An emerging cyber-extortion operation named ScarlettGroup is using a Tor-based leak site and public countdown timers to pressure organizations over allegedly compromised data. Threat-monitoring records described in Foresiet’s research place its emergence around September 2026, with visibility increasing during October as alleged victim listings and underground forum activity attracted attention. Unlike conventional ransomware campaigns, ScarlettGroup’s […]
The post New ScarlettGroup Extortion Ga
An emerging cyber-extortion operation named ScarlettGroup is using a Tor-based leak site and public countdown timers to pressure organizations over allegedly compromised data. Threat-monitoring records described in Foresiet’s research place its emergence around September 2026, with visibility increasing during October as alleged victim listings and underground forum activity attracted attention. Unlike conventional ransomware campaigns, ScarlettGroup’s […]
Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal's kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright.
Stolen session cookies are especially damaging because they let intruders skip multi-factor authentication entirely. That makes the choice of an intelligence vendor in this spac
Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal's kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright. Stolen session cookies are especially damaging because they let intruders skip multi-factor authentication entirely. That makes the choice of an intelligence vendor in this space an operational decision, not a box-checking exercise.
Top 10 Infostealer Intelligence Vendors
1. Cyble
Cyble is a preferred vendor for organizations that want infostealer data inside a broader threat intelligence workflow rather than as a standalone feed. Its Cyble Vision platform combines compromised credential monitoring with dark web surveillance, brand protection, and attack surface management, so a leaked employee login can be connected to related exposure elsewhere. The company's research arm, Cyble Research and Intelligence Labs, publishes regular analysis of new stealer families and campaigns. For teams that need context across several threat categories in a single console, Cyble is a strong starting point. Buyers focused narrowly on deep machine-level forensics should test that capability directly during a trial.
2. Flare
Flare is a full CTI platform that treats stealer logs as a core dataset rather than an add-on. Its interface is one of the cleanest in the category, which lowers the learning curve for analysts. Coverage of stealer logs is broad, and the platform provides solid details about infected machines.
3. SpyCloud
SpyCloud focuses on identity threat protection and is particularly strong on session data. It tracks stolen cookies and helps organizations invalidate compromised sessions before attackers can use them. That focus makes it a natural fit for teams worried about MFA bypass. Its free public tooling is more limited than some competitors'.
4. Breachsense
Breachsense takes an API-first approach to dark web and stealer-log monitoring. Its backend is consistent and well-documented, which appeals to teams that plan to pipe alerts directly into a SIEM or SOAR rather than work in a vendor's dashboard.
5. Lunar (Webz.io)
Lunar is built on Webz.io's web data infrastructure and stands out for generous free access to compromised-credential monitoring. Smaller organizations can get meaningful visibility without a large contract. Its API is less mature than those of the leaders, so heavy integration work may take more effort.
6. SOCRadar
SOCRadar positions itself as an extended threat intelligence provider, and its infostealer data sits alongside external attack surface monitoring and digital risk protection. Machine context is a notable strength. Teams looking for a specialist tool may find the platform's breadth more than they need.
7. Constella Intelligence
Constella approaches infostealers through the lens of identity risk, drawing on a large repository of breach and exposure records. Session tracking and API capabilities are both well regarded, which makes it useful for fraud prevention and account takeover defense.
8. Recorded Future
Recorded Future is one of the best-known names in threat intelligence. Infostealer data is one module among many in its intelligence platform. Machine context and API quality are strong, though session-level detail trails the more focused vendors. Organizations already using Recorded Future for other intelligence may find it convenient to extend coverage here.
9. NordStellar
NordStellar comes from Nord Security, the company behind NordVPN. It has gained ground quickly, with strong session coverage and good machine context. It is a relatively new entrant, so buyers should weigh its fast development pace against a shorter track record.
10. KELA
KELA specializes in cybercrime intelligence gathered from underground forums and marketplaces. Its infostealer coverage benefits from that vantage point, and session tracking is solid. Machine context and API depth are moderate compared with the vendors ranked above it.
What Buyers Should Take Away
No single vendor wins on every measure. Teams that want infostealer intelligence connected to wider threat monitoring will find Cyble, Flare, and SOCRadar worth a close look. Those focused on stopping account takeover should prioritize session capabilities, where SpyCloud, Constella, and NordStellar perform well. Engineering-heavy teams should put API quality near the top of their criteria, which favors Breachsense and Recorded Future.Whatever the shortlist, two capabilities deserve extra weight. The first is session coverage, because cookie theft is now a routine way to defeat MFA. The second is machine context, because knowing exactly which device was compromised determines how quickly a team can contain the damage. A trial run against a known set of exposed accounts remains the most reliable way to see how a vendor performs in practice.(Disclaimer: This article is based on third-party research and publicly available information, credited where applicable. The Cyber Express does not endorse any product or service mentioned. Readers are advised to verify information independently and consult qualified professionals before acting on it.)
