Podcasts
How can you identify ransomware operators targeting you on the dark web?
How can you identify ransomware operators targeting you on the dark web?
In this Dark Web Explained video our Director of Threat Intelligence Jim Simpson outlines how ransomware groups use the dark web for multiple phases of the "kill chain", giving defenders an opportunity to spot what they're doing, and how.
Up Next
How do you identify cyberattacks against your supply chain?
A new approach to the perennial challenge of supply chain cybersecurity.
Related Content
The Dark Web Hub
8Base
8Base uses a variant of Phobos ransomware, modified to append a ".8base" extension. Researchers have also noted that 8Base's leak site bears similarities to the data extortion operation RansomHouse.
The Dark Web Hub
Akira
Akira appears to be a novel ransomware, written in C++, with versions targeted both at Windows machines and Linux operating systems. It has quickly become one of the most prolific ransomware groups.
The Dark Web Hub
BlackBasta
BlackBasta is a ransomware operation that is notable for its high volume of attacks, use of custom tools, and suspected links to cybercriminal group FIN7.
The Dark Web Hub
BlackCat [offline]
The RaaS group BlackCat (also known as ALPHV or Noberus) is believed to include developers and money launderers from the former DarkSide ransomware group, most infamous for the Colonial Pipeline attack.
The Dark Web Hub
Cl0p
Cl0p is notable for its approach of using vulnerabilities in supply chain software to target multiple organizations, announcing them in a batch at a later date.
The Dark Web Hub
LockBit
LockBit was the most active ransomware group by number of listed victims on its dark web leak site in 2022 and 2023. In February 2024 its leak site was seized in Operation Cronos.
The Dark Web Hub
Play
Play keeps a fairly low profile on the dark web aside from its leak site, not advertising via forum accounts and recently had to fend off accusations it had introduced a RaaS model.
The Dark Web Hub
Rhysida
Rhysida is noteworthy for its focus on organizations in the education industry, followed by those in health care equipment & services, and the public sector.
The Dark Web Hub
Royal [offline]
Royal initially used third-party ransomware including BlackCat and Zeon before developing its own malware, written in C++, which infects Windows systems.
The Dark Web Hub
Vice Society [offline]
Vice Society stopped posting victims to its dark web leak site in June 2023 and went offline in December. Some security analysts note similarities in the TTPs of Vice Society and those used by Rhysida.