

Many OSINT sleuths have identified Russian oligarchs’ and government officials’ assets, like super yachets parked in international ports and submitted photographs via posts on social media. This website could be used to officially report supporting information leading to the seizure of those assets or other correlative intelligence obtained through leaks shared by Anonymous.

30 March 2022 – 22:09 UTC

Database Containing the PII of 56 Million Ukrainian Citizens Leaked on Deep Web

A user on the forum breached.co leaked an arhive containing the personal identification information for over 56 Million citizens of Ukraine. The database includes the full name, dates of birth, and address for the individuals. Its unclear the origins of the data. Members of the forum stated it was the Ukrainian Tax Service and could be dated back to 2018.

30 March 2022 – 21:53 UTC

ATW Continues Offensive Against China, Leaks Alibaba Cloud & Ministry of Justice of PRC Data

The AgainstTheWest/Blue Hornet group have ramped up their attacks against Chinese targets and leaked the largest archive they have exfiltrated to date. ATW successfully breached the e-commerce company Alibaba and have dropped a 30GB archive consisting of Alibaba’s cloud endpoint environment, source code, and customer data. They also released a smaller database obtained from the Ministry of Justice of the People’s Republic of China. Both were shared to the deep web forum, breached.co.

30 March 2022 – 19:49 UTC

Anonymous Continues to Encourage SCADA Attacks; Leaks Default Credentials for COTS Hardware Suppliers

Members of the Anonymous Collective circulate spreadsheets and websites containing the default factory credentials for most commercial-off-the-shelf (COTS) vendor hardware. Hardware, that in turn, is often affiliated with and successfully exploited via SCADA-based industrial control system (ICS) cyberattacks.

One list includes 138 unique products including manufacturers such as Emerson, General Electric, Hirshmann, and Schneider Electric accompanied with default factory settings such as username: admin and password:default. Another resource is a surface web website (intentionally not included but available upon request) which lists 531 vendors and over 2,100 passwords deployed with hardware from the factory.

Sadly, most companies will rely on the default passwords upon installaton and do not bother with updating to a more robust credential security standard.

30 March 2022 – 18:19 UTC

Anonymous Leaks 5,500 Emails Stolen from Thozis Corporation

Anonymous successfully attacked Thozis Corporation – a Russian investment firm with links to Zakhar Smushkin of St. Petersburg. According to the Panama Papers, the company is registered in the British Virgin Islands. The firm is allegedly involved in one of the largest development projects in Russia, including a project to build a satellite city within St. Petersburg.

The trove of leaked emails likely include sensitive documents and agreements between the Russian government, its societal elite, and other international entites.

DDoSecrets assisted in the publication of the 5.9GB archive obtained by Anonymous.

30 March 2022 – 17:55 UTC

GhostSec Leaks Shambala Casino Network Data

GhostSec claimed a few days ago they had successfully attacked a prominent casino operator in Russia, known as Shambala.

The hacktivist group targeted the casino as they believed members of the Russian government used Russian casinos to move cash into different currencies besides the Ruble. At least 27 computers were reportedly compromised, data exfiltrated, systems locked, and files erased.

29 March 2022 – 06:12 UTC

Russian Aviation Sector Suffer Additional IT Operational Impacts

A post shared on the Russian Telegram channel, Авиаторщина, indicates that the aviation industry of Russia will have additional impacts to their IT support with the withdrawl of the Swiss-based company, SITA as of 29 March.

According to the Telegram post, SITA shutting down their operations will impact numerous systems utilized by the aviation industry and airlines across Russia.

[translated]

“Products for pilots such as AIRCOM Datalink, AIRCOM FlightMessenger, AIRCOM FlightTracker, and AIRCOM Flight Planning services will no longer be available. Such software is utilized by airlines and flight crews to plan, perform aeronautical calculations and track flights, and more accurately calculate remaining fuel, flight time, etc.”

The company – choosing to withdrawl from operating in Russia due to Putin’s invasion – suffered a significant cyberattack on 24 February, the same day as the invasion of Ukraine, resulting in the compromise of passenger data stored on their SITA Passenger Service System (US) Inc. servers. SITA supports numerous international air carriers.

This annoucement comes within days of the cyberattack against Rosaviatsiya (see below), Russia’s Federal Air Transport Authority.

(Update 30 March – 23:42 UTC) No alias associated with Anonymous has claimed credit for the 28 March cyberattacks against Rosaviatsiya which resulted in 65TB of lost agency data. Interestingly, new Anonymous groups have only recently joined the campaign, including RedCult, increasingly the likelihood that widespread industry sector attacks will continue across Russia.

28 March 2022 – 18:23 UTC

nb65 Claims to Hack JSC Mosexpertiza; Steals 450GB of Sensitive Data

In a social media post, nb65 hacktivist group claims they compromised Joint Stock Company (JSC) Mosexpertiza, Moscow’s independent center for expertise and certifications, via the domain mosekspertiza.ru.

They claim they also infected the domain with, none other than Conti’s “crypto-locking ransomware variant” – released earlier this month in the opRussia campaign. In the process of hacking the network nb65 also exfiltrated 450GB of emails, internal documents, and financial data.

28 March 2022 – 17:07 UTC

Anonymous Leaks 140,000 Emails from Russian Oil & Gas Company, MashOil

Distributed via DDoSecrets, the Anonymous hacktivist collective recently targeted MashOil, releasing over 140,000 sensitive corporate emails from the company.

Moscow-based, MashOil manufacturers equipment for hydraulic fracturing and enhanced oil recovery (EOR); injection, nitrogen and cementing equipment; top drive mobile drilling rigs; directional drilling equipment; and, ejector well clean-up.

Anonymous continues to target companies in Russia and any companies that continue to contribute to economic and financial viability for the Russian Federation.

28 March 2022 – 12:41 UTC

Anonymous Leaks Russian Document Ordering Propaganda Video Development

Knowing propaganda is widely circulated by both Ukrainian and Russian affiliated organizations, Anonymous has leaked an official Russian document, titled “On holding informational events on the Internet”, dated 21 March 2022, stating this was an official “order issued” by the Russian government to develop videos to discredit the Ukrainian military and their treatment of prisoners of war (POWs). The order was signed by the “Temporary Minister of Defense of the Russian Federation”, Dmitry Bulgakov and decrees:

Develop and distribute a series of video materials demonstrating the inhuman behavior of the military personnel of the Armed Forces of Ukraine and nationalist formations on the territory of Ukraine in relatinos to prisoners who showed a voluntary desire to surrender
Develop and distribute sermographic materials, evidence of the use of briefings by captured military personnel of the Armed Forces of the Russian Federation during the filming
Provide informational support for materials in the comments, the main argument is the violation of the Geneva Convention on the Treatment of Prisoners
To impose control over the implmtnation of this order on the head of the Information Warfare and Disguise Department of the Ministry of Defense of the Russian Federation

(UPDATE 29 March 2022 – 20:56 UTC) DarkOwl advises that recent open source intelligence research suggests this letter could be fake and disseminated as part of an information operations campaign. Researchers caught signature mismatches of the Russian official, Bulgakov. Such data is a reality in the the fog of asymmetric warfare.

28 March 2022 – 11:58 UTC

Ukrainian Defense Intelligence Doxxes 620 Russian FSB Agents

The Ukrainian Military Intelligence Agency of the Ministry of Defence of Ukraine, known simily as Defence Intelligence of Ukraine or GUR, has leaked the identities of over 600 Russian FSB spies. The database includes the agents’ full names, dates of birth, passport numbers, passport dates of issue, registration addresses as well as other identifying markers for the FSB employees.

Many of these agents may be conducting covert operations around the world and leaking their identities may compromise the success of their operations.

28 March 2022 – 11:05 UTC

ATW (BH) Targets Chinese Companys and Government Organizations

After a brief vacation announced on 23 March, the AgainstTheWest (Blue_Hornet) group returns with concerted attacks against a number of Chinese companies and government organizations. The group claims they successfully attacked the following:

The group also referenced a supply-chain software dependency attack, via a poisoned burgeon-r3 NPM package.

Fenglian Technology-Digital Ecological Platform Solution
Bluetopo China security development tool
China Pat Intellectual Property
Weipass
Ministry of Transport China
Freemud Software (supplier to Starbucks)
China Joint Convention Committee.

Shortly after the announcement and initial round of leaks, the group also released source code affiliated with China Guangfa Bank, along with associated Maven releases. The group also claims to have breached the Chinese social messaging platform, weChat.

We are still evaluating the data and determining the specific types of data compromised and released.

28 March 2022 – 03:22 UTC

Russian Federal Air Transport Agency, Rosaviatsiya Confirms CyberAttack; 65TB of Data Erased

The civil aviation agency Rosaviatsiyan responsible for air cargo transportation confirmed with a letter shared on the Russian Telegram channel, Авиаторщина that their website domain favt.ru was offline since Saturday due to a significant cyber attack. The attacks had severely impacted their ability to plan and conduct flight operations and the agency had resorted to pen-and-paper-based operations in the interim.

The notice stated that over 65TB of emails, files and critical documents had been allegedly erased along with the registry of aircraft and aviation personnel. There were no systems backups to restore from because according to the agency spokesperson, the Ministry of Finance had not allocated funds to purchase backups.

“All incoming and outgoing emails for 1.5 years have been lost. We don’t know how to work…”

“The attack occurred due to poor-quality performance of contractual obligations on the part of the company LLC ‘InfAvia’, which carries out the operation of the IT infrastructure of the Federal Air Transport Agency.”

27 March 2022 – 20:44 UTC

Anonymous Leaks 2.4GB of Emails from Russian Construction Company, RostProekt

Over the weekend, DDoSecrets helped Anonymous distribute over 2 gigabytes of sensitive company emails exfiltrated by breaching a prominent Russian construction company, RostProekt (in Russian: РостПроект). The company primarily operates in Russia, with the head office in Moscow Oblast. RostProekt is a primary contributor to Russia’s lumber and other construction materials merchant wholesalers sector. The breach may impact construction projects in the country.

As of time of writing, the website for the company is online.

25 March 2022 – 20:36 UTC

nb65 Leaks Sample Internal Data from the All-Russian State Television and Radio Broadcasting Company (VGTRK)

The nb65 hacktivist team targeted and released data affiliated with a state-sponsored propaganda broadcasting company of the Russian Federation, VGTRK. The All-Russia State Television and Radio Broadcasting Company, also known as Russian Television and Radio (native: Всероссийская государственная телевизионная и радиовещательная компания) owns and operates five national television stations, two international networks, five radio stations, and over 80 regional TV and radio networks. It also runs the information agency Rossiya Segodnya.

nb65 claims they have successfully compromised the organization’s network and exfiltrated over 750GB of data, much of which consists of employee email (.pst) files from the company’s email network. The group claims to be ‘watching’ for their ‘eventual incident response.’

The group continued to troll the organization…

“Your blue team kinda sucks. Hard to find good IT help when all your techies are fleeing the country, eh?”

25 March 2022 – 18:36 UTC

Anonymous Releases Files Exfiltrated from the Central Bank of Russia

Anonymous has released data the hacktivists collected while conducting attacks against the Central Bank of Russia. The archive, broken up into 10 separate parts consists of over 25GB of archived data consisting of over 35,000 files of sensitive bank data. Earlier in the campaign, we observed several posts containing targeting information, e.g. domains, IP addresses, etc for the bank on the deep web.

24 March 2022 – 20:49 UTC

GNG Claims to Hack Russian Mail Server, mail.ru

Georgia’s Society of Hackers (GNG) announced today they successfully attacked Russia’s equivalent to Gmail, mail.ru, including their maps.mail.ru subdomain. The hacktivist group is in process of exfiltrating the data and will provide the detailed data dump in the next few days.

As of time of writing this, the maps.mail.ru website is online and operational.

24 March 2022 – 14:11 UTC

Anonymous Shares Proof of Hacked ATMs in Russia

Earlier today, users at what appears to be a Sberbank ATM reportedly located in Russia experienced technical errors when selecting the Russian language on the screen. Upon selection, the ATM monitor quickly flashes to the Ukrainian flag and the words Glory to Ukraine (Слава Україні!). See the video captured video here.

ATM malware is widely circulated on the darknet and used extensively in the fraud and financial crime communities.

24 March 2022 – 10:43 UTC

Pro-Russian Killnet Launches Anonymous-Style Campaign Against Ukraine – Targets Poland and NATO

The pro-Russian cyber threat actor group, Killnet have been conducting attacks against Ukraine for several weeks and have stepped up their demands and threats against Ukraine and western Europe. Today, they released a video on social media, mirroring the ominous messaging of an Anonymous-style video with the Russian flag in the background. During the video, the group stated they would attack targets in Poland for their assistance to the Ukrainian government during the invasion. They recently also posted specific targeting information for the National Bank of Poland on their Telegram channel.

“…together with the Russian cyber army, we disabled 57 state websites of the Kiev regime, 19 websites of nationalist parties…”

The group also referred to the Colonial Pipeline attack in the US from May 2021.

[translated] “Let’s remember American gas company attack, which resulted in 40% paralyzed infrastructure of America for few days.”

23 March 2022 – 16:45 UTC

AnonGhost Claims to Hack Russian Street Lighting System and Drops Proofs of Access to Moxa Industrial Wireless Networking Infrastructure

AnonGhost known for their attacks against industrial control systems, continued their campaign against Russia by targeting МонтажРегионСтрой г. Рязань street light control system. They stated they successfully shutoff the street lights at 19:35 Moscow time and it was a “gorgeous show.”

Shortly before announcing the breach of the lighting contol panel, AnonGhost also provided proof of access to Moxa (moxa.com) industrial networking devices. They leaked proof of access to router information for a industrial wireless Moxa device, its associated OnCell specifications, along with defacement of the device’s name, description, and login message.

In addition to the proofs they linked to a pastebin file containing over 100 Russian Moxa IP addresses for additional targeting.

It’s unclear where the Moxa device compromise is physically located or whether the Moxa compromise provides direct access to the streetlight control system.

23 March 2022 – 02:44 UTC

BeeHive Cybersecurity Claims They Are Running Ransomware Campaigns Against Russian Targets

When one thought they only hijacked Discord users and trolled pro-Russian ‘hackers’ like @a_lead_1, BeeHive Cybersecurity claims they have been quiet because they are running ransomware operations against targets across Russia.

Oh, in case you guys were curious why we’ve been so quiet. May or may not have a new #ransomware operation running in Ru right now. Alas, we find allies quicker than Putin finds ways to invade Ukraine. We’ll have more details soon but…consider this the public disclosure.

This would not be the first Russia-specific ransomware variant to emerge. According to Trend Micro, RURansom was detected targeting Russian-specific devices with AES-CBC encryption and hard coded salt. Another ransomware variant recently detected, known as “Antiwar” appends the file extension, “putinwillburninhell” to encrypted files.

22 March 2022 – 19:14 UTC

ATW (Blue Hornet) Compromises Russia’s Hydrometeorology and Environmental Monitoring Service with Bitbucket

The AgainstTheWest / Blue Hornet team has recently leaked several internal documents from Russia’s Hydrometeorology and Environmental Monitoring service (spelled by the threat actors as ROSHYDRO). According to open sources, the monitoring service is hosted on the meteorf.ru domain. The data leaks consists of 45 PDF files containing historical software change descriptions and feature requests from the company’s internal software development tracking system. ATW refers to a superadmin account for the GIS FEB RAS Team on Bitbucket in the leak.

21 March 2022 – 22:44 UTC

ATW Returns to Campaign with Attacks Against Almaz-Antey

After a disruption in the ATW team’s cyber activities due to personal issues, the ATW/Blue Hornet team returns leaking a 9GB archive of data allegedly exfiltrated by breaching Almaz-Antey’s corporate networks. The data leak includes employee login data, multiple documents containing PII, confidential and classified intellectual property, schematics, and SQL database files.

Almaz-Antey (Russian: ОАО “Концерн ВКО “Алмаз-Антей”) is one of Russia’s largest defense and arms enterprises, known for the development of Russian anti-aircraft defense systems, cruise missiles, radar systems, artillery shells, and UAVs.

21 March 2022 – 15:26 UTC

Anonymous Targets Russian Software Developer, naumen.ru

Hacktivists from the Anonymous collective have leaked data exfiltrated from Naumen, a software vendor and cloud services provider in Moscow. The company markets itself as “world class IT solutions fully adapted to the Russian market” and lists several prominent international companies as partners. The leaked data consists of an SQL database containing thousands of usernames, email addresses, hashed passwords, and associated PII. The specific purpose and origins of the database from inside Naumen is unclear, but partner companies could experience supply chain / vendor risk issues.

21 March 2022 – 03:27 UTC

KelvinSec Targets Nestle for Continued Commercial Operations in Russia

The KelvinSec ‘hacking’ team have reportedly compromised Nestle in retaliation for continuing to operate and distribute their products in Russia. The group leaked multiple databases from Nestle consisting of customer entity data, orders, payment information, and passwords (10GB total). The group insisted its a “partial” database leak and more data may be released in the future.

Nestle defended its business decision after President Zelenskyy called the company out to protestors on Saturday night in Bern, Switzerland.

(Update 3/22 – 01:48 UTC) Anonymous issues warning and gives a number of US companies 48 hours notice to pull out of Russia or become targets of the #opRussia cyber offensive campaign. Example corporations include: Subway, Chevron, General Mills, Burger King, citrix, and CloudFlare.

20 March 2022 – 23:33 UTC

Anonymous Compromises Russian Social Media VK to Send Message to Millions

Anonymous accesses VK’s messaging platform and sends direct messages to over 12 million Russian users of the social media app. The message, written in Russian, speaks to the realities of the war in Ukraine, the demise of the Russian economy, and threatens that users using the Russian “Z” insignia on as their profile avatar will be targeted by international authorities.

VK users have shared proofs of the message received to confirm the campaign in VK occurred.

20 March 2022 – 15:32 UTC

GhostSec Leaks Military Asset Monitoring System and More from Russian Networks

The leak includes data exfiltrated from a military operational readiness monitoring website (orf-monitor.com), including inventory tracking of key Russian military assets; a leak of a Russian investment company that includes recent Chinese contract data; and lastly, technical data leaks from Russian Defense Contractor Kronshtadt, that includes computational specifications related to their UAVs, along with military operational doctrine, etc.

GhostSec teased on their Telegram channel they had more data coming and this archive they were sharing was a sample of a much bigger dataset.

20 March 2022 – 13:40 UTC

Honest Railworkers in Belarus Help Stop Lines Going to Ukraine

According to open source reporting and the hacktivist group known as Cyber Partisans, the railways going out of Belarus into Ukraine have stopped. Earlier in the campaign, Cyber Partisans disrupted rail operations in Belarus using cyber attacks against ticketing systems and switching systems; however, others report that the rails are inoperable due to “honest railworkers” who do not want to see Belarus military equipment transported into Ukraine for use in this war. (Source)

“I recently appealed to Belarusian railway workers not to carry out criminal orders and not transport Russian military forces in the direction of Ukraine. At the present moment, I can say that there is no railway connection between Ukraine and Belarus. I cannot discuss details, but I am grateful to Belarus’s railway workers for what they are doing” – Oleksandr Kamyshin, director of the Ukrzaliznytsya state railroad

20 March 2022 – 10:28 UTC

Arvin Club Takes Down STORMOUS Ransomware’s Tor Onion Service

Shortly after STORMOUS ransomware gang setup a Tor onion service, the Arvin Club ransomware group compromised their site and leaked SQL databases, information, and performance schemas. It’s unclear whether or not this attack occurred out of STORMOUS’s Russian allegiance or if Arvin merely wanted to teach the cyber criminals a lesson in setting up secure sites on the darknet.