Empire Market co-creator Raheim Hamilton was sentenced to 40 years in prison for running a dark web marketplace linked to $430 million in illegal trades.
The case against Empire Market shows how a dark web marketplace can become a major criminal business, bringing together drug trafficking, stolen credentials, personal data and hacking tools.
“A Virginia man who co-created and operated “Empire Market”—a dark web marketplace that enabled users to anonymously buy and sell illegal goods and
Empire Market co-creator Raheim Hamilton was sentenced to 40 years in prison for running a dark web marketplace linked to $430 million in illegal trades.
The case against Empire Market shows how a dark web marketplace can become a major criminal business, bringing together drug trafficking, stolen credentials, personal data and hacking tools.
“A Virginia man who co-created and operated “Empire Market”—a dark web marketplace that enabled users to anonymously buy and sell illegal goods and services—has been sentenced to 40 years in federal prison.” reads the press release published by DoJ. “RAHEIM HAMILTON co-owned and operated Empire Market from 2018 to 2020. “
On October 7, 2026, the U.S. Department of Justice announced that Raheim Hamilton, a 30-year-old man from Virginia who co-created and operated the marketplace, had been sentenced to 40 years in federal prison and fined $5 million. His case also highlights a point worth remembering: hiding behind cryptocurrency, encryption and the dark web doesn’t guarantee that law enforcement won’t identify the people running the operation.
Hamilton co-owned and operated Empire Market with Thomas Pavey between 2018 and 2020. In June 2024, two men, Thomas Pavey (aka “Dopenugget”) and Raheim Hamilton (aka “Sydney” and “Zero Angel”), were charged in federal court in Chicago for operating the dark web marketplace “Empire Market” from 2018 to 2020.
According to the indictment, the duo was previously involved in selling counterfeit U.S. currency on AlphaBay before starting Empire Market. The site handled more than four million transactions worth over $430 million, giving buyers and sellers a way to trade illegal goods and services anonymously. The marketplace offered controlled drugs, stolen or compromised account credentials, personal information, counterfeit currency and computer-hacking tools.
The dark web marketplace Empire Market featured multiple categories of illicit goods such as illegal drugs, counterfeit items, Software & Malware, and credit card numbers. The platform allowed its users to pay using Bitcoin (BTC), Monero (XMR), and Litecoin (LTC).
The dark web marketplace shut down in 2020, leaving users without time to withdraw funds from their escrow accounts. At the time, some users blamed a prolonged denial-of-service (DDoS) attack, while others suspected an exit scam.
The two operators used cryptocurrency to conceal the nature and identities involved in the illicit transactions and encouraged users to use “tumbling” services, which mix and exchange cryptocurrencies to obscure their origin and connection to the marketplace.
During the investigation, the feds seized $75 million worth of cryptocurrency at the time of the seizures, as well as cash and precious metals.
The DOJ’s account also shows how much attention the operators paid to the practical details of criminal activity. Vendors could receive ratings based on how well they concealed drugs in shipments. That feature suggests the marketplace didn’t just provide a place to trade illegal goods. It also gave users ways to assess how safely vendors operated.
In January, Hamilton pleaded guilty to U.S. drug conspiracy charges in Chicago.
“Hamilton agreed to forfeit certain ill-gotten proceeds, including, among things, approximately 1,230 bitcoin and 24.4 Ether, as well as three properties in Virginia.” continues the press release.
The judge’s sentence was imposed on Monday, and the $5 million fine adds a financial penalty to the lengthy prison term.
The case also involves Pavey, 41, of Ormond Beach, Florida, who pleaded guilty last year and admitted that he helped create and operate Empire Market. He agreed to forfeit about 1,584 bitcoin, two boxes containing 25-ounce gold bars, three cars and two properties in Florida, and he is due to be sentenced later this month.
The sentence was announced by federal prosecutors and investigators from the FBI, the U.S. Postal Inspection Service and Homeland Security Investigations.
Clop responds to ShinyHunters after its leak site takeover as the group demands an eight-figure payment, interest and a public apology in their escalating feud.
Clop responds to ShinyHunters after its leak site takeover as the group demands an eight-figure payment, interest and a public apology in their escalating feud.
The PNLD data breach has exposed contact information belonging to police officers, government partners, criminal justice professionals and customers after data from the Police National Legal Database (PNLD) was published on the dark web. The data breach at PNLD, identified on July 26, 2026, also affected some users of Ask the Police, raising concerns about targeted phishing attacks.
PNLD Data Breach Exposes Police and Contact Details
According to PNLD, the compromised data includes names, or
The PNLD data breach has exposed contact information belonging to police officers, government partners, criminal justice professionals and customers after data from the Police National Legal Database (PNLD) was published on the dark web. The data breach at PNLD, identified on July 26, 2026, also affected some users of Ask the Police, raising concerns about targeted phishing attacks.
