DarkWatch Weekly: Ransomware Activity and Data Leaks
This week, our DarkWatch monitoring captured 140,006 items across dark web forums and leak sites. We identified 27,787 entities and raised 2,706 alerts. There are currently 14 active targets.
The Week in Numbers
- 140,006 captures – the total number of dark web posts and files we monitored.
- 27,787 entities – these are individuals, companies, or groups mentioned in those captures.
- 2,706 alerts – potential threats that required attention.
- 14 active targets – ongoing monitoring of specific threats.
Top Monitored Targets
Ransomware groups dominate our monitoring. The top targets this week are:
- Ransomware Group (Unidentified)
- Dark Web Discovery Hub
- Rhysida
- LockBit
- RansomHouse
- 8Base
- Akira
- ALPHV/BlackCat
- BlackBasta
- BianLian
- Cactus
- Clop
These groups are known for stealing data and demanding payment. They often publish stolen information on leak sites if victims don't pay.
Notable Captures
We saw activity on several leak sites, including Interlock, Lynx, DragonForce, LockBit, and RansomHouse. These sites are used by criminals to shame victims and share stolen data.
What This Means for UK Families
While these groups mainly target businesses, the stolen data often ends up for sale on the dark web. That means your personal information could be exposed if a company you use is attacked. This week, there were 47 UK ransomware victims, and over 15 billion credentials are in circulation globally.
Takeaway: Keep an eye on news about data breaches. If a company you use is affected, change your passwords and be alert for phishing emails that use your personal details to seem genuine. Using a password manager and enabling two-factor authentication can help protect you.
Related reading