In-depth analysis of dark web activity, ransomware trends, and cyber threat intelligence. Explore expert research, case studies, and insights that help you stay ahead of evolving threats.
DimasHxR ranks second among all threat actors tracked by DarkWebSonar in the last 90 days with 508 incidents — yet carries zero open-source footprint. Weekly telemetry shows a surge peak of 150 incidents in April 2026 followed by a 61% decline, revealing a campaign lifecycle that makes continuous monitoring essential.
Keymous+ is a DDoS-specialist hacktivist group with over 1,400 incidents tracked by DarkWebSonar, heavily targeting Morocco, France, India, Egypt, and Israel. Government, technology, and financial sectors bear the brunt of their Telegram-driven operations.
NoName057(16) is the most active threat actor tracked by DarkWebSonar, with 894 incidents in the last 90 days and 5,500+ total incidents. Their campaigns are heavily concentrated in Europe, making them a sustained, high-tempo disruption threat for European organizations.
MEDUSA has established itself as one of the most persistent ransomware groups of 2025, with 201 confirmed victim postings tracked by DarkWebSonar. With 61.7% of victims in the United States and strong targeting of construction, healthcare, and education sectors, MEDUSA represents a critical threat.
CL0P has re-emerged as one of the most dangerous ransomware groups of 2025, with a massive 1,028% surge in activity. With 480 incidents tracked by DarkWebSonar and a strategic focus on U.S. enterprises, CL0P represents a critical threat to organizations worldwide.
HEZI RASH has rapidly emerged as one of the most prolific hacktivist groups of 2025, with 856 incidents tracked by DarkWebSonar in just over three months. Dominated by DDoS attacks, the group targets 38 countries across government, media, and education sectors.
Sinobi ransomware resurged in October 2025 after a brief lull, recording 61 new incidents targeting U.S. construction, healthcare, and manufacturing sectors. DarkWebSonar data reveals its evolution from the Lynx codebase into a mature RaaS operation.
NOTCTBER404 surged onto the scene in late 2025, launching over 100 DDoS attacks primarily across Southeast Asia and forming an alliance with HEZI RASH. DarkWebSonar data reveals how fast this new hacktivist group is expanding.
Akira has surged to become one of the top ransomware groups of 2025, with over 570 incidents tracked by DarkWebSonar and a disproportionate focus on U.S. enterprises.
Get the latest cybersecurity insights, threat intelligence updates, and security best practices delivered directly to your inbox.
No spam, unsubscribe at any time.