Live Blog: Cyber Reflections on the Iran-Israel-U.S. War Read the Analysis
SOCRadar Blog

Dark Web

Latest SOCRadar research and analysis on Dark Web: threat reports, advisories and practical guidance for security teams.

Latest articles

Dark Web Profile: Andariel SOCRadar

Dark Web Profile: Andariel

Andariel operates as a North Korea–linked threat group under the Reconnaissance General Bureau (RGB). Security researchers widely assess it as a sub-cluster of the Lazarus Group. Since around 2009, Andariel…

Wendy’s Franchise Data Listing, WhatsApp Exploit, and Origin GPT Surface on Forums SOCRadar

Alleged Wendy’s Franchise Data Listing, WhatsApp Exploit, and Origin GPT Surface on Forums

SOCRadar’s Dark Web Team identified several new underground posts this week, including an alleged Wendy’s franchise database leak, a low-cost exploit listing targeting WhatsApp, and two AI-related services marketed for…

Dark Web Profile: Lotus Blossom SOCRadar

Dark Web Profile: Lotus Blossom

Lotus Blossom is a long-running cyber espionage Advanced Persistent Threat (APT) group active since at least 2009 and widely attributed to the People’s Republic of China (PRC). The threat group…

Dark Web Profile: Sinobi Ransomware SOCRadar

Dark Web Profile: Sinobi Ransomware

Sinobi Ransomware is a cybercrime operation that emerged in mid-2025, operating as a Ransomware-as-a-Service model. It is believed that the group is a rebrand or direct successor of the Lynx…

Alleged Discord Exploit Sale & WormGPT Database Leak Detected SOCRadar

Alleged Discord Exploit Sale & WormGPT Database Leak Detected

SOCRadar’s Dark Web Team identified several new underground posts this week, including an alleged Discord zero-day RCE exploit sale, a claimed source code leak of the NOXIPOM ULTIMATE ransomware tool,…

Dark Web Profile: The Gentlemen Ransomware SOCRadar

Dark Web Profile: The Gentlemen Ransomware

Despite its polished name, The Gentlemen Ransomware shows little interest in playing nice. First observed in 2025, the group quickly established itself as a capable and coordinated threat, operating across…

Alleged Suno Data, Card Dump, ASUS Records & Air France Access Sale SOCRadar

Alleged Suno Data, Card Dump, ASUS Records & Air France Access Sale

SOCRadar’s Dark Web Team identified several new underground listings this week, including an alleged database and source code sale linked to AI music platform Suno, a large aggregated credit card…

Dark Web Profile: 0APT Ransomware SOCRadar

Dark Web Profile: 0APT Ransomware

0APT, also recognized as the 0APT Syndicate, is a controversial Ransomware-as-a-Service operation that surfaced in late January 2026. The group rapidly gained notoriety by listing hundreds of high-profile victims on…

Never miss a critical advisory.

Join 30,000+ security professionals who read SOCRadar research every week.

See SOCRadar in Action