Spacebears ransomware DLS caught mid debug crash on its onion portal. PHP 8.3.6, Laravel 10.43.0, Ignition exposed via SQLSTATE. Stack trace, filesystem paths, controller source, raw SQL queries and env vars visible. Code shows scripted view count inflation.

New group in town: WhiteArmor (W.A) DLS: hxxp://whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad[.]onion/ Session: 05e7d90e446b823946dc3dfd8210ce14835cad13b28edadc798b51c186a29f5f7b More analysis soon

New clearnet mirror of The Seven Deadly Sins DLS 193[.]24[.]123[.]177 AS200593 (Prospero OOO) Same build as 37[.]72[.]140[.]179 (AS211663)

RT @ransomnews: 📣 Truffe WhatsApp, la guida utile 🇮🇹 Leggiamo sempre più spesso di persone in difficoltà dopo messaggi truffa su #WhatsApp…

🚨 Update: the archive node of The Seven Deadly Sins, 37[.]77[.]150[.]177 /pay_or_leak/, is back online The open directory holds 4 more folders than the 7 victims shown on the Tor DLS board Attached: README

🚨 The Seven Deadly Sins DLS exposed its clearnet infra 2 hosts serve the same DLS index on port 80, different builds (23 Sep and 24 Sep) 37[.]72[.]140[.]179 AS211663 185[.]100[.]85[.]146 AS200651 sha256 aca2081b75647ee71f7257de8ed456e6fa23603c76087ff86c8930696e408439 Distinct SSH host keys Archive node 37[.]77[.]150[.]177:8080 /pay_or_leak/ AS198953 Now down Same Session ID posted on exploit[.]in on 20 Aug 2026 by whale_leads42 Session: 051b27343be2bafb389aee16bfb6526d1f09d2e487430eb0427336415bb408452d

While analyzing the HYFLOCK ransomware group, found that it has been active on underground forums since at least March 2026, well before its leak site was first observed. Forum activity Mar 2, 2026: account "hyflock" on Rehub forum claims its own Rust ransomware, self described student Same day asks about a libp2p P2P botnet Mar 29 and Apr 12: RaaS ads on t1eron3[.]vip May 29: RaaS ads in RU, EN and CHN on Duty Free forum Apr 2: technical article on encryption design for RaaS on Rehub forum Offer Rust locker, 80/20 split, CIS banned VSS deletion, Defender disabling, GPO and SYSVOL deployment Suspension of 27 cloud services, DDoS and call spam Planned: AI assisted C2 Infrastructure Affiliate panel, trial version linked in the May 29 ad, footer reads "2025 HYFLOCK": hxxp://e5hdifgit6ua7k4ggmltume7kbyryksdnlrkc55we33fnshgxfeqgsyd[.]onion Leak site: hxxp://yhgphvfgaecacgtlbn67u7yfhafe6evnj4gs4s2oyb3hzjnlhq45azqd[.]onion/blog Assessment: new brand, actor active since at least March

Noticed that Global Cybernetic Collective has relaunched a RaaS program Actor $€0 posted on T1erone: return to ransomware, affiliates welcome for full collaboration now, manual mode for the moment, automation to come Onion URLs listed: 1. hxxp://globalrbweyhxxa5b65bjjsm5bfuqfs5ydizefupqcminoedzn6o2sqd[.]onion 2. hxxp://globalco44t2yl6ltgj74cwthr6b6olggl3srg7engqfhx72f6ni3cyd[.]onion 3. hxxp://globaldonejcrwbe7ujwuzptsummx3rvba54wcjoxrjvqgo37y4aqwid[.]onion More analysis soon

New group in town: ScarlettGroup DLS: scarlettgugldabhgz3uertpnxglxytddxbd5vnoma5pihfk6k5q2sid[.]onion Session ID: 05866673bcba27e7713eec9bbf6ffe0d01895d522b321e8dda7056e4172115b32e More analysis soon

While analyzing a DarkForums post by V0idix, noticed the download link resolves to a known Chaos ransomware file server Root path of that onion returns 403, but victim-named subpaths expose open directory listings Found multiple active victim folders on the same storage beyond the one posted, populated over several weeks Open question: is V0idix reusing Chaos file server infrastructure independently, or is this Chaos itself posting under a different alias ?

🚨 New extortion group BYOD also exposes its backend on clearnet IP: 31[.]56[.]19[.]34:3000 Content on IP matches onion exactly, same three victim cards observed on both channels Served over plain HTTP, no TLS Hosting: Blatant Technologies LLC (RIPE whois, Seychelles) Geo (FOFA/Shodan consensus): Turkey, Bursa Hosting block is shared multi tenant infrastructure, unrelated domains and services observed in same /24, not attributed to the actor

🚨 new apt in town: ULOSE Infrastructure DLS: hxxp://egm34gsyx65wb6jyqds4esvkskl34barx4robuebjhqpc4dfeavg7fyd[.]onion Origin exposed in clear: 64[.]227[.]132[.]179 Hosting: DigitalOcean, AS14061, Bangalore Ports: 22 OpenSSH 9.9p1, 80 nginx 1.26.3, 123 ntpd, 5000 Express (default 404) SSH host key SHA256: ba664e257fecb1a3cee9e6f8dcd2b561d3c17967ec4906efed6d5f2473d8ca08 DarkForums account ULOSE UID 144316 Contacts Tox 1: 7FD474DA4CEE6D3B331AA5B0E04997FBE296435619920EAE2FCE4D176DB4F515B978E46FDA50 Tox 2 (also on forum): B6EA3F82D3957B07619753D5EF7E68C4C9E618756D9922B254D69353823DDF78C12135A564FE A68A5EDE5 SimpleX: # 2u6lxlRey515Z10Ee9vlE5J0q9luoXOGzd08t5vfoWU

CRPX0 has a public YouTube channel CRPX0RAAS (Channel ID: UCj5484WoLehR7iI7dFEzwew) 1 video: full end-to-end demo of the operation. payload generation, deployment, data exfiltration, encryption/decryption, C2 dashboard. Actively recruiting affiliates, 70% commission.

🚨 New group observed: "Vladivostok" (Владивосток) (?) Recruiting pentesters, researchers & insiders. Affiliate cut up to 60% (negotiable, value-based). No victims posted yet. dr5beljvyqljgq5ppro57pgetg4yeslcsexmuhvv3p46wod3odsh3fid[.]onion Updates to follow.

Cl0p DLS is back online. The onion service is reachable

Adding some additional data points collected on the same .onion (723pt5dc...v3hqd). The address has been reused for months under rotating branding. observed use: April 2026, sample with .dominus27 extension, Dementor/LockFile family. Same onion and contact emails resurface in August 2026 on Pastebin. About a month ago it was tracked as "Montage," and it now appears as "Regulus". Pattern consistent with a shared negotiation panel, reused by different operators/affiliates over time, rather than a single structured group.