The STORMOUS ransomware group had previously operated only on Telegram.

(UPDATE) As of 3/22 the Tor service is still offline.

20 March 2022 – 02:18 UTC

Anonymous Leaks Database from Russian Aerospace Company Utair

Hacktivists from the Anonymous collective have released the customer database for Russia’s Utair airlines. (Russian: ОАО «Авиакомпания «ЮТэйр»). The JSON database appears to have been collected long before the 2022 #opRussia campaign, as the MongoDB is dated 2019. There are records containing personal data for over 530,000 clients using Utair’s services.

18 March 2022 – 21:29 UTC

nB65 Leaks Data from Russian Space Agency

After a disappointing trolling exercise against Kaspersky, the nb65 hacktivist group returns with data leaks from Russia’s Space Agency, Roscosmos. The group claims they still have persistent access to the agency’s vehicle management system and leaked the IP of the compromised network to prove their access. The leaked data archive consists of over 360MB of user and operations manual, along with solar observatory logs.

Hours earlier, the group also claims to have compromised tensor.ru and leaked 1.6GB of compromised emails for a corporate mailbox for the Russian digital signature company.

18 March 2022 – 15:39 UTC

Russia Targets Ukraine Red Cross Website in Cyber Attack

The Ukrainian Red Cross reported their Internet web servers have been hacked, likely by Pro-Russian cyber threat actors. The website domain – redcross.org.ua – is currently offline with the statement “account disabled by administrator.”

The social media account for the Ukrainian Red Cross stated that no personal data of beneficiaries stored on the website were compromised by the cyber attack.

The Ukrainian Red Cross staff and volunteers are busy and actively providing medical aid and support to vulnerable and wounded Ukrainian civilians across the country as Russian military continue their barrage of cruise missile strikes.

17 March 2022 – 11:43 UTC

AnonGhost Leaks Screenshots of GNSS Satellite Hacks Along with IP Addresses

AnonGhost shared several screenshots as proof of attacks they conducted against Russia’s Trimble GNSS satellite interface. They claimed on social media that other “fake Anonymous” accounts had taken credit for the operation. They also leaked 48 unique IP addresses associated with the GNSS satellite systems. The group did not specify the nature of the attacks against the Russian assets.

17 March 2022 – 09:23 UTC

Anonymous Claims to Have Located Putin’s Bunker

Using OSINT analysis involving satellite imagery and topography and landmark comparisons like rivers and powerplants, the Anonymous community claims they have detected President Putin’s bunker. There no means to verify the accuracy of these assertions.

17 March 2022 – 03:58 UTC

Anonymous Leaks 79 GBs of Emails from R&D Department of Transneft – OMEGA

DDoSecrets released the data on behalf of Anonymous hackers operating in cyber campaigns against Russia. Anonymous compromised email inboxes of OMEGA Company, the R&D arm of Russia’s state-controlled pipeline company known as Transneft [Транснефть]. Transneft is the world’s largest oil pipeline company with over 70,000 kilometres (43,000 miles) of trunk pipelines and transports an estimated 80% of oil and 30% of oil products produced in Russia. The emails cover the accounts’ most recent activity, including after the introduction of US sanctions on February 25, 2022. Some of the emails reflect some of the effects of those sanctions.

16 March 2022 – 10:47 UTC

Russian Foreign Intelligence Service (SVR) Requests Information via Tor

Russia’s external intelligence agency has issued instructions on how to establish secure communcations via their Virutal Reception System (VRS) to relay any threats to the Russian Federation. The call for leads, found on svr.gov.ru, details how to install the Tor anonymous network, details the v3 .onion address of their secure communications system, and advises the informant using PGP in order to further encrypt the details of any messages provided.

“If you are outside Russia and have important information regarding urgent threats to the security of the Russian Federation, you can safely and anonymously share it with us via the virtual reception system (VRS) of the SVR over the TOR network.”

If you are in hostile environment and/or have reasons to worry about your security, do not use a device (smartphone, computer) registered to you or associated in any way with you or people from your personal settings for network access. Relate the importance of information you want to send us with the security measures you are taking to protect yourself!

15 March 2022 – 11:48 UTC

Pro-Russian Group Xaknet Threatens to Attack Critical Infrastructure Information Centers

“We cannot endlessly give you ‘lessons of politeness.’ We demand the cessation of hacker attacks against Russian infrastructures, we demand the cessation of the activities of information centers for the dissemination of fakes.

In case of refusal, we will be forced to use the most sophisticated methods, and reserve the right to act as the enemy does. Critical information infrastructure facilities will become a priority target for the group. All work will be aimed at the complete destablization of the activities of the aforementioned CIIs.”

It’s unclear from the threats what specific websites or services the cyber threat group considers critical infrastructure information services. The IT Army of Ukraine’s extensive information operations spread across most all social media platforms and information communication mediums across Russia.

15 March 2022 – 07:19 UTC

User on Telegram Leaks New Letter from FSB

A user on pro-Ukrainian Telegram channel (name redacted) has released a new letter, reportedly from an FSB agent, translated into English.

The temperature has really risen here, it’s hot and uncomfortable. I won’t be able to communicate for some time here in the future. I hope we can chat normally again in a few days. There are a lot of things that I have to share with you…
The questions are raised by the FSO (Federal Protective Service of the Russian Federation, aka Putin’s Praetorian Guard) and the DKVR (Russian Military Counterintelligence Department). It is precisely the DKVR that is mounted on horseback and is looking for “moles” and traitors here (FSB) and in the Genstaff (General Staff of the Armed Forces of the Russian Federation) regarding leaks of Russian column movements in Ukraine. Now the task of each structure is to transfer the fault to others and to make the guilt of others more visible. Almost all members of the FSB are busy with this task at the moment.

The focus is on us more than others at the moment, due to the hellish circumstances regarding the intra-political situation in Ukraine: We (the FSB) have released reports that at least 2,000 trained civilians in every major city of Ukraine were ready to overthrow Zelensky (President of Ukraine). And that at least 5,000 civilians were ready to come out with flags against Zelensky at the call of Russia. You want to laugh ? We (FSB) were supposed to be the judges to crown Ukrainian politicians who were supposed to start tearing each other apart arguing for the right to be called “Russia’s allies.” We even set criteria on how to select the brightest of the most competent (among Ukrainian politicians). Of course, some concerns have been raised about the possibility that we may not be able to attract a large number of people (Ukrainian politicians) to Western Ukraine, to small towns and to Lvov itself. What do we actually have? Berdyansk, Kherson, Mariupol, Kharkiv are the most populated pro-Russian areas (and there is no support for Russia even there). A plan can fall apart, a plan can be wrong. A plan can give a result of 90%, even 50%, or 10%. And that would be a total failure. Here it is 0.0%.

There is also a question: “How did this happen?” This question is actually a (misleading) trap. Because 0.0% is an estimate derived from many years of work by very serious (high-ranking) officials.
And now it turns out that they are either agents of the enemy or simply incomprehensible (according to the FSO / DKVR who are now looking for “moles” within the FSB).

But the question does not end there. If they are so bad, then who appointed them and who controlled their work? It turns out that they are people of the same quality but of a higher rank. And where does this pyramid of responsibilities stop? At the boss (Putin).
And this is where the evil games begin: Our dear Александр Васильевич (Alexander Vasilyevich Bortnikov – Director of the whole FSB) cannot fail to understand how badly he got caught. (Bortnikov realizes the deep mess he is in now)

And our evil spirits from the GRU (Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation) and the SVR (Foreign Intelligence Service – equivalent to the CIA) understand everything [and not only from these two organizations]. The situation is so bad that there are no limits to the possible variations (of events that will happen), but something extraordinary is going to happen.”

Shortly after a first letter from an FSB whistleblower surfaced around 5 March, Putin quietly placed his FSB chief, Sergei Beseda and his deputy on house arrest last Sunday. While telling the public he arrested them for embezzlement charges, according to open-source reports, the “real reason is unreliable, incomplete, and partially false information about the political situation in Ukraine” and Putin is holding them responsible for the Ukrainians’ success in the invasion thus far.

14 March 2022 – 12:00 UTC

Russian State Duma of the Federal Assembly Confirms Censorship of VPNs

Citing it was “a difficult task” Alexander Khinshtein, chairman of the State Duma Committee on Information Policy, commented that Russia’s media and propaganda agency, Roskomnadzor has been tasked with blocking over two dozen VPNs [virtual private networks] across Russia. (Source)

We anticipate that number to increase as Putin continues to crack down on Russian citizens’ media consumption.

VPNs have been targeted by Russian authorities since 2017, when an initial VPN law was passed. In 2019 many of the VPN providers across Russia received compliance demands from Roskomnadzor representatives via email – captured in the image below.

The demand for VPNs in the country has reportedly increased by over 2,000% in the last month. Users on Telegram encourage widespread use of anonymity tools like VPNs and Tor, and share links to VPN services still in operation and accessible in the region. Many of the VPNs are available via Telegram directly and offer free trial subscriptions to Russian users.

14 March 2022

Russian Cyber Actors Setup IT Army of Russia Group

The collective of cyber threat actors self identifies as the “IT Army of Russia”, mirroring the IT Army of Ukraine Telegram initiative, and claims it has targeted critical Ukrainian cyber services with DDoS attacks. The group has less than a 100 subscribers and many of the members are affiliated with the Killnet forum.

The group recently posted a detailed dox containing personal information for President Volodymyr Zelenskyy [in Ukrainian: Володимир Олександрович Зеленський]. The dossier contains specific information such as his date of birth, passport number, car registration details, and familial associations.

13 March 2022 – 09:31 UTC

Anonymous Germany Exfiltrates Data from Russian Rosneft Operations in Germany

An Anonymous hacktivist group from Germany, referring to themselves as “AnonLeaks” had access to the networks of Russia’s Rosneft subsidiary in Deutchland for almost two weeks and exfiltrated over 20 terrabytes of corporate data. According to a preliminary review, the data consists of laptop backups, virtual disk images, excel files, work instructions, and other operational information for the refinery.

Anonymous Germany emphasizes they did not have access to critical infrastructure in Germany, nor was the intent of their operation to access critical infrastructure for the refinery or compromise it in any way.

Rosneft is Germany’s third largest petroleum refinery company, processing roughly 12.5 million tons of crude oil per year.

(Update) Details of the leaked data has appeared on a dedicated Tor darknet service setup by the hacktivists.

13 March 2022 – 07:19 UTC

nB65 Claims to Be Jonathan Scott, a US-based Malware Researcher

Since the invasion, a social media account reportedly affiliated with the group nB65 was extremely active in sharing their leaks and targets across Russian networks – including claims of accessing Roscomos Space Agency. Most recently, they stated they had access to Kaspersky’s source code, with many teasers in the hours leading up to a what amassed to a disappointing dump of publicly available code from the Russian antivirus software developer. The group essentially trolled Kaspersky and received heavy criticism from members of the information security research community.

The owner of the group’s Twitter account claimed today they were in real life, Jonathan Scott, a US-based Computer Science PhD student researching mobile spyware and IoT malware. Shortly after, the Twitter account for the group was deleted.

11 March 2022 – 06:25 UTC

GhostSec Claims to Access, Shutdown, and Deface Control Panel of Russian ICS via SCADA Attack

GhostSec continues their offensive against Russian critical infrastructure with attacks affecting industrial controls systems. Today, they claimed they successfully accessed an unknown Russian industrial control system, deface the control panel, and shut the system down. They also stated they deleted the backups to make restoring services more challenging.

They included the screenshot below which appears to correlate to a typical ICS system. The name or location of the network was not identified.

11 March 2022 – 01:34 UTC

BeeHive Cybersecurity Enters Campaign and Targets Pro-Russian Discord Users

A pro-Ukrainian group, known as “BeeHive Cybersecurity” claims to have attacked over 2,700 pro-Russian Discord users, compromising their accounts and defacing their profiles with statements about the realities in Ukraine posted in English, Ukrainian, and Russian.

The group insinuates that they “CnC [command and control] the platforms of the ignorant” and use compromised devices to help combat disinformation.

10 March 2022 – 12:30 UTC

KelvinSec Leaks Private Chats from Darknet Tor Service: Database Market

KelvinSec, a pro-Ukrainian cyber threat actor on the darknet, has leaked 3,178 files containing the private chats from DATABASE Market. DATABSE is a relatively newly-launched service on Tor, where carding and fraud cyber-criminals congregate and transact.

The service is allegedly hosted by IT Resheniya on the IP address 45.155.204.178. KelvinSec reported they infilitrated the market via an insecure direct object reference vulnerability, commonly called “IDOR” which gives an attacker access to the website’s hidden information.

The compromised Tor service is still active as of time of writing.

10 March 2022 – 11:24 UTC

DDoSecrets Leaks Over 800GB of Data from Russian Media Censor, Roskomnadzor

The whistleblower leak site, DDoSecrets has obtained 360,000 files from Роскомнадзор (Roskomnadzor) via hacktivists from the Anonymous campaign against Russia. Roskomnadzor is a Russian state-controlled agency responsible for monitoring, controlling and censoring Russian mass media. The agency is responsible for the recent crackdowns on digital bans of Facebook, Twitter, and YouTube. The two part dataset totals over 800 GB including files, emails, and information critical about their operations.

10 March 2022 – 08:35 UTC

GhostSec Hits Hundreds of Printers Across Russia

GhostSec reportedly hacks hundreds of printers across Russia to spread the message about realities in Ukraine. They tagged on to the announcement an obscure 4chan meme, “Hey Russia do you liek mudkipz?” on their Telegram channel. The stated they are targeting Russian government and military networks for the printer exploit.

9 March 2022 – 20:05 UTC

Pro-Russian Group, devilix-EU Joins Campaign Against Ukraine and the US

Late last week, a new Pro-Russian persona appeared on social media and began sharing pro-Russia propaganda, Pro-Trump rhetoric, and counter #opRussia Anonymous content. Over the last five days, they’ve ramped up their attacks claiming to have compromised AWS instances, Microsoft IIS sysstems, and performed BGP hijacking with mentions of several US-based IP addresses.

The group makes further claims that they’re named after their own custom ransomware, “DEVILIX shark.”

DEVILIX named as me is one of the strongest viruses on the world DEVILIX shark is ransomware which can do anything we can create BotNet. where we want. Just a Simple but it’s not.

They most recently shared their thoughts about the cyber war in Russian, declaring that this was not about Ukraine and Russia, but the US and NATO and their intent to keep Russia and Ukraine divided.

Я вижу, что речь идет о двух сторонах, России и Украине. Почему мы разделены из-за политики? Разве вы не видите, что здесь делает Запад и хочет, чтобы мы были разделены. НАТО избежало конфликтов, и теперь привет! Слава России

[Google Translate]

I see that we are talking about two sides, Russia and Ukraine. Why are we divided because of politics? Don’t you see what the West is doing here and wants us to be divided. NATO has avoided conflicts, and now hello! Glory to Russia

8 March 2022 – 21:05 UTC

Anonymous Hacks Hundreds of Russian Security Cameras, Many Affiliated with Russian Government Ministries

Hacktivists from the Anonymous Collective successfully tapped the security camera feeds of hundreds of retail businesses, restaurants, schools, and government installations across Russia. They setup a website to share the leaked camera feeds — all to discover some where critical security offices. Anonymous also defaced security camera displays with the message:

Putin is killing children
352 Ukrainian civilians dead
Russia lied to 200rf.com
Slava Ukraini! Hacked by Anonymous

8 March 2022 – 18:34 UTC

nb65 Group Claims to Have Acquired Kaspersky’s Source Code

After keeping quiet for several days, the group sent out mysterious posts across social media claiming to have accessed Kaspersky source code and found “interesting relationships” in this code.

They also claimed it was “sloppier than Putin’s invasion.”

7 March 2022 – 17:31 UTC

22nd Member of Notorious TrickBot Gang Doxxed

The pro-Ukrainian affiliate of the Trickbot cybercriminal empire has leaked the personal identity of 22 key members of the gang along with private chats between group members. Since the 4th of March, DarkOwl has seen the following aliases mentioned: baget, strix, fire, liam, mushroom, manuel, verto, weldon, zulas, naned, angelo, basil, hector, frog, core, rocco, allen, cypher, flip, dar, and gabr.

7 March 2022 – 13:01 UTC

Digital Cobra Gang Claims 49 “A-Groups” Led by Conti and Cobra Are Attacking America Cyberspace

The Pro-Russian group entered the campaign shortly after Anonymous started #opRussia (28 Feb) with the statement:

“DIGITAL COBRA GANG DCG has officially declared cyber war on hackers who attacking Russia as well and to protect justice”

They’ve given little indication of success, other than inflated claims they have acquired over 92Tb data from US’s military personnel files but no proof has been published.

Earlier today, they posted that members of Conti were helping and 49 “A-team” groups were hacking Amera.

(9 March 2022) – US AWS and Azure cloud platforms have experienced higher than normal traffic on the network but no major disruptions.

7 March 2022 – 06:44 UTC

RedBanditsRU Leaks Russian Electrical Grid Source Code Data

The pro-Russian group, originally assembled to counter-hack Anonymous and cyber actors targeting Russian organizations, posted today that they are leaking the source code Rosseti Centre’s [mrsk-1[.]ru] electrical grid networking infrastructure. Rosseti Centre provides reliable electricity for more than 13 million people in the subjects of the Central Federal District of the Russian Federation.

The group is sharing this information because they believe Putin and his supporters are “leading this country to an apocalypse state.”

DarkOwl warns security researchers opening these archives should always use isolated sandbox environments in the event there is malware and viruses included in the leak.

7 March 2022 – 04:55 UTC

AgainstTheWest (ATW) Returns to the Fight and Drops Multiple Leaks of Russian Corporate Data

In the last 24 hours, ATW dropped URLs for at least 7 leaks corresponding to various Russian technical companies and organizations, reportedly breached by the cybercriminal group. ATW’s participation in the campaign has been controversial as they have had multiple dramatic departures and returns to the campaign and reports of “health issues” of some of the team’s members.

Security researchers reviewing the information from dataleaks last week calls into question the veracity of the information ATW is sharing. Checkpoint released analysis stating that after, “checking their claims deeper reveals that for many of the claims there are no solid proofs apart of very generic screenshots that are allegedly from the breached organizations.”

(Update 7 March 2022 – 18:36 UTC) The group also posted to their Telegram channel that they had successfully breached a Russian cybersecurity company that has been “hording” US-based government data, exposure of multiple SonarQube instances and requested someone get in touch with them immediately. It’s unclear if this is legitimate or just further ego inflation.

