In-depth analysis of dark web activity, ransomware trends, and cyber threat intelligence. Explore expert research, case studies, and insights that help you stay ahead of evolving threats.
Nova ransomware has logged 129 victim postings across 45 countries since April 2025, with only 13% of victims in the United States. DarkWebSonar telemetry shows a May–June 2026 surge and a RaaS operation rebranded from RALord.
DimasHxR ranks second among all threat actors tracked by DarkWebSonar in the last 90 days with 508 incidents — yet carries zero open-source footprint. Weekly telemetry shows a surge peak of 150 incidents in April 2026 followed by a 61% decline, revealing a campaign lifecycle that makes continuous monitoring essential.
Keymous+ is a DDoS-specialist hacktivist group with over 1,400 incidents tracked by DarkWebSonar, heavily targeting Morocco, France, India, Egypt, and Israel. Government, technology, and financial sectors bear the brunt of their Telegram-driven operations.
NoName057(16) is the most active threat actor tracked by DarkWebSonar, with 894 incidents in the last 90 days and 5,500+ total incidents. Their campaigns are heavily concentrated in Europe, making them a sustained, high-tempo disruption threat for European organizations.
MEDUSA has established itself as one of the most persistent ransomware groups of 2025, with 201 confirmed victim postings tracked by DarkWebSonar. With 61.7% of victims in the United States and strong targeting of construction, healthcare, and education sectors, MEDUSA represents a critical threat.
CL0P remains one of the most dangerous ransomware groups tracked by DarkWebSonar, with 635 victim postings since October 2024 and a sustained January–February 2026 campaign wave. With 68.5% of victims in the United States and heavy targeting of manufacturing, technology, and retail, CL0P represents a critical threat to organizations worldwide.
HEZI RASH has rapidly emerged as one of the most prolific hacktivist groups of 2025, with 856 incidents tracked by DarkWebSonar in just over three months. Dominated by DDoS attacks, the group targets 38 countries across government, media, and education sectors.
Sinobi ransomware resurged in October 2025 after a brief lull, recording 61 new incidents targeting U.S. construction, healthcare, and manufacturing sectors. DarkWebSonar data reveals its evolution from the Lynx codebase into a mature RaaS operation.
NOTCTBER404 surged onto the scene in late 2025, launching over 100 DDoS attacks primarily across Southeast Asia and forming an alliance with HEZI RASH. DarkWebSonar data reveals how fast this new hacktivist group is expanding.
Get the latest cybersecurity insights, threat intelligence updates, and security best practices delivered directly to your inbox.