PNLD Data Breach Exposes Police and Contact Details
According to PNLD, the compromised data includes names, organizations and work email addresses of police officers, police staff, criminal justice professionals, government partners and customers. The incident also exposed the names and email addresses of some individuals who had previously submitted questions through Ask the Police. UK government guidance warns that such information could enable attackers to craft more convincing phishing emails targeting named officers and affected individuals.In its official statement, PNLD said, "There is no evidence to suggest that passwords or other security credentials have been compromised." The organisation clarified that it provides legal information, products and services to UK police forces and criminal justice organisations. It also stressed that PNLD is not the Police National Computer or the Police National Database, is not a crime-recording system, and does not store confidential information relating to victims, witnesses or offenders.
PNLD Notifies Authorities and Affected Users
Following the PNLD data breach, the organization said it had contacted all affected organizations and provided additional guidance. Individuals impacted through Ask the Police have also received notification emails with further informationPNLD confirmed that it has informed the Information Commissioner's Office (ICO) and is working with the National Crime Agency (NCA) and specialist cybersecurity organizations as the investigation continues.Its statement noted: "We are continuing to investigate a data security incident affecting the Police National Legal Database (PNLD), which was identified on Sunday 26 July." It added that compromised information had been published on the dark web and reiterated that there is no evidence that passwords or other security credentials were accessed.Regarding Ask the Police, PNLD said the platform was affected because it is hosted on the same infrastructure, resulting in the publication of some users' names and email addresses.
Investigation Continues as Key Questions Remain
As of August 3, 2026, PNLD had not disclosed how many people were affected by the data breach at PNLD, when the intrusion began, how long unauthorized access lasted or the total volume of data obtained. Its public breach notice lists the categories of exposed information but does not include a victim count.PNLD's 2025-26 annual summary reported 108,429 police registrations and support for all 43 Home Office police forces. However, the organization emphasized that this figure represents its user base and should not be interpreted as the number of people affected by the breach.The organization's 2023-24 annual summary stated that PNLD uses Microsoft Power Platform technology. On August 3, 2026, The Hacker News reported that the breach notification page referenced assets hosted on Microsoft's content.powerapps.com domain. While this supports the platform connection, it does not indicate how the attackers accessed or extracted the compromised data.
EY confirmed the theft of client tax documents from its third-party support platform. ShinyHunters claims responsibility and is threatening to publish the data.
EY confirmed the theft of client tax documents from its third-party support platform. ShinyHunters claims responsibility and is threatening to publish the data.
The dark web is often misunderstood, but it plays an important role in both privacy technology and cybercrime activity. In this episode, Tom Eston speaks with cybersecurity researcher and educator John Hammond about what the dark web actually is and how it has evolved in recent years. The discussion covers underground marketplaces, ransomware leak sites, […]
The post The Dark Web Explained with John Hammond appeared first on Shared Security Podcast.
The post The Dark Web Explained with John Hamm
The dark web is often misunderstood, but it plays an important role in both privacy technology and cybercrime activity. In this episode, Tom Eston speaks with cybersecurity researcher and educator John Hammond about what the dark web actually is and how it has evolved in recent years. The discussion covers underground marketplaces, ransomware leak sites, […]
Tax season is also peak season for identity theft. Malwarebytes researchers spotted criminals trading stolen tax records on dark web forums.
The post Your tax forms sell for $20 on the dark web appeared first on Security Boulevard.
Google began offering "dark web reports" a while back, but the company has just announced the feature will be going away very soon. In an email to users of the service, Google says it will stop telling you about dark web data leaks in February. This probably won't negatively impact your security or privacy because, as Google points out in its latest email, there's really nothing you can do about the dark web.
The dark web reports launched in March 2023 as a perk for Google One subscribers. The r
Google began offering "dark web reports" a while back, but the company has just announced the feature will be going away very soon. In an email to users of the service, Google says it will stop telling you about dark web data leaks in February. This probably won't negatively impact your security or privacy because, as Google points out in its latest email, there's really nothing you can do about the dark web.
The dark web reports launched in March 2023 as a perk for Google One subscribers. The reports were expanded to general access in 2024. Now, barely a year later, Google has decided it doesn't see the value in this type of alert for users. Dark web reports provide a list of partially redacted user data retrieved from shadowy forums and sites where such information is bought and sold. However, that's all it is—a list.
The dark web consists of so-called hidden services hosted inside the Tor network. You need a special browser or connection tools in order to access Tor hidden services, and its largely anonymous nature has made it a favorite hangout for online criminals. If a company with your personal data has been hacked, that data probably lives somewhere on the dark web.
Entrar
