DarkWatch Weekly: Ransomware Groups Active as Credential Thefts Surge

This week, DarkWatch monitored 53,233 captures across the dark web, tracking 15,797 entities and generating 2,030 alerts. Ten active targets were under close watch. The data shows ransomware groups remain highly active, and a staggering 15 billion credentials are circulating online, putting millions at risk.

Top Targets

Our top monitored targets this week include a mix of ransomware groups and dark web hubs:

  1. Ransomware Group (Unidentified) – A new or rebranded group showing high activity.
  2. Dark Web Discovery Hub – A service that indexes hidden sites.
  3. Rhysida – Known for targeting healthcare and education.
  4. LockBit – Still active despite law enforcement disruptions.
  5. RansomHouse – Focuses on data theft and extortion.
  6. 8Base – Targets small and medium businesses.
  7. Akira – Exploits VPN vulnerabilities.
  8. ALPHV/BlackCat – Continues to operate after exit scam rumours.
  9. BlackBasta – Specialises in double extortion.
  10. BianLian – Pivoted to pure data theft.
  11. Cactus – Uses encryption and exfiltration.
  12. Clop – Known for mass exploitation of file transfer tools.

These groups frequently leak data on dedicated sites, and this week we saw new leak sites for DragonForce, Embargo, and INC Ransom.

What It Means for Families

While these attacks often target businesses, the stolen data can include personal information like names, addresses, and passwords. That data can end up in the hands of other criminals who may attempt phishing or identity theft.

Actionable Takeaway

Use unique passwords for every account and enable two-factor authentication wherever possible. Check if your email has been in a breach at haveibeenpwned.com. If you receive suspicious emails or texts referencing personal details, don’t click links—verify directly with the organisation.

Alert Highlights

This week’s live scam alerts included high-risk ransomware sites for DragonForce, Embargo, and INC Ransom, plus low-risk suspicious email addresses linked to Nightspire Leak Site. Daily briefs also noted a 22% week-on-week rise in dark web activity, new Telegram scam channels, and the emergence of Lunex Stealer, which abuses AMD drivers to steal browser credentials.

Stay vigilant and keep your devices updated.

Related reading