6 March 2022

Free Civilian Tor Service Leaks Entire DIIA Contents

Recently, the administrator of Free Civilian shared a post on their Tor service containing the entire Ukraine’s DIIA database of users. They stated the buyer of the database consented to the release, with the understanding some records were deleted. The downloads consist of 60+ archives containing gigabytes of data. The download links have been unstable since DarkOwl discovered them.

The administrator also expressed desire to have the ban on their “Vaticano” Raid Forums account lifted, claiming this leak proved the legitimacy of the information they shared back in January.

Recently, screenshots of an indictment for the alleged seizure of Raid Forums on VeriSign has been in circulation, after users spoke of rifts between pro-Ukrainian users and Russian hackers, potential FBI seizures, and the alleged hijacking the alias of former admin Omnipotent on Darknet World. Prominent users from the forum have setup RF2 and advised any old working Raidforums links are likely phishing logins for the FBI.

6 March 2022 – 18:43 UTC

Anonymous Continues Information Warfare Against Russian Media; Video Services Wink and ivi Stream Anti-War Messaging

After Putin’s overt authoritarian take on media sharing the realities of the war in Ukraine, Anonymous managed to hack Russian video services Wink and ivi to stream pro-Ukrainian messages and video of the conflict.

This weekend, Putin’s parliament passed a “fake-news” law imposing prison sentences for media using the words “war” or “invasion” prompting numerous western outlets to pull their journalists and suspend operation.

6 March 2022 – 15:39 UTC

AnonGhost Enters Campaign and Claims SCADA Attacks Against Multiple Russian Infrastructure Targets

This weekend, AnonGhost entered Anonymous’ #opRussia campaign with a vengence, and claims today they have hacked multiple Russian infrastructure control systems via SCADA attacks and “shut it down.”

They list the following targets:

Волховский РПУ> Volkhov RPU
Бокситогорский РПУ> Boksitogorsk RPU
Лужский РПУ> Luga RPU
Сланцевский РПУ> Slantsevsky RPU
Тихвинский РПУ> Tikhvinsky RPU
Выборгское РПУ> Vyborg RPU

This is after they leaked data from 9 Russian commercial servers hours earlier.

azovkomeks[.]ru
vserver24[.]ru
dvpt[.]ru
ach[.]gov[.]ru
itmo[.]ru
vpmt[.]ru
pvlt[.]ru
hwcompany[.]ru
corbina[.]ru

DarkOwl is in the process of pulling in this data to review and assess the contents of all of the databases.

The AnonGhost group is reportedly one of the more senior anonymous hacktivist teams in the underground, with reporting of the group going back to the early 2010s. According to open-source reporting, AnonGhost was led by Mauritania Attacker. In an online interview with a hacker’s blog in 2013, Mauritania Attacker claimed to be a 25 year old male from Mauritania who started hacking at a young age by joining TeaMp0isoN and ZCompany Hacking Crew (ZHC), two hacking groups known for their attacks of high-profile targets such as NATO, NASA, the UN, and Facebook. (Source)

For those who remember Stuxnet, SCADA type attacks are controversial as there is a fine line between disruption and destruction. Services knocked offline but able to be restored is disruptive and inconvient, causing delays in operation and psychological concern over the safety of such services. However, disruptions that lead to destructive events, e.g. hard disks wiped and unrecoverable, de-railed trains, power plant overheating resulting in explosions, & satellites falling out of the sky are considered serious and may be interpreted as an act of war and result in severe retaliation.

Yesterday, Putin declared western sanctions an act of war and uttered similar threats about hacking satellites earlier this week.

6 March 2022 – 14:52 UTC

GhostSec Returns with Leaks from Russia’s Joint Institute for Nuclear Research (JINR) and Department of Information (DOI) FTP Server Data

Hours ago, an archive consisting of several gigabyte emerged from GhostSec reportedly containing information from Russia’s nuclear research and disinformation activities. GhostSec has been silent for most the last week, perhaps busy with this activity.

According to their website (jinr.ru), the Joint Institute for Nuclear Research is an international intergovernmental organization established through the Convention signed on 26 March 1956 by eleven founding States and registered with the United Nations on 1 February 1957.

As of time of writing, the public facing website is online.

6 March 2022 – 12:34 UTC

Anonymous Dumps Leak of 139 Million Russian Email Addresses

An archive of over 139 Million email addresses, broken up into 15 separate files with mail_ru at the beginning of each file, lists the email addresses for presumed account holders for mail_ru services. VK (VKontakte) assimilated mail.ru email services into its internet services conglomerate in the fall of 2021.

The files included two additional HTML files with ominous warnings – possibly shared on the servers from which these leaks were obtained.

[image translation]

Russian soldiers!
If you think that you are going to an exercise, in fact you are being sent to Ukraine to DIE.

DarkOwl has not determined the veracity of this data, nor confirmed how these emails were obtained; some combolists of this nature are created as an aggregation of other leaked data.

As of time of writing, mail.ru’s public facing website is still online and operational.

5 March 2022 – 20:41 UTC

Anonymous Targets Russian FSB; Letter Appears from Possible FSB Whistleblower

The Federal Security Service (FSB) of the Russian Federation [Федеральная служба безопасности (ФСБ)] is the principal security and intelligence agency of Russia and the main successor agency to the Soviet Union’s KGB.

Earlier today, Anonymous hacktivists targeted the FSB (at the direction of the IT Army Ukraine) and managed to take the external facing website offline. Rumors on social media and chatrooms suggested Anonymous managed to “breach” the FSB’s server.

Shortly after the announcement of the website’s offline status (e.g. #TangoDown) a deep web paste emerged containing a list of 62 subdomains for the fsb.ru domain. This could be for additional targeting and exploitation.

The stability and alliances of members of the FSB are in question by threat intelligence and security researchers across the community. Last night, an alleged FSB whistle-blower letter surfaced (via the founder of http://gulagu.net) that damned Russia’s military performance in Ukraine and predicted a disaster for the RU in the next weeks and months. An English translation of the letter has appeared in the deep web (excerpt below).

To be honest, the Pandora’s box is open – a real global horror will begin by the summer – global famine is inevitable (Russia and Ukraine were the main suppliers of grain in the world, this year’s harvest will be smaller, and logistical problems will bring the catastrophe to a peak point). I can’t tell you what guided those at the top when deciding on the operation, but now they are methodically lowering all the dogs on us (the Service).

We are scolded for analytics – this is very in my profile, so I will explain what is wrong. Recently, we have been increasingly pressed to customize reports to the requirements of management – I once touched on this topic. All these political consultants, politicians and their retinue, influence teams – all this created chaos. Strong. Most importantly, no one knew that there would be such a war, they hid it from everyone.

And here’s an example for you: you are asked (conditionally) to calculate the possibility of human rights protection in different conditions, including the attack of prisons by meteorites. You specify about meteorites, they tell you – this is so, reinsurance for calculations, nothing like this will happen. You understand that the report will be just for show, but you need to write in a victorious style so that there are no questions, they say, why do you have so many problems, did you really work badly. In general, a report is being written that when a meteorite falls, we have everything to eliminate the consequences, we are great, everything is fine.

And you concentrate on tasks that are real – we don’t have enough strength anyway. And then suddenly they really throw meteorites and expect that everything will be according to your analytics, which was written from the bulldozer.

That is why we have a total piz_ets – I don’t even want to pick another word.

5 March 2022 – 16:37 UTC

Anonymous Claims to Breach Yandex (Russia’s Mail and Search Service); Leaks Account Credentials

DarkOwl discovered two leaks shared through the Anonymous hacktivist collective network consisting of over 5.2 Million user accounts’ email addresses and password combinations. We are in the process of analyzing this data leak to determine the veracity of its contents. 1.1 Million Yandex accounts were previously dumped in 2014. Many hackers are using #opRussia to opportunistically claim clout for breaches that did not occur, when in reality they are circulating old previously dumped data and/or verifying accounts by credential stuffing.

5 March 2022 – 15:23 UTC

Paypal Suspends Service in Russia

Paypal announced on LinkedIn they would be halting its operations in Russia; a statement released days after suspending signing up new users on the payment platform on Tuesday. Dan Schulman, CEO wrote:

We remain steadfast in our commitment to bring our unique capabilities and resources to bear to support humanitarian relief to those suffering in Ukraine who desperately need assistance. We will also continue to care for each other as a global employee community during this difficult and consequential time.

On Wednesday, 3 March, the IT Army of Ukraine launched a petition calling for all supporters to sign a petition on change.org:

[TRANSLATION]

While Ukraine protects its people and places, and Russia faces the radical consequences of its war crimes, the most popular payment service via PayPal is still available to the aggressor. This means that it also helps finance the bloody war against Ukraine through PayPal.

We are absolutely sure that modern technologies are a powerful response to tanks, grads and missiles. We call on the company to block its services in Russia via PayPal and launch them in Ukraine, as well as provide an opportunity to raise funds to restore justice and peace in our country and the world.

5 March 2022 – 15:03 UTC

Anonymous Leaks Private RocketChat Conversations from Russian Government Officials

Anonymous is targeting Russia by any means possible and managed to collect private chats between Russian officials on the messaging service, rocket.chat. After review, these chats are different from the ones dropped by @contileaks last week.

The chat includes the network ID, username, and “real name” of 14 members of the chat group. The domain associated with the leak corresponds to the official website of the Russian government and the Governor of the Moscow region.

5 March 2022 – 06:04 UTC

squad303 Sets Up SMS Messaging System to Text Random Russian Citizen Phone Numbers

With the lack of Russian media coverage of the invasion of Ukraine and the intentional misinformation spread by Putin’s disinformation agencies, a pro-Ukraine hacktivist collective, known as squad303 setup an SMS messaging system for citizens around the globe to use to randomly text Russian citizens a scripted message about the nature of world events.

The squad303 team also setup an API for more advanced users.

Update: As of 8AM UTC, 6 March 2022, the service had been used to send over 2 Million texts Russian mobile phone numbers.

The team also reports of suffering from heavy DDoS attacks from pro-Russian cyber actors.

5 March 2022 – 02:34 UTC

Anonymous Hackers Claim to Have Accessed Communication Data for a Russian Military Satellite

After nb65’s reported success accessing Roscosmos earlier this week, it appears that members of the Anonymous collective under the campaign #opRussia have ventured into breaching the communications of Russian military satellite for data collection. The satellite – designated COSMOS 2492 (aka glonass132) is likely active in geospatial intelligence collection over Ukraine for Russia. (note: the original indication of the connection occurred 4 March 2022 @ 09:35 by Anonymous collective member, @shadow_xor.)

DarkOwl also uncovered a leak shared by LulzSec member @shadow_xor titled, “Leak_RUSAT_shadow_xor.zip” which contains significant geopositioning data since the satellite’s launch in 2014. The hacker stated they could not change the coordinates of the satellite, but did capture orbital, passage, and communications data.

Our original reporting on this suggested the hackers were Russian-based, but further analysis only indicated that a number of Russian-based hackers supported the attack on COSMOS 2492.

4 March 2022 – 18:16 UTC

Putin Officially Bans Facebook in Russia

In order to combat the information operations campaign against them online, Putin ordered for ISPs to block Facebook servers and websites across Russia. Security researchers also note an uptick in Russian trolls on social media with bot accounts promoting Putin’s military operations in Ukraine.

Putin’s parliament also passed a law imposing prison terms of up to 15 years for individuals spreading intentionally “fake news” about the military. The terms “invasion” and “war” are no longer allowed in press and media coverage.

Several foreign and Western media outlets, including BBC, CNN, and Bloomberg, have temporarily suspended reporting on the war from Russia.

4 March 2022 – 09:44 UTC

NB65 Teases Information Security Community with Riddles on their Activities

NB65 – the pro-Ukrainian group who claimed responsibility for accessing and shutting down Russia’s spy satellites via SCADA vulnerabilities – teased the information security community that they been quiet cause they were parsing and analyzing numerous vulnerabilities in Russian cyber targets.

If we seem quiet, it’s because we have an olympic sized swimming pool worth of data and vulnerabilities. But here’s some fun that you can participate in…

DarkOwl discovered a post matching the target hidden in the riddle and the content suggests the group has access to RUNNET: Russia’s UNiversity Network.

4 March 2022

IT Army of Ukraine Calls for Volunteers to Support the Internet Forces of Ukraine

Ukraine’s Ministry of Digital Transformation steps up its information warfare against Putin’s propaganda by forming the Internet Forces of Ukraine (ITU). Forming a separate Telegram channel at the start of the month, the channel is dedicated to posting instructions and guidance for citizens around the world that want to aid Ukraine and lack an IT/cybersecurity background.

Друзі, наш ворог, окрім наявної війни у наших містах та селах, веде також інформаційну війну. Не вірте фейкам, не вірте брехні пропаганди путіна – ніякої капітуляції України НЕ БУДЕ!!! У нас потужна армія, ми сильні духом і нас підтримує весь світ! Тому, не ведіться на провокації і вірте в Україну. Поширюйте це серед рідних та близьких у соціальних мережах, щоб вони також не велись на нісенітниці кремля. Ми разом і ми переможемо!!🇺🇦

Friends, our enemy, in addition to the existing war in our cities and villages, is also waging an information war. Do not believe fakes, do not believe the lies of Putin’s propaganda – there will be no capitulation of Ukraine!!! We have a powerful army, we are strong in spirit and we are supported by the whole world! Therefore, do not be fooled by provocations and believe in Ukraine. Spread this to your family and friends on social networks, so that they also do not fall for the Kremlin’s nonsense. We are together and we will win!! 🇺🇦

4 March 2022 – 01:46 UTC

Trickbot Gang Members Doxxed and Links to FSB Confirmed

At 15:00 UTC, before DarkOwl could even finish analyzing the ContiLeaks, a Ukrainian-aligned underground account leaked details of key members of the infamous TrickBot gang. Over the course of the day at a cadence of every 2 hours, dossiers for the individuals appeared on social media. Private chats between members of the gang were included with each of the leaks. 7 male members and their aliases identified: baget, fire, strix, mushroom, manuel, verto, and liam. Twitter has since suspended the account.

3 March 2022 – 20:54 UTC

Russian-Aligned Hackers Target Anonymous Hacktivists in Canada

A pro-Russian cyber group using the name Digital Cobras, claims to have been targeting #opRussia hackers from the Anonymous collective across the US, UK, Greece, and Canada. Earlier today, they posted several names of individuals along with pictures of some of the alleged members of Anonymous.

They also claimed to have “hacked Anonymous’ servers” and downloaded over 260gb of their files and tools. They also claimed to have full access of the administration of Tor Project, including their crypto accounts.

Anonymous does not possess servers or centrally locate their information or tools as it is an organic decentralized collective of hacktivists around the world. Similarly, the Tor Project is run by a network of volunteers.

It is very likely this group is designed to spread disinformation and FUD.

3 March 2022

Size of Zeronet Anonymous Network Increases Since Invasion

In the week since the Putin launched an invasion against the Ukrainian people, DarkOwl has noticed an increase of 385 Zeronet domains in the last week and a near 20% increase in the network’s activity. Zeronet has been historically most heavily used by Chinese threat actors. The trend in “new domain” activity appears to have started on or about February 27th, within hours after the IT Army of Ukraine rallied the underground.

The Tor Project has reported significant increases in the number of unique addresses on Tor on the same day.

3 March 2022 – 17:10 UTC

Anonymous Leaks Database Containing Bank Account Holders Information

bkdr – member of the Anonymous hacktivist collective – released an Excel spreadsheet containing the personal information of over 8,700 business bank account holders in Russia. Full names, passport, DoBs, account standing, etc are included in the file.

3 March 2022 – 15:40 UTC

Pro-Russian Cyber Team, Killnet Claims To Hack Vodafone Services in Ukraine

Killnet, a Pro-Russian organized threat actor has claimed they were successful in attacking Vodafone’s telecommunications services across Ukraine. The group shared links to the vodafone.ua website (as offline) and network graphs proving the website suffered an outage.

The group also claims to have attacked “Anonymous” networks directly, prompting criticism as the Anonymous hacktivist has no central severs or repositories.

[Google Translate]

Cellular communication services under the Vodafone trademark on the territory of Ukraine are provided by the partner of Vodafone Group plc, PRO “VF Ukraine”

⚠ OUR ATTACK WAS REPELLED [REFLECTED] AFTER 4 HOURS.

3 March 2022 – 05:22 UTC

Anonymous Breaches Private Server in Roscosmos and Defaces Website

v0g3lSec – member of the Anonymous hacktivist collective – claims to have infiltrated private servers at the Russian Space Agency, Roscosmos and exfiltrated files from their Luna-Glob moon exploration missions. The archive consists of over 700 MBs. Many of the files are drawings, executables, and technical documents dating back to 2011. A scientific review of the content would be needed to assess the value of the information collected.

In addition the website for the Space Research Institute (IKI) Russian Academy of Sciences (RAN) was also defaced by the same group.

3 March 2022 – 01:11 UTC

Anonymous Leaks Data from Rosatom, Russia’s State Atomic Energy Corporation

According to DarkOwl’s preliminary review of the 74 files, the leak appears to be a mixture of budget data, conference materials, powerpoint presentations, and technical files dating back to 2013. There is random mixture of information included that it is unclear whether this was obtained directly from a breach of the corporation’s servers, an employee at the organization, or collected via OSINT and compiled for use in #opRussia.

“There is no place for dictators in this world. You can’t touch the innocent, Putin. No secret is safe. State Atomic Energy Corporation Rosatom has been hacked!”

2 March 2022 – 19:55 UTC

ATW Quits Campaign – Cites Conflict with Anonymous, Attribution, and Twitter Suspension

Drama in the group started yesterday with AgainstTheWest claiming Anonymous was taking credit for their successes in the cyber war against Russia. They briefly turned their attention to China announcing several new victims, including the Chinese Science, Technology and Industry for National Defence organization. After their suspension from Twitter earlier today, they announced retirement claiming they had no means for communicating with the public. (Analysts note rebrand to BlueHornet occurred shortly after their announcement)

2 March 2022 – 19:09 UTC

Conti Leak Source Code, Panel, Builder, Decrypter Appear on Darknet Forum

Less than 48 hours after a pro-Ukrainian leaked the infrastructure of the CONTI gang’s operation, including botnet IP addresses and source code executables, users begin circulating the ransomware gang’s critical data across popular darknet forums and discussion boards.

2 March 2022 – 16:35 UTC

Leak Documents Surface Proving War Against Ukraine was Approved on 18 January

Anonymous hackers released photographs of captured documents from Russian troops titled, “WORKING MAP”, and authored by the commander of Russia’s Bomb Battery of the Black Sea Fleet. The maps and documents affirm to the public that the invasion of Ukraine was approved on January 18th with intention to seize the country sometime between 20 February and 06 March 2022. Liveuamap, under intermittent DDoS since this started, confirmed the data.

