DarkWatch Weekly: 483,239 Captures and 1,635 Alerts

DarkWatch, our dark web monitoring service, had another busy week ending 13 September 2026. We captured 483,239 items from hidden services, monitored 9,382 entities, and generated 1,635 alerts. There was 1 active target under close observation.

Top Monitored Targets

The most monitored targets this week were:

  1. Dark Web Discovery Hub – A key gateway for accessing hidden services, often used by criminals to discover marketplaces and forums.
  2. Ransomware Group (Unidentified) – A yet-to-be-named group that is actively discussed in dark web forums, indicating ongoing operations.
  3. LockBit – Despite law enforcement disruptions, LockBit remains a prominent ransomware brand, with affiliates continuing to operate.
  4. 8Base – A ransomware group known for aggressive tactics and data leak sites.
  5. Akira – A ransomware variant that has been targeting businesses across various sectors.
  6. ALPHV/BlackCat – Another major ransomware group that has been quiet since its exit scam, but still monitored for potential resurgence.
  7. BlackBasta – A ransomware group linked to the Conti syndicate, known for targeting large organisations.
  8. BianLian – A group that initially used pure extortion but has shifted to encryption.
  9. Cactus – A ransomware group that exploits vulnerabilities in VPN appliances.
  10. Clop – Known for mass exploitation of file transfer software, Clop continues to be a significant threat.
  11. Hunters International – A group that emerged after the Hive takedown, using similar tactics.
  12. Medusa – A ransomware group that has been targeting healthcare and education sectors.

Recent Captures

The majority of recent captures came from Ahmia, a search engine for Tor hidden services. This indicates that criminals are actively using search engines to discover new marketplaces and forums. The captures were largely search queries and results, highlighting the ongoing demand for illicit goods and services.

Live Scam Alerts

We identified a live ransomware site: a .onion address associated with a ransomware operation (risk: high). This site is actively being used to leak stolen data or communicate with victims.

What This Means for UK Families

While these threats primarily target businesses, the stolen data often includes personal information of individuals. Ransomware attacks on companies can lead to your data being exposed, which can then be used for identity theft or targeted phishing.

Actionable takeaway: If you receive a notification that your data was involved in a breach, change your passwords immediately and enable two-factor authentication where possible. Be extra cautious of unsolicited emails or calls, as criminals may use stolen data to make their scams more convincing.

DarkWatch continues to monitor these threats to provide early warnings and protect UK families.