DarkWatch Weekly: Ransomware Groups Dominate Dark Web Activity

Welcome to this week’s DarkWatch summary for the week ending 25 October 2026. DarkWatch is our monitoring service that tracks activity on the dark web to help us understand the threats facing UK families and businesses.

The Week in Numbers

  • 167,699 captures: This is the number of individual items (such as posts, files, or messages) we recorded across dark web sources.
  • 32,377 entities: The number of distinct actors, forums, or sites we identified.
  • 2,949 alerts: These are potential threats or items of interest that we flagged for further analysis.
  • 8 active targets: The number of high-priority targets we are currently monitoring closely.

This volume of activity shows that the dark web remains a busy marketplace for cyber criminals.

Top Monitored Targets

Our monitoring this week shows that ransomware groups are the most active and prominent entities on the dark web. The top targets are:

  1. Ransomware Group (Unidentified): A group we have not yet attributed, but which is highly active.
  2. Dark Web Discovery Hub: A service that helps users find other dark web sites.
  3. Rhysida: A ransomware group known for targeting healthcare and education.
  4. LockBit: One of the most notorious ransomware groups, despite law enforcement action.
  5. RansomHouse: Another ransomware group that steals data and demands payment.
  6. 8Base: A group that has been linked to numerous attacks.
  7. Akira: A ransomware group that has been expanding its operations.
  8. ALPHV/BlackCat: A prolific ransomware group.
  9. BlackBasta: A group known for double extortion tactics.
  10. BianLian: A group that has shifted to pure data theft and extortion.
  11. Cactus: A newer ransomware group.
  12. Clop: A group known for mass exploitation of software vulnerabilities.

These groups often leak stolen data on their dark web sites to pressure victims into paying. While they primarily target businesses, the stolen data can include personal information of customers and employees, which can then be used for identity theft or other scams.

What This Means for You

While these groups target organisations, the fallout can affect you if your data is compromised. It’s a reminder to keep your personal information safe and to be cautious if you receive notifications about data breaches.

Actionable takeaway: If you receive a data breach notification, change your passwords immediately and enable two-factor authentication where possible. Stay informed about which companies have been breached and monitor your accounts for suspicious activity.

DarkWatch will continue to monitor these threats and provide updates.

Related reading