2 March 2022 – 13:52 UTC

XSS Admin Reports XMPP Jabber Service Ransomed and Heavy DDoS Attacks

A darknet forum popular with the Russian-speaking community has been experiencing technical issues, suffering from Jabber service outages and heavy DDoS attacks. The forum is well known in the darknet for malware discussions and coordination of attacks. The admin shared a post that the jabber service was hit with ransomware and the contents of the chats wiped from the services. They nonchalently suggested users register and continue using the service.

[Translated]

The server didn’t work yesterday. Because of ransom (which, by the way, is prohibited here) we were listed in a spamhouse. Instead of reporting the violation, the “brilliant” spamhouse immediately leafed through us. In principle, for many years I got used to their “adequacy”. I’m not surprised at anything. We have more than 21,000 users, and no one is able to check everyone. To do this, in fact, they came up with feedback contacts (xmpp, e-mail), they are listed everywhere.

Why, I wonder, they don’t block gmail.com ? So many, so to speak, violators of law and order use it, and nothing, for some reason they are not immediately listed.

In parallel with this, a powerful DDoS attack was conducted on us.

Our XMPP project is not commercial, completely free and subsidized. I’ve never understood the point of attacking toads.

At the moment, the functionality has been restored.

An unpleasant moment. Backups according to the law of meanness turned out to be broken. The last one alive was a week ago. Suddenly someone has lost contacts or a toad has disappeared, re-register.

2 March 2022 – 10:33 UTC

Leak Appears with Russian Air Force Officer’s Information

Anonymous leaked another database containing the personal information for over 300,000 of Russia’s military personnel and civilian citizens. The archive, titled “Translated Base Database” contains 35 separate database files containing personal details of the individuals. Information includes: full name, date of birth, age, passport number, address, occupation, etc.

1 March 2022 – 20:46 UTC

Russian Criminal Gang TheRedBanditsRU Recruits on Social Media – Offers Payments for Affiliates

The RedBandits openly recruit “affiliates for certain jobs” stating they did not want white hats, but that they want to “speak to exploit Devloplers, Spammers (phishing skills, vishing etc), Pentesters. We’re building an army!” They incentivize skilled hackers to join their cause for monetary gain, claiming partners would be paid well and to apply directly via qTox.

Earlier today, the group claimed that they did not agree with Putin as a leader nor of his invasion of Ukraine, but will protect him as a citizen of Russia.

“War is good for no one, come, take my hand, make money help your family”

1 March 2022 – 12:57 UTC

STORMOUS Ransomware Group Aligns With Russia

The STORMOUS ransomware group, which has been targeting international victims with their ransomware strain for months, claimed their alliance with the Russian government and threatens greater attacks against Ukraine.

The STORMOUS team has officially announced its support for the Russian governments. And if any party in different parts of the world decides to organize a cyber-attack or cyber-attacks against Russia, we will be in the right direction and will make all our efforts to abandon the supplication of the West, especially the infrastructure. Perhaps the hacking operation that our team carried out for the government of Ukraine and a Ukrainian airline was just a simple operation but what is coming will be bigger.

1 March 2022 – 09:26 UTC

Ukrainian Paper Leaks Personal Data for 120,000 Russian Military Personnel

In an effort to target the Russian soldiers invading Ukraine, the Centre for Defence Strategies in Ukraine has acquired the names and personal data of 120,000 servicemen who are fighting in Ukraine. Ukrainian newspaper, Ukrayinska Pravda has leaked the details of the soldiers which could be one of the biggest information warfare campaigns using doxing mid-military conflict, ever seen.

The doxxed soldiers are likely to face increased engagement on social media and direct phishing attacks.

1 Mar 2022 – 00:38 UTC

NB65 Takes on Russia’s Satellite Technology

nB65 claims that they successfully accessed Russia’s Roscosmos Space Agency and deleted the WS02, ‘rotated’ the credentials and shut down the server. They did not provide any leaks with the social media announcement.

The Russian Space Agency sure does love their satellite imaging. Better yet they sure do love their Vehicle Monitoring System.

Network Battalion isn’t going to give you the IP, that would be too easy, now wouldn’t it? Have a nice Monday fixing your spying tech. Glory to Ukraine.

28 February 2022 – 23:54 UTC

ATW Targets Russia’s Electrical Grid

AgainstTheWest Leaks Information from Russia’s PromEngineering corporation. Archives of corporate emails between employees, clients, vendors, as well as blueprints and engineering documentation for power stations around Russia are included in the leak.

28 February 2022 – 22:00 UTC

CONTI’s Entire Infrastructure Leaked

Does this signal the end of CONTI’s reign as leading RaaS?

Ukrainian aligned affiliate decides to destroy CONTI ransomware gang’s operation by exfiltrating and sharing 141 additional JSON data files of private Jabber chats from 2020, details of their server architecture, their sendmail phishing campaign data information, command and control botnet architecture, and ransomware executables (password protected). Analysis confirms that the gang uses BazarLoader backdoor for installing persistent malware on infected machines.

DarkOwl analysts also noted from leaked Jabber messages that RaaS affiliates were persistent at determining how to evade AV/EDR protection systems like Sophos and Carbon Black. Stating that they had setup sales calls and demos with Carbon Black and Sophos AV providers’ sales teams using proxy companies to gain more information, test the product and attempt to find specifics of the product’s AV/EDR bypass mechanisms.

This reminds us all the importance of vetting and verifying all commercial in-bounds for requests for demos and sales information, especially when it might present an opportunity to learn critical corporate intelligence.

The affiliate leaking the details wrote how this war against their people and Ukraine was breaking their heart.

My comments are coming from the bottom of my heart which is breaking over my dear Ukraine and my people. Looking of what is happening to it breaks my heart and sometimes my heart wants to scream.

28 February 2022 – 21:41 UTC

STORMOUS Ransomware Hits Ministry of Foreign Affairs of Ukraine

The Pro-Russian STORMOUS ransomware gang claims to have attacked Ukraine’s Ministry of Foreign Affairs, mfa.gov.ua using their custom ransomware. The group posts victims’ information on their Telegram channel, posting in both English and Arabic. The group stated the Ukraine government network “fragile” and called for DDoS attacks them.

Their network is fragile – their various data has been stolen and distributed according to their phone numbers, email, accounts and national card numbers with an internal network hacked and access to most essential files. This is with placing denial attacks on their main site !

28 February 2022 – 18:00 UTC

China’s Huawei Steps in to Assist Russia with ISP Network Instability

According to Chinese deep web forums, Huawei is reportedly building a mobile broadband in Russia to help with internet outages. As of 26 February, at least 50,000 technical experts will be trained in networking and securty in Russia’s R&D centers.

28 February 2022 – 12:00 UTC

Russian Gas Station Pumps Hacked

Video of disabled electric vehicle (EV) charging stations in Russia surface, displaying error status and the following warning:

”Putin is a dick”, “Glory to Ukraine”, ”Glory to our heroes”,” death to our enemies”

27 February 2022 – 23:06 UTC

Anonymous for Ukraine Leaks Customer Data from Sberbank Russia

While Anonymous leaked the files, the credit for the hack goes to Hacktivist group, Georgia Hackers Society. The two text files (bygng.txt & bankmatbygng.txt) appear to be personal data from the financial institution with the bankmat file containing 4,568 records.

27 February 2022 – 21:00 UTC

CONTI RaaS Suffers for Professing Their Allegiance to the Russian Federation

DarkOwl just discovered 393 JSON files containing private Jabber chats from the ransomware group since January 2021 leaked online. Many of CONTI’s affiliates were displeased with the group’s alliance with Russia.

27 February 2022 – 19:00 UTC

ATW Claims to Take Down CoomingProject Ransomware Group

AgainstTheWest assesses “CoomingProject are actually one of the dumbest “threat” groups online.” AgainstTheWest statement on Twitter:

“RIP CoomingProject. All data on them is being passed to relevant authorities in France.”

27 February 2022 – 16:54 UTC

Cyberpartisans Take Belarusian Railway’s Data-Processing Network Offline

The hacktivist group of cyber specialists located in Belarus managed to force the railway switches to manual control mode, to significantly slow down the movement of trains. The webservers for the railway’s domains (pass.rw.by, portal.rw.by, rw.by) are also offline.

The rail services are being essentially held hostage until Russian troops leave Belarus and there is peace in Ukraine.

27 February 2022 – 11:00 UTC

AgainstTheWest Ransomware Gang Enters the Campaign

AgainstTheWest (ATW) claims to have attacked Russia’s Department of Digital Development and Communications of the Administration of the Pskov Region with their own custom “wiper” malware. All data has been reportedly saved and deleted.

27 February 2022 – 09:00 UTC

Anonymous Attacks Russian Critical Infrastructure

Tvingo Telecom offers fiber-optic networking, internet and satellite services. Tvingo Telecom is a major provider to Russian clients.

27 February 2022 – 00:00 UTC

GhostSec Leaks More Data and Claims Attacks Against Belarusian Cybercriminals, GhostWriter

GhostSec is active in the Anonymous cyber war against Russia and released a sample of databases stolen from additional government and municipality sites across Russia (economy.gov.ru and sudak.rk.gov.ru).

They state on their Telegram channel they have been conducting attacks against “Russian hackers” and the “hacker group GhostWriter” (a.k.a. UNC1151).

26 February 2022 – 18:00 UTC

IT ARMY of Ukraine Now Active on Telegram

A Telegram Channel titled “IT ARMY of Ukraine” appeared earlier today to help coordinate cyber activities against Russia. The channel has already accumulated over 96K followers. Posts are shared in Ukrainian and English containing target server IP addresses and media for mass distribution on social media.

Videos of what events are really happening across Ukraine have appeared on intercepted Russian State Television channels.

В найближчу годину буде одне із найголовніших завдань!

26 February 2022 – 16:00 UTC

Anonymous Hackers Interrupt Russian State Television

Multiple reports across underground chatrooms suggest Russian television was allegedly briefly interrupted to play Ukrainian music and display national images. (Source)

Ukraine’s telecommunications’ agency also announced that Russia’s media regulator’s site was down as well.

26 February 2022 – 09:00 UTC

Russia Restricts Facebook and Twitter to Control Information

Open source internet monitoring reporting organizations discovered Twitter has been blocked by multiple ISPs across Russia. Ukraine’s government is regularly posting on social media to show the Russian people they are still fighting in the invasion. Cybercriminals and hacktivist campaigns also disrupt Russia’s information operations by calling out disinformation bots and taking critical communications sites offline. Twitter has reportedly blocked account registrations from IPs originating in the Russian Federation.

Russia’s state-controlled television station, RT, is still offline.

26 February 2022 – 01:00 UTC

Hackers Leak Data from Belarusian Weapons Manufacturer Tetraedr on the Darknet

Anonymous Liberland and the Pwn-Bär Hack Team announce the start of #OpCyberBullyPutin and leak a two-part archive (200GB total) of confidential employee correspondences from prominent defense contractor and radar manufacturer, Tetraedr in Belarus. The first part is the most recent 1,000 emails from each employee inbox, in .EML format. The second part is a complete archive of each inbox in .PST format.

The hacktivists stated they successfully attacked the company through an unpatched ProxyLogon security vulnerability.

25 February 2022 – 23:30 UTC

Russian Military Radio Frequencies Hijacked

Ukrainian radio frequency (RF) hackers intercepted Russian military numbers stations UVB-76, frequency 4625KHz, and trolled Russia communications by playing Swedish pop group Caramella Girls’ Caramelldansen on top of the radio waves.

The group also successfully intercepted frequencies utilized by Russian strategic bomber planes.

25 February 2022

CoomingProject Ransomware Group Announces Support for Russia

Another ransomware gang sides with Russia officially declaring war against anyone conducting cyber attacks against the Russian government on their Telegram channel.

“Hello everyone this is a message we will help the Russian government if cyber attacks and conduct against Russia”

25 February 2022 – 21:00 UTC

Russia’s Gasprom Energy Corporation Knocked Offline

Headquartered in St. Petersburg, Gasprom (ПАО “Газпром”) is the largest natural gas transmission company in Eastern Russia. The company is mostly owned by the Russian government even though the shares are traded publicly.

The Anonymous hacktivist collective, operating their campaign against Russia via the hashtag #OpRussia, has claimed responsibility.

25 February 2022 – 20:00 UTC

Anonymous Hackers Leak Database for Russia’s Ministry of Defense (MoD)

Russia’s gov.ru and mil.ru website server authentication data, including hundreds of government email addresses and credentials, surface on transient deep web paste sites and Telegram channels. Another leak consisting of 60,000 Russian government email addresses is also now in circulation.

GhostSec, also participating in Anonymous’s cyberwar against Russia, #OpRussia, claimed all subdomains for Russia’s military webservers were offline hours earlier as of 11:00 UTC.

Over around 100+ subdomains for the russian military were hosted on this IP (you may check DNSdumpster for validation) now all downed. In Support of the people in Ukraine WE STAND BY YOU!

25 February 2022

CONTI’s decision to side with Russia has dire consequences for the RaaS Gang

The ransomware-as-a-service (RaaS) gang CONTI (a.k.a. CONTI News) has officially sided with the Russian Federation against “Western warmongers” in the conflict.

Many of their affiliate partners are reportedly in disagreement – siding with Ukraine – which became evident once certain private chats were leaked on their internal affiliate platform on social media. It’s uncertain how these political divisions will impact the effectiveness of the ransomware gang’s campaigns. Conti revised their WARNING statement claiming they do “not ally with any government and we condemn the ongoing war.”

25 February 2022 – 16:30 UTC

Hundreds of Russian IP Addresses Appear on Deep Web for Targeting

Over 600 IP addresses correlating to key Russian web services emerge on transient paste sites and underground hacker forums. (Source DarkOwl Vision)

25 February 2022 – 05:00 UTC

Anonymous Threatens to Take Russian Industrial Control Systems Hostage

The hacker group known as Anonymous stepped up its participation in defending Ukrainians through its cyber war with Russia. In an ominous video posted to Twitter, the group called for UN to establish a “neutral security belt” between NATO and Russia to ease tensions. They elevated their influence by threatening to “take hostage industrial control systems” against Russia. Expect Us. We do not forgive. We do not forget.

“If tensions continue to worsen in Ukraine, then we can take hostage… industrial control systems.” Expect us. Operation #Russia Engaged

24 February 2022 – 19:00 UTC

Free Civilian Tor Service Announces 54 New Ukrainian Government Database Leaks

The administrator of the Free Civilian Tor Service – who DarkOwl analysts believe is the Raid Forums threat actor, Vaticano – updated their database leaks service, stating they had confidential data for dozens of Ukrainian government services. DarkOwl analyzed these databases closely and confirmed the threat actor likely exfiltrated the data in December 2021. (Source)

24 February 2022 – 17:00 UTC

Russia’s FSB Warns of Potential Attacks against Critical Infrastructure as a result of Ukraine Operations

The National Coordination Center for Computer Incidents (NCSCI) released an official statement warning citizens of Russia of imminent cyber attacks and for the country to brace for the disruption of important digital information resources and services in response to the on-going special military operation in Ukraine.

“Attacks can be aimed at disrupting the functioning of important information resources and services, causing reputational damage, including for political purposes” – NCSCI

24 February 2022 – 05:00 UTC

Cryptocurrency Markets Crash in Wake of Invasion

Bitcoin cryptocurrency fell below $35,000 USD for the first time since January in reaction to the Russian troops crossing over the Ukraine border. Ethereum fell more than 12% in the last 24 hours.

According to open-source reporting, the collective cryptocurrency market has plummeted over $150 billion dollars in value since the tensions began.

beginning of post

[DEVELOPING] Darknet Economy Surges Around Abortion Rights

Written by DarkOwl Content Team on July 1, 2022. Posted in Blog.

SCOTUS members credit card information continues to be doxxed

July 1, 2022

The recent doxxing of Supreme Justices – presumably in retribution for the Roe v Wade rulings – has spread widely across social media platforms, including Twitter, Instagram, TikTok, and more.

While all members of the Supreme Court have been doxxed to some degree in the past, this latest round of public information sharing contains Credit Card information for at least four Justices.

Many posts circulating on the darknet, deep web, and paste sites include other associated PII (as pictured above), which together form a comprehensive doxx of the targeted Justices that could be exploited for social engineering attacks, fraud and more.

SIEGEDSEC Targets Pro-Life State Governments

27 June 2022

Over the weekend cyber hacktivists enraged about the SCOTUS decision, decided to direct their anger towards their keyboards and targeted the networks of pro-life state governments, e.g. Kentucky and Arkansas. The group claimed to have accessed and exfiltrated several gigabytes of sensitive data, including employee PII from state government servers. The cyber threat group, SiegedSec, who we featured earlier this month, has been recently emboldened by their involvement in the Russia-Ukraine cyber war and stated on their Telegram channel, the attacks against Kentucky and Arkansas are just the beginning with planned continued attacks against pro-life organizations and states with anti-abortion regulations.

“THE ATTACKS WILL CONTINUE!” – SiegedSec

Source: Telegram

SCOTUS Overturns Roe v. Wade

24 June 2022

On Friday morning, the U.S. Supreme Court uploaded their controversial decision on the case titled, DOBBS, STATE HEALTH OFFICER OF THE MISSISSIPPI DEPARTMENT OF HEALTH, ET AL. v. JACKSON WOMEN’S HEALTH ORGANIZATION ET AL; a decision which effectively removed one’s constitutional right to an abortion as provided by the long-standing 1973 Roe v. Wade precedent. The decision sparked widespread protests around the country and conflicts between activists and law enforcement.

Original Report

21 June 2022

As a result of the recent political landscape regarding Roe v. Wade, our analysts reviewed the topic of abortion and observed a surge in darknet economies providing abortion medications and home kits on underground marketplaces.

Background and Political Context

The historical January 1973 Roe v. Wade decision by the U.S. Supreme Court, which legally protected one’s rights to an abortion at the Federal level, is on a precipitous demise in a radical shift in political power across the United States. In a draft majority opinion that was leaked out of the Supreme Court to Politico in early May, the conservative majority of the Supreme Court justices are very likely to overturn the landmark Roe v. Wade and a subsequent 1992 decision — Planned Parenthood v. Casey, with Justice ALITO stating, “Roe was egregiously wrong from the start.”

Figure 1: Source POLITICO

If the position of the draft opinion goes ahead as written – which some legal experts predict might be officially published as early as this week – federal protections for one’s right to an abortion will immediately end and the issue will be tossed back for decision at the individual state level. With recent extreme state-legislative decisions such as the Texas Heartbeat Act criminalizing abortions any time after six weeks of pregnancy, 23 states have some form of restrictive abortion-related legislation in place. 19 states have protected the right to abortion by codifying it into their state laws, Colorado and California have established themselves as “sanctuary states” for women’s reproductive health.

According to the American Pregnancy Association, an abortion is defined as the early termination of a pregnancy and is induced by a clinical surgical procedure or the administration of drugs to remove the embryo and placenta from the female’s uterus. Two drugs associated with the “chemical abortion pill regimen” are oral Mifepristone (Mifeprex) and Misoprostol (Cytotec) used in conjunction to stop the production of pregnancy related hormones and induce contractions of the uterus to expel the embryo.

Impacts Seen on the Darknet

Within a week of the Supreme Court’s leaked draft opinion, DarkOwl analysts observed a noticeable volume of information related to medical abortions materialize – including offers for chemical abortion drugs for sale across the darknet.

Chatter on darknet discussion forums and deep-web adjacent chat platforms foster creating an online community to support US-based individuals’ access to abortion, calling it the “Underground Abortion Railroad” to help connect women with abortion and transportation providers and avoid criminal prosecution.

One forum user identified themselves from Europe and offered to stock up on abortion medications and emergency contraception pills such as “Plan B” from their local pharmacies, offering to ship them at fair market price to those in the United States who cannot access them legally through non-darknet sites.

Another user in a popular darknet forum mentioned a reliable marketplace selling Misoprostol, described as “28 Pills 200MG Safe Home Abortion Method.” The vendor of the marketplace commented on the thread that they don’t actually sell the pills anymore because there were not enough buyers, but would be willing to change their position and offer them again if there was demand.

Monitors on the darknet marketplace suggested has yet to offer a “Safe Home Abortion Method Kit” as mentioned in the thread or abortion-related pills on their site. The same vendor also offers a variety of illegal drugs and narcotics as well, including Cocaine, Percocet, Xanax, weight loss treatments, and Freebase.

Figure 2: Source Dread Darknet Discussion Forum

DarkOwl continues to observe other sources of underground abortion services on offer in its Vision database with multiple advertisements for Misoprostol and Mifeprex, and access to (purportedly) safe abortion services. One supplier recommended those in need of abortion pills contact them via XMPP with OMEMO for a direct, private sale.

Another classified-style advertisement describes the at-home abortion treatment in detail and the medications used, with pricing, ranging from $7 to $16 USD for the abortion-related medications. Multiple forms of contact information was also included.

Other drugs offered for sale on the same classified-advertisement forum have been affiliated with scammers that have no intention of providing the services or goods on offer. Tragically, there is increased risk that darknet scammers will exploit the current political abortion issue in the US for financial gain like they did during the COVID-19 pandemic.

Drugs offered for sale on darknet marketplaces

Figure 3: Source DarkOwl Vision

Some darknet forum users point readers to “offshore pharmacy sites” where abortion-related medication could be purchased, mentioning a clinic taking online consultations in India among others. A quick OSINT search revealed numerous Surface Web domains offering abortion-related medications for purchase. How those sites will operate regarding shipping the drugs to customers in states who have banned abortions once Roe is overturned is yet to be determined.

Overall, opinions on the darknet about abortion are mixed with strong opinions on both sides of the issue. Members of right-wing aligned Telegram channels spin abortion as murder and celebrate the Supreme Court’s position.

Figure 4: Source DarkOwl Vision

While other users support less government over individual choices regardless and view the decision as a potential turning point for the loss of other individual rights.

“I do believe everyone should have a choice, it’s a sensitive topic, but I will stand on democracy, taking peoples choices away is not democracy.” – Dread User

Figure 5: Source DarkOwl Vision

A controversial pro-choice group, Ruth Sent Us (RSU), named after late liberal Justice Ruth Bader Ginsburg, recently admitted to publishing on social media the home addresses of Chief Justice John Roberts alongside five other conservative associate justices: Samuel Alito, Clarence Thomas, Neil Gorsuch, Brett Kavanaugh and Amy Coney Barrett. The group claimed the information was publicly available and never encouraged violence against any of the justices.

The release of such information has fueled on-going deep web forum debates about the topic with some stating such information releases violates 18 USC 1503, which “prohibits ‘endeavors to influence, intimidate or impede… officers of [the] court’.” Despite the online debate, a 26-year old man, Nicholas John Roske, likely relied on such leaked information to target Justice Kavanaugh last week. Roske was arrested for attempted murder after arriving at Kavanuagh’s home with a Glock 17 handgun, ammunition, a knife, zip ties, pepper spray, and duct tape, that he told police he planned to use to break into Kavanaugh’s house and kill him. Other left-leaning U.S. politicians have also been targeted in their homes since the draft opinion leaks with users on Telegram calling them “pro-abortion death cult democrats.”

Figure 6: Source Telegram

DarkOwl analysts have not yet observed abortion pills such as Mifepristone and Misoprostol widely available on principal decentralized darknet markets, but they are available for purchase via threads in discussion forums, as well as classified-style advertisements on transient paste services.

Closing Thoughts

Users across darknet forums have voiced interest in abortion-related pills and services following the leaked Supreme Court documents and advocate for organized protests in support of and against the potential ruling. Once the U.S. Supreme Court officially issues their ruling, we anticipate a more concerted response from darknet marketplaces in offers for abortion related drugs and services. The darknet will also continue to be a resource for activists to organize political protests and circulate sensitive information related to the abortion debate.

Irrespective of which side of the debate one stands, the darknet will continue to fuel the controversy both in support of and criticism of a woman’s right to abortion. In a world of increased digital surveillance and the fundamental privacy-centric nature of Tor and similar anonymous platforms, individuals will seek out like-minded communities on the darknet for social activism related to the topic. DarkOwl predicts an increased use of Tor to organize political protests and circulate sensitive information related to the abortion debate.

Curious about darknet marketplaces or something you read? Interested in learning more? Contact us to find out how darknet data applies to your use case.

NoName057(16) Telegram Activity Assessment

Written by kathy hoffman on November 5, 2026. Posted in Blog.

November 5, 2026

NoName057(16) is a pro-Russian hacktivist group that conducts coordinated cyberattacks against countries and organizations supporting Ukraine. They are very active on Telegram where they often post claims of DDoS (Denial of Service) attacks on their victims. The group formed in March 2022, shortly after Russia’s full-scale invasion of Ukraine. They are known to target government websites, financial institutions, transport hubs, and media outlets in Ukraine, the US, Taiwan, and European NATO countries.

They form a collective of other hacktivist groups supporting Russia and often share posts from other groups as well as appearing in other group’s posts as supporting their efforts. Unlike traditional centralized hacker groups, NoName057(16) recruits volunteer supporters through messaging apps like Telegram. Volunteers download a proprietary crowd-sourced attack tool called DDoSia onto their computers, which automatically floods targeted websites with traffic. Active participants are often rewarded with cryptocurrency. This often provides a list of victims to be targeted.

The group operates across multiple Telegram languages in several languages for maximum impact.

Telegram Activity: An Overview

DarkOwl analysts reviewed the English-language Telegram channel operated by NoName057(16) (“NNM057(16) eng vers”), covering the channel’s creation on 27 October 2025 through 30 September 2026.

The export contains 2,825 messages, of which 1,228 are text posts authored by the group and 230 are distinct posts forwarded from other channels.
The channel posted on 338 of 339 days, averaging 100–130 text posts per month with a weekday-heavy pattern concentrated between 07:00 and 12:00 UTC (10:00–15:00 Moscow time).
The group made 666 DDoS claim posts and list 3,421 alleged targets (≈2,200 unique), averaging roughly 70 claimed targets per week. Ukraine, Germany, Denmark, France, Italy and the United Kingdom are the most targeted countries.
NoName057(16) publicly announced 13 alliances during the period and named Z-Pentest Alliance, PalachPro and Desinformador Ruso as operational partners in joint attacks.
Growing amplification forwarding of other groups’ content rose sharply in August–September 2026 (36 and 49 posts respectively), driven by Server Killers, Dark Storm Team, BD Anonymous and Shadow ClawZ 404, signaling deepening ties with pro-Palestinian and Global-South hacktivist networks.
Beyond DDoS, the group increasingly claims intrusions into industrial control systems (ICS) and CCTV (45 posts tagged #BrokenByte), runs a paid TOR tip platform, and publishes a “Tribunal” list of named foreign individuals.

Scope and Methodology

DarkOwl parsed every message, from of the group’s English-language channel, for timestamp, text, hashtags, links, media type and forward origin. Alleged victims were extracted from the group’s standard claim format — each target is prefixed with a ❌ marker and usually accompanied by a check-host.net report used as “proof” of downtime. Country attribution relies on the group’s own #Op campaign hashtags.

All victim figures represent claims made by the threat actor and have not been independently verified. Some listed targets are described by the group as “closed by geo” or “behind a stub”, indicating geo-blocking or DDoS mitigation rather than an outage. Unique-target counts are approximate because the same organisation is frequently described with different wording across posts.

Posting Activity

NoName057(16) operates its English channel with near-industrial regularity. Following a short partial month at launch, output stabilised at 98–129 text posts per month and never dropped materially, even during periods of reported law-enforcement pressure and channel takedowns. Posting occurs on almost every day of the period, typically 2–5 posts per day and at most 10.

Figure 1: Monthly text posts and claimed DDoS targets, Oct 2025 – Sep 2026

• Weekday focus: Wednesday (222 posts) and Tuesday (206) are the busiest days; Saturday and Sunday volume drops by roughly half (129 and 104).

• Working-hours pattern: over 80% of posts are published between 07:00 and 13:00 UTC, consistent with a staffed schedule in Moscow time rather than ad-hoc volunteer activity.

• Consistent messaging: 1,020 posts carry the group’s signature hashtags #FuckEastwood and #TimeOfRetribution, a reference to Europol’s July 2025 Operation Eastwood takedown against the group.

Alleged Victims

The group’s core output is DDoS claim posts. Across the period DarkOwl identified 666 claim posts listing 3,421 alleged targets, a median of five targets per post. After normalisation, approximately 2,200 distinct organisations are named, of which around 650 were claimed on more than one occasion. Claim volume held steady at 300–360 targets per month from November 2025 through May 2026 before tapering to about 200 per month in August and September 2026, a decline that coincides with the rise in forwarded partner content.

Figure 2: Claimed targets by country campaign (#Op hashtag), top 16

Target selection appears to be tightly coupled to geopolitical triggers. Most claim posts open with a news item on military aid to Ukraine, sanctions or anti-Russian statements, followed by a list of targets in the relevant country. Government portals, municipalities, transport (airports, ports, metro systems), energy utilities, telecoms, banking and defence-industrial firms dominate the target set. Ukrainian defence-industrial and infrastructure organisations are repeatedly re-targeted; the most frequently claimed individual targets include Ferrexpo, AvtoKrAZ, Amstor Retail Group and the Sumy regional ISP SKM.

Intrusion and ICS Claims

In addition to DDoS, NoName057(16) increasingly publicises claims of unauthorised access to operational technology, often in collaboration with Z-Pentest Alliance, PalachPro and its own DDoSia Project volunteers. Examples include an Italian poultry-farm control system, an 850 kW industrial boiler in the Czech Republic, the Centrale Chalmazel hydroelectric plant in France and CCTV at a German water-treatment facility. Forty-five posts carry the #BrokenByte campaign tag introduced for this activity.

Affiliations, Alliances and Forwarded Content

NoName057(16) uses its channel as a hub for a wider hacktivist ecosystem. DarkOwl identified three distinct types of relationship:

Named operational partners with which the group claims joint attacks;
Formally declared alliances, announced with a standard “Forging an alliance with… The more of us, the stronger we are!” post; and
Groups and outlets whose content is forwarded without a declared alliance.

The channel also forwards third-party threat-intelligence reporting (notably Hackmanac’s weekly “Hack Tuesday” rankings) as a form of self-promotion.

Figure 3: NoName057(16) affiliation network — relationship type, and volume of forwarded content per group

Declared Alliances

Thirteen alliances were announced during the period. Early announcements (October–December 2025) were almost entirely with Russian-speaking collectives; from February 2026 onward the group courted non-Russian actors, including Iranian-aligned Vulture, North-African Moroccan Cyber Sentinels, and Hider Nex, reflecting a deliberate internationalisation of its coalition.

Figure 4: Alliance announcements and joint operations timeline

Forwarded Content Over Time

Forwarding volume was modest from October 2025 to July 2026 (typically 4–26 posts per month) and dominated by Server Killers, Hackmanac and Z-Pentest Alliance. Z-Pentest forwards stop after April 2026. A marked shift occurs in August–September 2026, when forwards rise to 36 and 49 per month and the mix broadens to Dark Storm Team, BD Anonymous, Shadow ClawZ 404 and third-party outlet CyberAsia.io.

Figure 5: Distinct forwarded posts by source and month. *Other: Vulture, Cyber News (Persian), Golden Falcon, Keymous+, Handala Hack, Team1914_official

Forwarded hacktivist sources span a broad ideological range. Alongside pro-Russian collectives, NoName057(16) amplifies pro-Palestinian and Global-South actors, BD Anonymous (Bangladesh), Nullsec Philippines, Cyber Team Indonesia, Team Fearless, Hezi Rash, CLOBELSECTEAM and Iranian-aligned personas such as Golden Falcon and Handala Hack. In March 2026 the group explicitly attacked Israeli targets “in solidarity with our Iranian allies”.

Other Notable Activity

• DDoSia Project recruitment: 107 posts promote the group’s crowdsourced DDoS tool and volunteer program, including periodic results summaries.

• TOR “Secure Share” platform: repeated calls (Mar–Jul 2026) for insiders to submit sensitive information on “countries hostile to Russia” in exchange for payment.

• “Tribunal” list: a campaign (#NoName05716_Tribunal) naming foreign individuals the group accuses of acting against it, and offering rewards for personal information about them, in some cases extending to their families.

• Channel resilience: frequent references to Telegram takedowns, replacement channels (e.g., a new Spanish channel on 20 May 2026) and a backup bot launched on 17 September 2026, alongside language-specific channels in Russian, Italian and Spanish.

• Offline influence: volunteers distributing NoName057(16) stickers in European cities and campaigns in support of a detained associate.

Assessment

NoName057(16) remains one of the most prolific hacktivist actors observed, sustaining a steady tempo of DDoS claims against NATO and EU states supporting Ukraine despite the July 2025 Operation Eastwood disruption. DarkOwl assesses with moderate confidence that the group is evolving from a standalone DDoS brand into a coalition hub: the late-2026 surge in forwarded partner content, the steady cadence of alliance announcements, and the pivot toward ICS and CCTV intrusion claims all point to a strategy of amplifying reach through allied groups while shifting its own messaging toward higher-impact operations.

Organizations in the most-targeted countries, particularly public-sector, transport, energy and defense-industrial entities, should expect continued short-duration DDoS campaigns timed to political announcements on Ukraine support, and should review internet-exposed OT/HMI and CCTV interfaces given the growing number of intrusion claims by NoName057(16) and its partners.

Keep up to date with DarkOwl research. Follow us on LinkedIn.

Threat Intelligence RoundUp: October

Written by DarkOwl Content Team on November 2, 2026. Posted in Blog.

November 03, 2026

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. Treasury Dismantles Major Hamas Financing Network – U.S. Department of the Treasury

On October 2, 2026, the U.S. Department of the Treasury announced sanctions against individuals and organizations involved in a Hamas financing network that allegedly moved more than $2 million to the group between 2020 and 2026. According to Treasury, the network operated through France-based organizations that presented themselves as charities raising humanitarian aid for civilians in Gaza, while actually directing donations to a Hamas financial facilitator in Gaza. The network also used cryptocurrency to transfer hundreds of thousands of dollars and promoted fundraising accounts through social media. Treasury stated that $1.5 million of the funds was raised after the October 7, 2023, Hamas attack on Israel. Read full article.

2. Hackers stole Pentagon personnel records of over 3 million people – Bleeping Computer

The Pentagon recently reported a major data breach that exposed personal information belonging to nearly 3 million people in October 2025. Hackers accessed a Defense Manpower Data Center (DMDC) system containing sensitive information, including names, Social Security numbers, dates of birth, and other personal and employment details. The affected individuals include military personnel, civilian employees, contractors, veterans, and others connected to the Department of Defense. Officials say the vulnerability has been fixed and an investigation is ongoing. Read More.

3. U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud – The Hacker News

The U.S. Federal Bureau of Investigation (FBI), in coordination with the Department of Justice (DOJ) and cybersecurity firm CrowdStrike, disrupted more than 40 suspected “laptopfarms” across Texas as part of an operation targeting North Korean remote IT worker fraud schemes. These laptop farms were residences used by U.S.-based facilitators to host and operate laptops supplied by American companies, allowing North Korean IT workers to appear as legitimate U.S.-based remote employees while concealing their actual identities and locations. According to U.S. authorities, the workers allegedly used stolen or falsified identities to secure employment with more than 70 U.S. companies across industries including healthcare, communications, retail, manufacturing, and cybersecurity support. The FBI seized approximately 187 laptops and keyboard, video, and mouse (KVM) devices used to facilitate the scheme, which reportedly generated around $3 million in revenue believed to have been transferred to entities controlled by North Korea. Read more here.

4. FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions – The Hacker News

The Federal Bureau of Investigation (FBI) and the U.S. Department of Justice (DOJ) seized seven internet domains to disrupt cyber operations associated with Flax Typhoon, a China-linked advanced persistent threat (APT) group connected to Beijing-based Integrity Technology Group. According to U.S. authorities, the group used two primary tools, MicroScan and FishHub, to target critical infrastructure and organizations in the United States and internationally. MicroScan is a Python-based vulnerability scanning tool containing more than 1,300 scripts designed to identify security weaknesses in websites, applications, and network systems. FishHub was used to conduct spear-phishing attacks, gain unauthorized access to victim networks, and potentially steal sensitive information. Investigators also connected the group to a large Internet of Things (IoT) botnet called Raptor Train, which infected hundreds of thousands of devices before a previous FBI disruption operation in September 2024. Read here.

5. Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites – The Hacker News

A researcher at the cybersecurity company NorForge observed a Chinese-speaking hacker breach more than 100 company websites using autonomous AI agents. According to the report, the AI agents attempted to compromise more than 1,200 sites; among the 100 compromised ones were Deere, SharkNinja, and Cummins. Snorre Fagerland, the researcher who observed the incident, discovered it by scanning the web for “inadvertently exposed instances of Cairn,” an AI-powered system often used by hackers. Fagerland observed approximately two dozen instances of Cairn being used in malicious ways—one of which was by the Chinese-speaking hacker. Learn more.

6. Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers – The Hacker News

On 30 September 2026, an international law-enforcement operation led by German authorities resulted in three arrests linked to the KillSec ransomware group. The suspected 16-year-old main operator was arrested in Alicante, Spain, where Spanish police also searched a home and a hotel office. A 24-year-old suspect was arrested in Romania, with searches carried out in Bucharest and Vaslui County. The third suspect was arrested in the United Kingdom and is reportedly linked to an extradition request from U.S. authorities. In addition to the arrests, police carried out eight searches across Spain, Greece, Romania and the UK, while seizing five servers and securing at least 110 terabytes of data. Read full article.

7. US soldier gets 70 months in prison for extorting 10 tech, telecom firms – Bleeping Computer

Cameron John Wagenius (known online as ‘kiberphant0m’ and ‘cyb3rph4nt0m’) has been sentenced to 70 months in prison for hacking and extorting 10 technology and telecommunications companies. According to records, the attacks occurred from April 2023 to December 2024 while Wagenius was on active duty with the U.S. Army. Wagenius and his accomplices used stolen credentials to access victim networks, coordinated their activities through Telegram, and later attempted to extort organizations by threatening to publish or sell stolen data on cybercrime forums. The conspirators also sold some of the stolen information and used it to conduct additional fraud, including SIM-swapping, while attempting to extort at least $1 million from data owners. Wagenius was sentenced to 70 months in prison and ordered to pay $294,978 in restitution for his role in the scheme. Read full article.

8. Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks – The Hacker News

Cybersecurity researchers at Dutch mobile security firm ThreatFabric uncovered a new Android banking trojan called Hirudo, which uses modified versions of legitimate banking applications to bypass built-in security protections and facilitate financial fraud. The malware targets users across several countries including Indonesia, China, India, Mexico, Morocco, and Thailand, with eight Indonesian banking apps identified as targets for replacement with malicious versions. Hirudo is distributed through seemingly legitimate shopping, entertainment, and video-streaming applications that prompt users to install the malware through fake in-app updates. Once installed and granted the necessary permissions, it can steal banking credentials, payment PINs, SMS messages, and device information, capture screens and camera activity, and give attackers remote control of infected devices. What makes Hirudo particularly concerning is its ability to replace genuine banking apps with modified copies containing tools designed to deceive security mechanisms, including application-signature verification, accessibility-service checks, screen-capture protections, and Google Play Integrity checks. Learn more.

Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.

Things That Go Bump in the Dark Web: 2026’s Scariest Threat Trends

Written by DarkOwl Content Team on October 30, 2026. Posted in Blog.

October 30, 2026

Introduction

Haunted houses close on the first of November. The dark web does not. While most of us are carving pumpkins, threat actors are trading stolen logins, rebranding ransomware crews, and selling AI-generated faces by the thousands.

At DarkOwl, our analysts spend every day in the parts of the internet most people never visit. So, this Halloween, we’re counting down the five threats from 2026 that kept us up at night. Grab a torch. It gets dark from here.

Zombie Credentials: the Logins that Won’t Stay Dead

You changed your password years ago. Your old credentials are still out there. Infostealer logs keep feeding stolen logins back into criminal markets, where they are bundled, resold and repackaged into combolists again and again.

The numbers are grim. KELA tracked 2.86 billion compromised credentials circulating in criminal markets in 2025, and Constella processed 51.7 million infostealer packages that year, up 72%.

What makes these zombies dangerous isn’t the password alone. A single log can hold:

Saved browser passwords
Session cookies that can skip MFA entirely
Autofill data, including addresses and card details
Crypto wallet files and seed phrases

The infection-to-sale window is fast. Logs are tested against live services within a day and listed on markets such as Russian Market within 48 hours. Corporate VPN or identity-provider access can sell for $100–$500.

Why it’s scary: one infected personal laptop can hand an attacker a valid session into your corporate SSO. No break-in required, just a login.

The Shapeshifters: Ransomware that Changes Its Face

Kill one ransomware brand and two more crawl out of the grave. 2026 has been the year of splintering: fewer giants, many more small crews, and affiliates switching between them as easily as changing costumes.

Black Kite counted 146 active ransomware groups by June 2026, more than double its 2023 figure, with 61 new groups in 12 months. Some brands barely last a season. Vect appeared in January 2026, and its leak site was offline by mid-April.

The shapeshifting is often driven by the affiliates themselves:

The Gentlemen reportedly grew out of a former Qilin affiliate after a commission dispute, and Unit 42 credited it with 580 claimed victims across 77 countries by July 2026.
Global Secret Group surfaced in mid-2026 using leaked LockBit 3.0 code.
Data-theft-only crews skip encryption altogether and go straight to extortion.

Why it’s scary: a new name doesn’t mean new people. Defenders who track brands instead of actors, tools and infrastructure will always be one costume behind.

The Masks: Deepfakes for Hire

The scariest mask this year isn’t on a trick-or-treater. It’s a real-time synthetic face sold to defeat identity checks.

In April 2026, a threat actor on DarkForums advertised a darknet kit called JINKUSU CAM, reportedly offered for around $15 per KYC bypass attempt. The kit reportedly:

Swaps a donor face onto a live video stream in real time
Feeds that stream through a virtual camera, so verification platforms see a “real” webcam
Adds voice modulation to match
Ships with presets for major crypto exchanges

Pair these tools with the identity data from stealer logs and “fullz” bundles, and you get synthetic identities that can open accounts, pass checks and launder funds at scale.

Why it’s scary: “seeing is believing” no longer works. A face on a video call or a selfie check is now something you can buy for less than the price of a Halloween costume.

The Haunted Messenger: Telegram’s Undying Channels

Telegram has been swinging the axe, but the channels keep coming back like a slasher who’s always “definitely dead this time”.

Check Point reports that Telegram blocked more than 43.5 million channels and groups in 2025, with daily takedowns rising to 80,000–140,000 and peaking above 500,000. Yet criminals have adapted:

Backup channels are set up before a ban, with audiences preloaded
“Request to Join” gates keep moderation bots out
Forwarded messages carry content from blocked channels into new ones

And they aren’t really leaving. Over three months, Check Point found about 3 million Telegram invite links shared underground, while Discord made up under 6% of that volume. One group that moved to SimpleX returned to Telegram when its followers didn’t follow.

Why it’s scary: takedowns change how threat actors operate, not where. Monitoring has to follow the resurrections, not just the original channel.

The Call is Coming from Inside the House: SaaS and Identity Breaches

Our number one scare is the classic horror twist: the threat is already inside. In 2026, many of the biggest data thefts didn’t involve breaking down the front door. Attackers logged in.

The pattern is consistent. Threat actors compromise identity access through vishing, session hijacking or MFA fatigue against single sign-on, then move into SaaS tenants such as Microsoft 365, Google Workspace and Salesforce to export data. In early 2026, data tied to around 14 million Panera Bread customers was reportedly advertised on criminal forums, with a threat actor linking it to ShinyHunters.

This is where every monster on our list meets. Stolen session cookies (zombies) open the door, deepfaked voices and faces (masks) talk past the help desk, Telegram channels (haunted messengers) advertise the data, and extortion crews (shapeshifters) collect.

Why it’s scary: your perimeter is now every vendor, every SaaS app and every login. If one of them is compromised, your data walks out wearing a valid badge.

Turning the Lights On

Every horror film has the moment someone finally flips the switch. With the dark web, visibility is that switch. You can’t stop threats you can’t see, but you can see a lot more than most organizations realize.

A few practical ways to keep the monsters at bay:

Monitor for exposed credentials and sessions. Watch stealer logs and combolists for your domains, and invalidate sessions as well as passwords.
Track actors, not just brands. Follow the handles, tooling and infrastructure behind ransomware names so rebrands don’t catch you off guard.
Harden identity checks. Treat video and selfie verification as one signal among several, and train help desks to spot social engineering.
Watch the chatter. Monitor Telegram and forums for mentions of your brand, executives and vendors, including the backup channels.
Map your SaaS and third-party exposure. Know which vendors hold your data and watch for them in leak listings.

DarkOwl gives security teams that light. Our data covers the darknet, deep web, Telegram and other high-risk platforms, so you can spot exposure early and act before the scare becomes a breach.

Happy Halloween from all of us at DarkOwl. Stay safe out there.

Get in touch to see what’s lurking in the dark for your organization.

ZeroForums: A New Chinese-Language Dark Web Forum Mimicking Established Cybercriminal Platforms

Written by DarkOwl Content Team on October 27, 2026. Posted in Blog.

October 27, 2026

A newly emerged dark web forum known as “ZeroForums” has been identified, operating with a user interface closely mimicking established cybercriminal platforms including BreachForums and RaidForums. The forum defaults to Simplified Chinese as its primary language, with all threads and posts displayed in Chinese by default, though users retain the ability to switch the interface to English.

Figure 1: The Chinese language darkweb forum, “Zeroforums”

DarkOwl has been actively monitoring ZeroForums since its emergence, tracking the forum’s growth, content, and associated infrastructure in close to real time. The forum’s promotion and sharing of alleged data leaks and breaches across both its on-platform subforums and associated Telegram channels has been captured through DarkOwl Vision, ensuring early identification and indexing of any alleged breach material distributed through this emerging platform.

Figure 2: The “Zeroforums” was monitored since very early stages of its emergence by DarkOwl

Domain and Infrastructure

Public WHOIS records indicate that the forum was created on August 28, 2026. The forum employs Cloudflare CDN (Content Delivery Network) to mask its real IP address, a common operational security measure among dark web forum operators. However, despite apparent attempts to apply additional OPSEC measures, including the removal of sensitive files from the forum infrastructure and the removal of the favicon, the forum’s real IP address appears to have been identified.

Registration Process

To present a familiar experience to users of established cybercriminal forums, “ZeroForums” employs a registration process closely modeled on platforms such as DarkForums, RaidForums, and BreachForums. Prospective users are required to accept a registration agreement before accessing the registration form.

The registration form requests a username, password, and email address, alongside two separate CAPTCHA challenges to prevent automated bot registrations. Optional fields include language settings, account preferences, and time zone configuration. Upon submission, the user account is created, and a confirmation email is dispatched to the provided address. Following email confirmation, the registered user gains the ability to both view and create posts on the forum.

Figure 4: The registration form of the “Zeroforums”

Forum Structure and Subforums

The forum’s homepage lists several subforums catering to typical dark web cybercriminal activities, including DataBreach, Free Database, Database Requests, Tools and Scripts, among additional subforums.

Figure 5: The Homepage of the forum with the subforums

Staff Structure

Similar to other dark web forums, “ZeroForums” maintains a staff team comprising three tiers:

Administrators hold the highest level of authority on the forum, responsible for overall platform management, user moderation policy, subforum configuration, and the enforcement of community rules. The administrator also sets the operational and ideological tone of the forum through their own posting activity and content curation.

Moderators serve as the day-to-day enforcers of forum rules, managing user conduct, reviewing and approving or removing posts, handling user reports, and maintaining the integrity of individual subforums. Moderators operate under the direction of the administrator.

User Group Leaders manage designated user groups within the forum, overseeing the activity and conduct of members within their assigned communities. On “ZeroForums”, this role is currently held by the same individuals as the moderator tier.

The identified staff members are as follows:

Administrator: Admineirunk
Moderators: Bluecateye and Camelliaonly
User Group Leaders: Bluecateye and Camelliaonly

Figure 6: The Staff page of the forum, the members of the Administrator group, Moderators and User group leaders

Administrator Profile: Admineirunk

Admineirunk is the sole administrator of “ZeroForums” and the forum’s founding member, holding user ID 1 — confirming they were the first account created on the platform. The account joined on May 29, 2026, and has initiated 8 posts and 6 threads since joining.

Figure 7: The Administrator of the “zoneforums” ‘s profile

Forum Statistics

As of the time of writing this report, “ZeroForums’” statistics page records 32 posts across 16 topics, with 70 registered members and the most popular subforum being Free Database. The forum is notably new, and the relatively low volume of 32 posts across 16 topics and 70 registered members at the time of writing should not be interpreted as an indicator of limited threat relevance. Dark web forums in their early stages frequently exhibit low post counts and membership numbers before rapidly scaling in activity and user base, as demonstrated by the growth trajectories of now-established platforms such as BreachForums and RaidForums, both of which began as small communities before becoming major cybercriminal hubs.

Figure 8: The stats page of the forum, displays 32 posts across 16 topics

The forum’s member list displays all 70 registered users across 4 pages of 20 records each. Beyond the staff accounts, registered members are categorized as Junior Members, Newbies, and Account Not Activated users.

Figure 9: The forum listed 70 registered users across 4 pages

Q&A Subforum

“ZeroForums” maintains a dedicated Q&A section addressing common user inquiries on topics including updating personal profile pages, use of cookies, login and logout procedures, and member registration. This section mirrors the support infrastructure observed on more established dark web forums and is consistent with an operator seeking to lower the barrier to entry for new and less technically experienced users.

Figure 10: The Q&A section addressing common user queries

“Admineirunk”, the administrator of the forum, is one of the most active members, with notable posts including “Category: Gaming data in the United States” and “30 million Chinese students”, indicating a direct role in seeding the forum with alleged data breach content. The administrator has also shared two Telegram channels on the forum, one of which is no longer accessible and one of which remains active at the time of writing.

Figure 11: The stats page of the forum, displays 32 posts across 16 topics

Telegram Infrastructure

The Telegram channel shared by forum administrator “Admineirunk” translates to English as “Notification Channel” and has accumulated 6,451 subscribers at the time of writing. The channel is accessible via two Telegram addresses, was created on January 2, 2026, and has been used to share a linked Telegram channel that is no longer online, the clearnet address of “ZeroForums”, and an onion address for the forum.

Figure 12: The “Notification channel” promoting the “Zeroforums”

iShare Supply and Demand Channel

A separate Telegram channel — translated to English as “iShare Supply and Demand Channel” — publishes posts in Chinese and on September 20, 2026, actively promoted “ZeroForums” and the Telegram channel associated with the forum.

Figure 13: The “Zeroforums” Telegram channel, Telegram bot and admin contact shared on another Chinese language telegram channel

New Telegram Channel

Despite the original Telegram channel no longer being accessible, the operators created a new Telegram channel on September 27, 2026, through which they have shared 96 files of alleged data breaches at the time of writing.

Telegram Bot

A Telegram bot linked to “ZeroForums” has been identified, recording 767 monthly active users and associated with 3 community chats as noted on the bot’s profile.

Onion Site

An onion address for “ZeroForums” was shared via the associated Telegram channel. The onion site was not active at the time of writing this report. Further investigation led to the identification of an IP address that appears to host the forum, which upon geolocation references a server based in the United States.

Figure 16: The “IP address that hosts the “Zeroforums” is geolocated in US

Assessment

“ZeroForums” represents a newly established dark web forum with a deliberate design strategy of mimicking the interface, registration flow, and subforum structure of established cybercriminal platforms. Its default Simplified Chinese language setting, combined with the administrator’s posting of content targeting Chinese student data and U.S. gaming data, suggests a primary focus on Chinese-language cybercriminal audiences while maintaining English-language accessibility to broaden its potential user base.

The forum’s use of Cloudflare CDN alongside additional OPSEC measures, including favicon and sensitive file removal, indicates an operator with at least a moderate degree of infrastructure awareness. However, the apparent exposure of the forum’s real IP address, geolocating to the United States, represents a significant operational security failure that may expose the hosting infrastructure to law enforcement identification.

The active Telegram ecosystem surrounding “ZeroForums”, comprising a notification channel with over 6,400 subscribers, a secondary promotional channel, a newly created breach-sharing channel with 96 alleged data breach files, and a bot with 767 monthly active users, indicates that the forum’s operators are actively building an off-platform community infrastructure to ensure continuity of operations and audience retention even in the event of the forum itself being taken down.

All content in this report was identified through DarkOwl Vision during routine dark web and open-source collection. DarkOwl does not endorse, promote, or amplify the content of any threat actors referenced herein. The authenticity of all advertised breach claims referenced in this report has not been independently verified by DarkOwl.

PHP Vulnerabilities Affect the Darknet Also

Written by DarkOwl Content Team on October 21, 2026. Posted in Blog.

October 21, 2026

Introduction

On October 21, 2026, PHP’s maintainers released emergency fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which were identified through the use of AI. Within hours, government agencies in several countries told operators to consider taking sites offline until they could patch. They also took down their own websites, government websites in Finland and Edinburg council and the BBC all took down webpages as well as countless others.

So did the administrators of popular darknet forums BreachForums, DarkForums, and PwnForums.

What is PHP

PHP, which stands for PHP: Hypertext Preprocessor, is a free, open-source server-side scripting language designed specifically for web development.

Unlike client-side languages like HTML, CSS, or JavaScript that run inside your web browser, PHP code runs entirely on the web server. When a user requests a page, the server processes the PHP code to dynamically assemble the content (such as pulling data from a database), translates it into standard HTML, and sends the finished page back to the user’s browser.

The security company Wiz estimates PHP powers about 70% of the world’s websites.

What happened

Both identified flaws allow remote code execution. PHP rated each one CVSS 9.2, and CERT-EU says a score at that level implies exploitation without authentication, according to SecurityWeek. Public reporting suggests every PHP version from PHP 5 onward is affected. The NSA said flaws like these “often provide a direct path to the server’s file system or database.”

Researchers found the bugs using OpenAI’s GPT-5.6 Sol model, and Wiz independently found them with frontier AI models, per Cybersecurity Dive. SecurityWeek reports that details surfaced online before PHP’s scheduled coordinated disclosure. PHP had planned patches for 14:00 UTC on October 21 and released emergency updates that day.

The response went well beyond routine patching. Government agencies in the U.K., Canada, Australia and the EU (CERT-EU) urged operators to take sites offline until they could update PHP. Finland’s government and the Dutch House of Representatives disconnected their sites that same day. One researcher estimated that more than 1.3 million websites are vulnerable.

How the Darknet responded

Three major forums went dark as well. BreachForums, DarkForums and PwnForums are offline as of writing while their operators wait for PHP to be patched. Administrators announced the outages on Telegram on October 21.

The BreachForums moderator, posting as HasanBroker, wrote: “BreachForums will be offline for a little while until PHP is patched globally, we take our security seriously.” DarkForums posted: “DF will remain offline until PHP has been patched globally.”

With their sites down, operators then fell back on Telegram, a darknet-adjacent platform, to reach their communities and inform them about why the sites were down. These Telegram channels are often used to share messages and updates on the sites as well as publicize new ventures and leaks of note.

Many dark web forums run on the same software stack as the legitimate internet, and when the stack breaks, criminal communities scramble to patch it immediately, just like corporate and government communities. Remote code execution would let an attacker run commands on the forum’s server and reach its database, which holds member emails, IP addresses, private messages and the administrators’ own details.

Although they often share this kind of data from victims, darkweb forum admins take the security of their site seriously for fear of law enforcement action, such as site seizures or alleged honeypot operations. Additionally, competitors and rival forums within the darkweb community have historically exploited vulnerabilities and exfiltrated data for their own gains.

Why it matters beyond the forums

The forum outages are the visible part. The larger effect is what remote code execution on a PHP server does to the data economy behind them. An attacker who runs code on a web server can often reach its file system and database, which is where customer records, credentials and internal documents live. That data does not stay on the compromised server, and may surface later on darknet markets, forums and leak sites.

While Vision has not yet shown stolen data tied to these CVEs, past mass-exploitation events give us a reason to watch for it, and why darknet forum operators are “taking security seriously.”

What defenders should do now

Patch PHP. Update every PHP deployment to the fixed release, and take systems offline if you cannot patch promptly, as the U.K., Canadian, Australian and EU agencies advised.
Find PHP you did not know about. Check CMS platforms, plugins, internal tools and vendor-hosted portals. The exposure is in third-party software as much as your own.
Hunt backward. Details circulated before the patches shipped, so review web server logs and file systems for web shells and unexpected child processes from October 20 onward.
Watch the darknet for downstream exposure. Monitor for your domains, employee credentials and customer data, and for the vendors that host your PHP applications.

Darknet monitoring matters most at step four. Patching closes the door, but it does not tell you whether someone walked through it first. DarkOwl Vision indexes the forums, markets, chats and leak sites where stolen data appears, so security teams can detect exposure before it is misused.

Sources

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws, SecurityWeek
PHP website vulnerabilities, Cybersecurity Dive
Forum announcements: Telegram posts by BreachForums and DarkForums administrators, October 21, 2026
DarkOwl Vision collection: search results from October 14 to October 21, 2026, leak context records for the eight forum database leaks above, and site context records for the three forums

Don’t miss anything from DarkOwl. Follow us on LinkedIn.

Q3 2026 Product Updates and Highlights

Written by DarkOwl Content Team on October 20, 2026. Posted in Blog.

October 20, 2026

A look at new capabilities, platform improvements, and data updates across July, August, and September.

This quarter centered on three themes: Cases as the single place for your searches, findings, and alerts; clearer, more targeted search and Explore views; and the first structured Data Leak records, alongside new market analytics and notable leaks collected this quarter. Keep an eye out for more structured data in the coming quarters.

Cases Become the Home for Your Work

Investigations produce three kinds of output: searches, the findings those searches turn up, and the alerts that tell you when something changes. Until now, personal tools and Cases held those pieces in different places. This quarter we brought them together. Cases are now the one place where a search is saved, a finding is captured, and an alert is reviewed. With everything in one place, we focused on making Cases faster to work in – starting where the work begins.

The Search Bar Tools menu now includes Case Tools that puts your searches and blocks one click away. You can Pin a Case as your default, so you don’t interrupt your flow with every Finding. Alerts get the same treatment. A new Case Alert Group feature organizes your alerts by Alert Date, Tag, Search, or Criticality, and each group shows a summary, so you can decide where to start. When an investigation wraps up, Case Archiving separates Active and Archived Cases on the Cases home page, which keeps finished work out of the way.

Data Updates: Structured Leaks Arrive

Structured Data Leaks, now live in Vision, turn each leak into records you can query, filter, and read by field. Each record is organized into up to 40 attributes, with classification tags that help surface corporate, financial, identity, and device threats. The original headings from the source are retained and displayed alongside their data values, so context from the source file is not lost. Date options are richer as well, with both collected and posted dates available, and there are many more new features to explore.

Querying is sharper too. Username and alias searches now reach structured leak records, and they are especially powerful alongside other DarkOwl sources such as Forum Posts and Chat Messages when you are tracking actor activity. A handle that appears in a leak record can be followed to the forums and chats where the same handle is active.

Structured leak content is supported today in general search and the Search API, and more is coming. Customers can request beta access to our upcoming Leaks API, which will add enhanced query functionality and summarization features.

Market Analytics and Reporting

Darknet market data is most useful when it becomes a view you can act on. DarkMart™, DarkOwl’s structured collection of darknet marketplace content, gives us the listings, vendors, prices, and shipping details to build that view. This quarter we added the ability to turn it into intelligence reports. Product Category Reports go deep on a single category found on darknet markets, such as drugs, pharmaceuticals, or weapons. Top products with median prices, leading vendors, biggest movers against the previous period, pricing compared with the 12-month median, active markets, and shipping flows are all included. Activity and Trend Reports show markets that are new or going quiet, popular products moving across markets, pricing trends, emerging products and vendors, and geographic shipping trends.

Vision UI and Vision API Enhancements

Vision UI and the Vision API gained many new features this quarter. The updates below are a sampling:

Data Source Icons: We introduced a new search result layout with Visual Icons, making it easy to scan result types.

Usage and Activity Reporting: Usage metrics for Entity lookups, Translations, and Direct to Darknet launches now appear on the Activity page and in Usage Report downloads, so you can report a fuller picture of how Vision UI is used. For teams that use Vision API, the Usage API now supports filtering by date.

Data Leaks in Entity Explore and Entity API: Cryptocurrency, Card, and BIN entities in Entity Explore now include a Data Leak summary box, and Entity API returns data leak information in the response.

Collection Stats

Our data collection team continues to astonish us with the quantity of data made available across all DarkOwl products, including year over year growth for the number of email addresses, domains, credit card numbers, IP addresses, and crypto addresses.

Notable Content Collected

DarkOwl indexed a number of leaks attributed to ShinyHunters this quarter, and we are following the group closely. The victims span industries: healthcare and life sciences (Accord Healthcare, Lumenis), travel and retail (Carnival Corporation, Ralph Lauren, [JC Penney]), technology and communications (Fluke Corporation, American Tower Corporation), financial services (Abrigo, BOK Financial), and education and government (Houston City College, Moody Bible Institute, the Council of Europe). For recent activity from the group, read DarkOwl’s September 25, 2026 post, FBI Allegedly Hacked by ShinyHunters.

BOK Financial

Data purported to be from BOK Financial was posted on ShinyHunters on August 28, 2026. The post claimed 46 GB or more of data, and DarkOwl collected 48.3 GB. BOK Financial serves consumer, business, and wealth clients across the American Midwest and Southwest.

DarkOwl’s file tree analysis shows a large and varied collection that includes 848 JSON files, 707 HTML files, 398 SQL files, 76 Excel workbooks, 63 PDFs, 59 email messages, and 22 configuration files. Source code, API keys, and tokens appear among the exposed content, which makes this leak relevant beyond customer data: credentials and code give an adversary a path into systems as well as into records.

Police National Legal

Data purported to be from the Police National Legal Database (PNLD) was posted on ExfilSquad on August 3, 2026. According to the post, the leak contains 135,000 law enforcement contact records, including full names, email addresses, and police jurisdictions. DarkOwl indexed 135,065 records, which matches the claim.

PNLD has provided a legal database to the 43 Home Office police forces in England and Wales and the British Transport Police for over 30 years, and its customers include the Crown Prosecution Service and Trading Standards. In a public statement on August 2, 2026, PNLD acknowledged a July 26 cyber incident that exposed contact information of police staff, partner organizations, and public users. Contact records tied to police jurisdictions can support targeted phishing and social engineering of law enforcement personnel.

For more on the group that posted this leak, read DarkOwl’s August 6, 2026 analysis, ExfilSquad: A New “Data extortion group” Player Claiming High-Profile Breaches Across the US, UK, and Beyond. It also covers PNLD’s public confirmation of the incident.

Leaks of Interest

Council of Europe

Data purported to be from the Council of Europe (coe.int) was posted to the ShinyHunters data leak site in June 2026. According to the post, the group claimed to have exfiltrated 297GB of data across 429,000 files, from multiple Council of Europe divisions, including human resources, the Secretariat, the Parliamentary Assembly, and the European Directorate for the Quality of Medicines & HealthCare. Data exposed includes employee names, IDs, addresses, phone numbers, dates of birth, tax and social security information, and medical records, along with payroll and bank account information.

Carnival Corporation and Plc

Data purported to be from Carnival Corporation was posted by ShinyHunters, which listed Carnival Corporation on its “pay or leak” portal on April 18, 2026. According to the post, the leak contained 8.7 million records with 7.5 million unique email addresses and included fields indicating the data related to the Mariner Society loyalty program operated by Holland America Line. Data exposed includes names, dates of birth, email addresses, genders, geographic locations, and loyalty program details.

Police National Legal Database (PNLD)

Data purported to be from the UK’s Police National Legal Database was posted by the extortion group ExfilSquad, which listed PNLD on its leak site on July 26, 2026. According to the post, the group stole about 1.9 GB of data covering roughly 135,000 records, split between 114,000 PNLD subscribers and 21,000 Ask the Police users. Data exposed includes names, organizations, and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers.

Curious how these features and data can make your job easier? Get in touch!

Inside the Nexus Leak

Written by DarkOwl Content Team on October 15, 2026. Posted in Blog.

How a 160-Million-Record ID Database Spread Across the Dark Web

October 15, 2026

In late August 2026, a post appeared on the Russian-language cybercrime forum Exploit offering persistent access to a proprietary database of breached identity documents, reportedly pulled from an identity verification vendor and its client base. Within days, the same dataset was being repackaged and resold across at least three additional forums, a dedicated storefront, and a cluster of Telegram channels — long after the original listing had gone quiet.

DarkOwl analysts tracked the spread of this dataset, known by the name of the tool its original seller built to access it: Nexus. This post walks through what we found, and what it says about how stolen identity data circulates once it hits the dark web. In the interest of protecting the people whose personal documents were exposed, this post omits names, images, and identifying details of any individuals referenced in the underlying leak.

How It Started

On August 30, 2026, a relatively new Exploit forum account calling itself “databroker1,” registered just a few months earlier, posted an offer for “our proprietary and exclusive database of breached identity documents.” The post claimed persistent, continuous access to a major identity verification company and its customers, “which include multiple Fortune-500 companies,” with new data being exfiltrated for “over a year.”

The advertised haul: more than 160 million North American driver’s licenses and identification cards, plus over 10 million additional documents spanning international IDs, travel documents, residency cards, and medical cards. Records reportedly included barcode data and, in some cases, front-and-back scans of the physical document under regular, UV, and IR light.

To manage sales, databroker1 said they had built Nexus, a web application for browsing and purchasing individual records. Registration and searching were advertised as free, with pricing per record, and access was offered via a dedicated onion address.

To prove that the data was genuine, the seller pointed to a sample record. The document shown was independently confirmed as authentic by the person it belonged to, Brian Krebs, a security researcher who wrote publicly about receiving a tip that their own identity document was being used as a sales sample.

A Quick Disappearance

The Nexus storefront didn’t last long. Three days after the original post, another forum user reported that “this service is no longer available.” Other members speculated the operator had gotten spooked and pulled the listing down; at least one prospective buyer claimed to have seen the data firsthand and offered to pay several thousand dollars for access regardless. By the time DarkOwl reviewed the listing on September 14, the Nexus onion address was returning an invalid-site error, and the original post was subsequently removed from Exploit entirely. The “databroker1” profile, which had made only a single post, was gone as well.

Where the Data Likely Came From

The leak was first reported publicly by Brian Krebs, who said a source had alerted them that their own ID was being used as proof of the data’s authenticity. Their investigation pointed to IDScan, an identity-verification technology provider, as the likely source.

On September 4, 2026, IDScan disclosed that it had identified possible unauthorized access to data stored in its cloud environment, with potentially affected information including full names, driver’s license numbers, and numbers from other government-issued IDs. The company said it was cooperating with federal law enforcement.

DarkOwl analysts have not independently confirmed that the data offered on Exploit came directly from IDScan. However, several of the actors who later resold the dataset explicitly named IDScan as the source in their own posts.

The Data Goes Wide

Once the original Nexus listing disappeared, the same dataset resurfaced across other corners of the dark web, each time with a new seller and a different price tag.

September 5, 2026 — BreachForums

An account using the alias ShinyHunters advertised the dataset, describing document types and a list of affected organizations, and confirming IDScan as the source. The listing referenced an original asking price of $500,000, later dropped to $300,000, and claimed the group had “had this data for years” — expressing surprise that Nexus was independently reselling it.

September 5–6, 2026 — DarkForums

Near-identical posts appeared from separate DarkForums accounts, each reusing much of the same wording as the BreachForums listing but offering different contact channels and sample links — one pointing to a storefront selling the same dataset outright for $6,000, another asking as much as $90,000.

September 6–14, 2026 — Telegram

Multiple Telegram channels shared the same pricing, victim list, and sample material, occasionally forwarding posts between channels to widen their reach. One channel was later banned for violating Telegram’s terms of service; another continued circulating contact details, specifying it would only accept cryptocurrency payment.

Who Says They Were Affected

Threat actors reselling the dataset listed a range of organizations they claimed were impacted as customers of the identity-verification vendor, spanning retail, hospitality, automotive, finance, and gaming sectors, among others. DarkOwl has not independently verified this list it reflects claims made by the threat actors themselves, inclusion on a criminal seller’s list is not proof that an organization’s data was actually compromised.

Why This Matters

The Nexus case is a useful illustration of a pattern DarkOwl sees repeatedly: identity-verification and KYC vendors are high-value targets precisely because they concentrate the two things identity thieves want most — document scans and the personal data needed to use them. And once a dataset like this reaches even one dark web forum, taking down the original listing does little to stop its spread. Within two weeks, the same records had been repackaged by at least four separate sellers across forums, a dedicated storefront, and Telegram, each pricing and marketing it independently. Although it cannot be confirmed that these actors actually had access to the data they claimed. Actors have been known to take advantage of high profile data leaks to scam fellow criminals.

Key takeaways: a single compromised vendor can expose data spanning hundreds of downstream customers, not just the vendor itself. Stolen datasets rarely stay with one seller expect rapid resale, rebranding, and price competition once data surfaces. Overlapping infrastructure and copied listing text can reveal ties between seemingly unrelated dark web personas. And continuous monitoring matters: the original listing was gone within days, but the data kept circulating for weeks afterward.

DarkOwl continues to monitor forums, marketplaces, and messaging platforms associated with this activity for further developments, including any indication the dataset is being distributed for free or used in follow-on fraud campaigns.

Curious to learn more about darknet monitoring? Contact us.

AI Is Rewriting the Ransomware Playbook

Written by DarkOwl Content Team on October 13, 2026. Posted in Blog.

October 13, 2026

Artificial intelligence is reshaping cybersecurity on both sides of the battlefield. While organizations are increasingly adopting AI to strengthen their defenses, cybercriminals are using the same technology to launch faster, more sophisticated ransomware attacks that outpace traditional security measures. According to CrowdStrike’s 2025 State of Ransomware Survey, 76% of organizations say they struggle to keep up with AI-powered threats, and nearly 90% believe AI-driven protection is now essential.

According to the Global Cybersecurity Outlook 2026 survey, 87% of respondents identified AI-related vulnerabilities as the fastest-growing cyber risk in 2025. Looking ahead, data leaks associated with generative AI (34%) and the advancement of adversarial capabilities (29%) are the leading concerns for 2026. This represents a notable shift from 2025, when adversarial capabilities ranked first at 47%, compared with just 22% for genAI-related data leaks. The change signals a turning point in the AI risk landscape: while the AI arms race between attackers and defenders continues, growing attention is shifting from offensive AI capabilities toward the unintended exposure and misuse of sensitive data through generative and agentic systems.

The findings highlight a growing reality for businesses: as attackers continue to weaponize AI to automate and accelerate every stage of an attack, the question is no longer whether AI belongs in cybersecurity, it’s whether defenders can gain the advantage before adversaries do.

AI is Reshaping the Ransomware Threat Landscape

The 2025 Ransomware Survey conducted by CrowdStrike gathered responses from more than 1,000 IT and cybersecurity decision-makers across multiple countries. The findings highlighted a broad range of concerns, with the growing impact of AI emerging as a key theme.

Artificial intelligence is accelerating the sophistication and speed of ransomware attacks, with 76% of organizations reporting that it is becoming increasingly difficult to prepare as attackers use AI to evade traditional defenses. Social engineering has emerged as one of the greatest concerns: 82% believe AI-generated phishing emails are harder to detect, even for well-trained employees, and 87% say AI-powered social engineering is more convincing than traditional tactics. Looking ahead, 87% also expect deepfake audio and video to become major attack vectors, highlighting that employee awareness training alone may no longer be sufficient to counter evolving threats.

Organizations are also struggling to keep pace operationally. Nearly half worry they cannot detect and respond to AI-driven attacks quickly enough, while 85% believe traditional detection methods are becoming obsolete. Although AI adoption among defenders is increasing, implementation remains uneven: a little over half of organizations currently use AI-powered threat detection, with lower adoption in sectors such as the public sector. Concerns also vary across regions and industries, but the overall trend is consistent: AI is transforming ransomware into a faster, more adaptive threat that requires equally advanced, AI-enabled security capabilities.

How Cybercriminals are Using AI

One of the clearest examples is the explosion of AI-powered phishing. SentinelOne reports a 1,265% increase in AI-assisted phishing attacks, highlighting how generative AI has become a force multiplier for ransomware operators. Rather than sending generic spam, attackers can now build highly personalized campaigns at scale by using AI to:

Analyze publicly available information about individuals and organizations
Generate tailored phishing messages based on a target’s role, industry, or recent activity
Produce polished, grammatically accurate emails in multiple languages
Launch thousands of personalized campaigns with minimal manual effort

The result is phishing that is both more convincing and significantly easier to scale, increasing the likelihood of attackers obtaining the credentials or initial foothold needed to deploy ransomware.

AI is also shrinking the window between vulnerability disclosure and active exploitation. Security researchers have demonstrated that AI can generate working proof-of-concept exploits for newly disclosed vulnerabilities in as little as 10 to 15 minutes after a CVE is published. AI models can rapidly analyze vulnerability databases, review public proof-of-concept code, compare software patches to identify exploitable weaknesses, and produce exploit code that attackers can adapt for real-world use.

Cybercriminals are using AI to accelerate malware development by generating new variants with customized features that are more difficult for traditional security tools to detect. Rather than creating malware entirely from scratch, generative AI is particularly effective at rewriting, modifying, and obfuscating existing malicious code, allowing attackers to rapidly produce thousands of unique variants that can bypass signature-based defenses. AI also enables attackers to analyze source code and identify vulnerabilities more quickly, helping them tailor malware for specific environments after gaining initial access. In addition, AI-powered tools lower the technical barrier for cybercriminals by assisting with tasks such as generating ransomware scripts, phishing kits, and password-cracking techniques. Together, these capabilities allow ransomware operators to launch attacks faster, evade detection more effectively, and continuously adapt their malware to defensive measures.

JadePuffer: The First Fully Autonomous AI-Powered Ransomware Attack

Recent research from Sysdig highlights a significant shift in the ransomware landscape with the discovery of JadePuffer, an operation that appears to have been executed entirely by an autonomous large language model (LLM) agent. Rather than relying on a human operator, the AI agent independently carried out every stage of the attack, from initial reconnaissance and credential theft to lateral movement, privilege escalation, persistence, and ultimately data encryption. It gained initial access by exploiting CVE-2025-3248, a remote code execution vulnerability in Langflow, an open-source framework for building LLM applications. Throughout the intrusion, the agent demonstrated the ability to adapt when its actions failed, modifying its approach and refining its tactics until it achieved its objective. Although the individual techniques used were already well known, JadePuffer showed that AI can autonomously orchestrate the complete ransomware lifecycle without direct human involvement.

The significance of JadePuffer extends well beyond automation; it challenges many of the assumptions underlying modern cyber defense. Looking ahead, JadePuffer should be viewed as a proof of concept for a new generation of ransomware. As AI-powered attack frameworks mature, they are likely to lower the technical barrier for threat actors, enable attacks against multiple organizations simultaneously, and create increasingly adaptive ransomware campaigns that can outpace traditional, human-driven detection and response processes.

Conclusion

Traditional security controls such as multi-factor authentication prompts, alert thresholds, and incident response workflows are largely designed around the assumption of a human adversary who can be slowed by friction, fatigue, or error. Autonomous AI agents challenge that assumption by operating at machine speed, rapidly working around obstacles and potentially reducing the time from initial compromise to ransomware deployment to minutes. Their ability to continuously adapt to defensive measures may further reduce the effectiveness of static controls, while AI-generated payloads could complicate signature-based detection by dynamically modifying their characteristics during an attack. At the same time, recovery mechanisms may shift from being secondary targets to primary objectives as attackers seek to disrupt an organization’s ability to restore operations.

The findings from GuidePoint Security’s Q2 2026 report highlight several ransomware trends being observed this year, including continued growth in ransomware activity, the emergence of AI as a tool to improve threat actor efficiency, and the persistence of manufacturing as a frequently targeted sector. While the threat landscape continues to evolve, these trends underscore the importance of maintaining strong cybersecurity fundamentals, regularly assessing risk, and preparing for increasingly sophisticated extortion tactics.

Curious to learn more? Contact us.

What is Malware as a Service?

Written by DarkOwl Content Team on October 8, 2026. Posted in Blog.

October 08, 2026

Cybersecurity might as well have its own language. There are so many acronyms, terms, and sayings that unless you are deeply knowledgeable, have experience in the security field, or have a keen interest, one may not know what they mean. Understanding these terms is the first step to developing a thorough understanding of cybersecurity and, in turn, better protecting yourself, clients, and employees.

In this blog series, we aim to explain and simplify some of the most commonly used terms. Previously, we have covered bullet proof hosting, CVEs, APIs, brute force attacks, zero-day exploits, doxing, data harvesting, IoCs, credential stuffing, ransomware as a service, push bombing, web application attacks, man-in-the-middle attacks, ransomware leak sites, the CIA Triad, and encryption. In this edition, we dive into malware as a service..

Malware as a Service (MaaS) 101

Malware is one of the most persistent threats facing organizations worldwide. From stealing sensitive information to disrupting business operations, malicious software can cause significant financial and reputational damage. Traditionally, developing and deploying sophisticated malware required technical expertise, time, and resources. Today, cybercriminals can bypass much of that work by purchasing access to malware through a model known as Malware as a Service (MaaS).

Malware as a Service is a cybercrime business model in which malware developers sell or lease malicious software, infrastructure, and related services to other threat actors. Rather than building their own tools, buyers can purchase ready-made malware, often through subscription plans or one-time payments. Depending on the offering, these packages may include software updates, technical support, hosting infrastructure, and dashboards for managing campaigns. The result is a more accessible criminal ecosystem. Individuals with limited programming knowledge can use tools developed by more experienced threat actors to launch attacks against organizations and individuals.

MaaS operates similarly to legitimate Software as a Service (SaaS) platforms, where customers pay to access software maintained by a provider. The difference is that MaaS products are designed to facilitate cybercrime. Developers may earn recurring revenue from subscriptions, while customers use the tools to steal credentials, collect sensitive information, establish unauthorized access, or distribute additional malware.

This business model also creates specialization within the cybercrime economy. Developers can focus on building and maintaining malware, while affiliates and customers concentrate on distributing it and exploiting the information or access they obtain. Like Ransomware as a Service (RaaS), MaaS lowers the barrier to entry for cybercriminals and allows malicious campaigns to scale beyond the capabilities of a single operator.

Types of Malware Offered as a Service

Not all malware is designed to accomplish the same objective. MaaS offerings can support a range of malicious activities, depending on the software, infrastructure, and services included in a package. Below are some of the most common.

Information Stealers

Information stealers, also known as infostealers, are types of malware designed to collect sensitive information from infected devices. Depending on the malware, this information may include saved browser credentials, authentication tokens, cryptocurrency wallet data, and other sensitive files.

Cybercriminals can use this information to access corporate accounts, impersonate legitimate users, commit financial fraud, or sell the stolen data to other threat actors.

Infostealer operators frequently monetize their activity through subscriptions and the sale of stolen information. Some services also provide access to stealer logs, which are collections of data extracted from infected devices. These logs can become valuable commodities on darknet marketplaces and underground forums, particularly when they contain credentials associated with corporate systems.

Remote Access Trojans (RATs)

Remote Access Trojans (RATs) are malicious programs that allow an attacker to gain unauthorized remote control over an infected device. Depending on their capabilities, RATs may enable an operator to monitor activity, access files, execute commands, or collect sensitive information.

Through MaaS arrangements, threat actors can obtain access to remote-control malware without developing it themselves. Once deployed, these tools may provide a foothold that enables further malicious activity, including surveillance, credential theft, or attempts to move deeper into an organization’s network.

In the Wild

Nimbus Manticore, the Iranian hacking group, has been connected to two (NodeRabbit and PollCat) previously undocumented malwares targeting Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript. Nimbus Manticore, also known as Iranian Dream Job, has been targeting job candidates with fake recruitment coding challenges designed to infect their computers. In one case, attackers distributed a project-management application called Taskflow and asked candidates to find bugs in the frontend within three hours. The challenge appeared legitimate, but malicious code was hidden in the supposedly “bug-free” server.js file. It loaded a trojanized Node.js package that secretly launched NodeRabbit, a backdoor capable of communicating with attacker-controlled servers. Once installed, NodeRabbit can collect system information, run commands, access and modify files, manage directories, and gather network details. It can also execute temporary scripts and delete them afterward to hide evidence of its activity. Read more here.

Botnet Malware

A botnet is a network of compromised devices that can be controlled by an operator. These devices may include computers, servers, and Internet of Things (IoT) devices.

Some MaaS offerings provide malware that recruits infected devices into a botnet, while other services sell access to existing botnet infrastructure. Threat actors may use these networks to conduct Distributed Denial-of-Service (DDoS) attacks, distribute spam, or support other malicious campaigns.

The scale of a botnet can make it particularly disruptive. By coordinating activity across many compromised devices, attackers can overwhelm online services or use distributed infrastructure to support additional operations.

Ransomware

Ransomware is malware that encrypts files or otherwise prevents victims from accessing their systems or data, typically to extort payment. Some ransomware operations use a service-based model in which developers supply the malware and supporting infrastructure to affiliates.

Although Ransomware as a Service is often treated as its own category, it shares many of the same characteristics as MaaS. Both models allow threat actors to access malicious tools without independently developing the underlying software.

The distinction is that ransomware is specifically designed to support extortion, while MaaS is a broader category that can include many different types of malicious software and objectives.

How Does Malware as a Service Work?

MaaS is not simply a transaction in which someone purchases a malicious program. It is an ecosystem of developers, vendors, infrastructure providers, and customers who work together to distribute malware and monetize its impact.

The process typically involves several stages:

Malware development: Developers create malicious software, maintain its functionality, and may release updates to improve its capabilities or address problems encountered by customers.
Distribution and marketing: Vendors advertise their offerings through underground forums, darknet marketplaces, encrypted messaging channels, or other criminal communities. Listings may describe the software’s capabilities, subscription options, and available support.
Purchase or subscription: Customers pay for access to the malware or related services. Some offerings are sold for a one-time fee, while others require recurring payments. Cryptocurrency may be used to facilitate transactions, although payment methods vary.
Deployment: Customers distribute the malware through methods such as phishing emails, malicious downloads, compromised websites, or other delivery mechanisms. The delivery method depends on the tool and the attacker’s objectives.
Collection and monetization: Once malware has infected a device, attackers may collect credentials, steal files, establish unauthorized access, or carry out other malicious activities. Stolen information can then be used directly or sold to other criminals.
Resale and further exploitation: The information obtained during an attack may be passed through several hands. For example, stolen credentials may be sold to an initial access broker, who then sells access to another threat actor for use in a larger intrusion or ransomware campaign.

This division of labor makes the MaaS ecosystem difficult to disrupt. Developers may never interact directly with victims, and the person deploying the malware may not be the person who ultimately profits from the stolen data.

It also means that a single malware infection can have consequences beyond the original compromise. Information stolen from one device may enable additional attacks against an employer, a business partner, or a customer.

Why Is Malware as a Service a Growing Threat?

MaaS has changed the economics of cybercrime. Threat actors no longer need to possess advanced programming skills or spend months developing malicious software. Instead, they can purchase tools that have already been developed, tested, and maintained by other criminals.

Several factors contribute to the continued growth of this model.

Low Barrier to Entry

Developing malware from scratch requires technical knowledge, time, and resources. MaaS removes much of that investment by providing ready-made tools that customers can deploy with limited expertise.

Some services even offer user-friendly dashboards, documentation, and technical support. This allows a broader range of threat actors to participate in cybercrime, increasing the number of potential attackers organizations must defend against.

Scalability and Automation

MaaS providers can distribute the same malware to multiple customers, who may use it against different targets simultaneously. Automated features can further increase the speed and scale of malicious campaigns.

For example, a single infostealer sold to multiple subscribers could be used to collect credentials from hundreds or thousands of devices. Those credentials may then be sold, traded, or used to gain unauthorized access to additional systems.

This scalability makes MaaS particularly concerning for organizations that rely on credentials to protect corporate applications, cloud environments, and internal networks.

Professionalized Cybercrime Economy

Cybercriminals increasingly operate through structured marketplaces and service-based business models. MaaS vendors may advertise product features, publish updates, offer customer support, and establish reputations within underground communities.

These practices make malicious services easier to purchase and create recurring revenue streams for developers.

DarkOwl research and analysis provides visibility into these criminal ecosystems by indexing darknet forums, marketplaces, and other underground sources where threat actors advertise malware, discuss attack methods, and exchange compromised information.

Connections to Other Cybercrime Services

MaaS rarely operates in isolation. It can overlap with several other criminal services, creating a chain of activity in which different threat actors specialize in different stages of an attack.

For example, an infostealer may collect corporate credentials from an infected device. Those credentials could be sold through an underground marketplace or passed to an initial access broker (IAB), who specializes in selling unauthorized access to compromised systems. Another threat actor may then use that access to deploy ransomware or steal additional data.

Each participant contributes to the attack without necessarily interacting with the original victim. This interconnected ecosystem makes it more difficult for security teams to understand the full scope of a threat by investigating a single malware sample or security incident.

Malware as a Service and the Darknet

The darknet plays an important role in the MaaS ecosystem. Underground forums, marketplaces, and encrypted messaging channels give threat actors places to advertise malicious software, recruit customers, exchange information, and sell stolen data.

These environments can also provide valuable intelligence for defenders.

Darknet listings may reveal which malware families are being promoted, what capabilities vendors claim to offer, and which industries or organizations are being discussed by threat actors. Discussions between customers and vendors can provide additional context about the tools being used and the methods associated with particular campaigns.

However, an advertisement does not necessarily mean a product works as claimed or that an attack is imminent. Threat intelligence analysts must evaluate the credibility of the source, corroborate findings, and distinguish between marketing claims, speculation, and evidence of actual malicious activity.

What Darknet Intelligence Can Reveal

Monitoring underground activity can help security teams identify several types of potential risk:

Malware advertisements: Listings for infostealers, remote access tools, botnet services, and other malicious software can provide insight into the tools available to threat actors.
Credential exposure: Stolen employee credentials, authentication tokens, and stealer logs may indicate that an organization has already experienced a compromise.
Emerging attack methods: Discussions about new malware capabilities, security evasion techniques, or vulnerabilities can help analysts understand evolving attacker behavior.
Targeted organizations: Mentions of company names, domains, brands, or employees may provide context about potential targeting or previously undiscovered exposure.
Criminal relationships: Connections between vendors, malware operators, and other threat actors can help analysts build a more complete picture of the cybercrime ecosystem.

Connecting these findings can help organizations move beyond reacting to individual security alerts and toward a more proactive understanding of their exposure.

How Can Organizations Protect Against MaaS?

There is no single security control that can prevent every malware infection. Because MaaS supports multiple types of attacks, organizations should combine technical safeguards, employee awareness, incident response, and threat intelligence.

Implement Endpoint Detection and Response

Endpoint detection and response (EDR) solutions help security teams monitor endpoint activity, identify suspicious behavior, and investigate potential compromises.

Rather than relying exclusively on known malware signatures, security teams should also look for behaviors associated with malicious activity, such as unauthorized credential access, suspicious process execution, or unexpected connections to external infrastructure.

Strengthen Identity and Access Management

Stolen credentials are a common commodity in the cybercrime economy. Organizations should enforce multifactor authentication (MFA), use phishing-resistant authentication where possible, and apply least-privilege access controls.

Security teams should also monitor for exposed credentials and revoke compromised sessions or tokens when necessary. Resetting a password alone may not be sufficient if an attacker has obtained an active authentication token or maintained another form of access.

Keep Systems Updated

Unpatched software can provide opportunities for attackers to gain access to systems or execute malicious code. Organizations should maintain an inventory of their assets, prioritize security patches based on risk, and address known vulnerabilities promptly.

Regular updates do not eliminate every attack path, but they help reduce the number of weaknesses available for exploitation.

Train Employees to Recognize Phishing

Phishing emails, malicious attachments, and deceptive downloads remain common ways to distribute malware. Employees should understand how to recognize suspicious messages, verify unexpected requests, and report potential security incidents.

Organizations should also use email security controls, web filtering, and application restrictions to reduce the likelihood that a single mistake results in a successful infection.

Maintain Reliable Backups and Incident Response Plans

Organizations should maintain regular, tested backups of critical data and ensure that recovery copies are protected from unauthorized access or modification.

Incident response plans should address how to isolate infected devices, investigate potential credential theft, determine whether sensitive information was exposed, and restore affected systems.

A malware infection may be only the beginning of a larger incident. Understanding what information was accessed and whether attackers retained access is just as important as removing the initial malware.

Monitor the Darknet for Exposed Information

Traditional security tools primarily focus on activity within an organization’s devices, networks, and cloud environments. However, information associated with an organization may appear on underground sources after it has already been stolen.

Darknet monitoring provides another layer of visibility by helping security teams identify exposed credentials, leaked data, malware advertisements, and other indicators of potential risk.

When combined with internal security telemetry, this intelligence can help organizations investigate incidents, identify exposure that might otherwise go unnoticed, and prioritize remediation efforts.

Curious to learn more about dark web monitoring? Contact us.

GDPR and Dark Web Investigations: When European Subjects Show Up in Breach Data

Written by DarkOwl Content Team on October 6, 2026. Posted in Blog.

October 6, 2026

An analyst pulls a stealer-log dataset while tracking a threat actor’s infrastructure. Buried in the rows: credentials, device fingerprints, and email addresses belonging to residents of France, Germany, and the UK. The investigation was never framed as a “European” matter — but at this point, GDPR is very likely already in play.

For US-based OSINT and dark web investigation firms, this is a common blind spot. GDPR exposure isn’t about where a firm is incorporated or where its servers sit. It’s about whose data ends up in the workflow, and why.

Territorial Scope: “We’re Not in Europe” Isn’t a Defense

Your analyst’s location or your company’s headquarters outside of the UK or EU does not exclude GDPR regulations. Article 3 of the EU GDPR is where this is defined.

For those unfamiliar, a few things to note:

There is an EU GDPR and a UK GDPR
EU GDPR came into effect May 25, 2018
After Brexit, the UK retained the GDPR as domestic law (the ‘UK GDPR’), which now operates alongside the Data Protection Act 2018.
The UK GDPR core data protection principals and individual rights are nearly identical, differences exist in other areas.
A few links to get you caught up:
- Understanding UK/EU GDPR: https://www.gdpradvisor.co.uk/eu-gdpr-vs-uk-gdpr
- EU GDPR: https://gdpr.eu/what-is-gdpr/
- EU GDPR: https://gdpr-info.eu/
- UK GDPR: https://www.gov.uk/data-protection
- UK GDPR: https://uk-gdpr.org/
- June 2025 updates: https://www.gov.uk/government/publications/data-use-and-access-act-2025-factsheets/data-use-and-access-act-factsheet-uk-gdpr-and-dpa

The European Data Protection Board’s guidance on territorial scope elaborates on what counts as “monitoring”. This includes tracking individuals on the internet, including through profiling, to analyze or predict behavior.

The effects of GDPR regulations in the US have hit recent headlines. US company Clearview AI scrapes public facial images and sells database access to law enforcement. In 2025, the UK Upper Tribunal held that this still fell within the GDPR’s territorial scope (ICO v Clearview AI Inc [2025] UKUT 319 (AAC)). No EU or UK establishment, only public data — still subject to UK data protection law. The same logic applies to US investigation firms whose sourcing touches EU or UK subjects.

Note: Clearview was granted permission to appeal, so this isn’t final.

A timeline of this case can be seen here.

Breach Data is Still Personal Data

A common misconception: once data has already leaked, privacy law no longer applies to it. GDPR doesn’t carve out an exception for data that was exposed by someone else. The obligation attaches to your processing — collecting, querying, storing, or analyzing that data — regardless of how it came to be public or semi-public.

GDPR’s definition of personal data is broad: identifiers, online identifiers, IP addresses, and device fingerprints all qualify. Breach dumps and stealer logs frequently go further, containing special category data. This is information revealing health conditions, sexual orientation, or religious or political affiliation (dating site breaches and religious-forum leaks being obvious examples). Article 9 prohibits processing this category of data except under narrow conditions (Article 9 GDPR; see also the ICO’s guidance on special category data). Investigators pulling from breach sources need a process for flagging this material, not just extracting whatever the dataset contains.

Finding a Lawful Basis: Legitimate Interests, Done Properly

Consent is impractical for investigative work. Under EU GDPR, most firms rely on legitimate interests under Article 6(1)(f), applying the EDPB’s three-part test: identify a lawful, real interest; confirm the processing is necessary; and balance it against the data subject’s rights.

Under UK GDPR, this has changed. The Data (Use and Access) Act 2025 added a new “recognised legitimate interests” basis for a defined list of purposes, including crime prevention, safeguarding vulnerable people, and national security, which does not require the full balancing exercise. Investigation work tied to crime prevention or safeguarding may now qualify for this lighter-touch UK basis, while EU-side processing on the same engagement would still need the full EDPB three-part assessment.

Either way, documentation is the artifact a regulator or opposing counsel asks for first: which basis applies, why the processing is necessary, and for EU GDPR, the balancing assessment itself.

Minimize, Retain Deliberately, and Settle who’s the Controller

Breach datasets are messy by nature and often contain far more than any single investigation needs. GDPR’s data minimization principle (Article 5(1)(c)) calls for extracting only what’s relevant, discarding or quarantining the rest, and tying retention to a defined period rather than indefinite storage.

A Practical Checklist for Investigations or Engagements

Does this engagement involve EU or UK data subjects, even incidentally? If so, GDPR likely applies regardless of where your firm operates.
Has a legitimate interest assessment been documented before breach or dark web data was pulled?
Has the dataset been screened for special category data, with extra scrutiny applied where it appears?
Is retained data minimized and tied to a defined deletion timeline?
Has controller/processor status been clarified in the client engagement agreement?
Would the processing survive a regulator’s “reasonable expectations” test? And would the data subject be surprised or alarmed to learn how their data was used?

The Takeaway

GDPR exposure for OSINT and dark web investigation work should not be unfamiliar roadblocks. Geography will not limit the coverage of GDPR, and firms should be prepared to handle this data carefully. Firms that build legitimate interest assessments, minimization practices, and clear controller/processor terms into their process before an engagement starts are the ones whose findings hold up under scrutiny.