Access to your network may be offered for sale weeks before an intrusion. Your data may be listed before anyone inside knows it has left. This module watches the criminal ecosystem for mentions of your organisation, your people and your suppliers, and tells you what it means and what to do.
The criminal economy is specialised: some actors sell initial access, others buy it to deploy ransomware, others trade the data afterwards. Each stage leaves traces in forums, markets, messaging channels and leak sites. Reading them well requires language skills, access and context, which is why keyword alerts on their own produce noise.
Our analysts monitor these sources continuously, assess every relevant mention, track the actors behind it and deliver a clear early warning with recommended actions. When a finding indicates an intrusion in progress, our incident response team is activated directly.
Access is sold before ransomware is deployed. Data is listed before the victim knows. Insiders are recruited in the open. Each stage appears in forums, markets, channels and leak sites, if someone with access and context is reading.
Listings that offer access to your network, your cloud tenants or your data, assessed for credibility and matched against your environment.
Round-the-clock monitoring of extortion group sites for your organisation, subsidiaries, suppliers and customers, with alerts within hours of a listing.
Profiles of the groups active in your sector and region, their tradecraft, infrastructure, affiliates and current campaigns, updated as they evolve.
Channels and groups where logs, phishing kits, fraud campaigns and insider offers are distributed, including those that require sustained access.
Offers to buy insider cooperation, extortion attempts and threats against your organisation or your executives.
When data is published, rapid analysis of what it contains, whose it is and what obligations it triggers, in coordination with counsel.
Credentials, keys, configuration files and internal documents found in paste sites, code repositories and open storage.
A finding that indicates compromise in progress activates our 24/7 incident desk without a separate engagement.
Entities, brands, executives, suppliers, technologies and keywords agreed, with escalation paths for critical findings.
Continuous collection across forums, markets, channels and leak sites, with sustained access where it is required.
Analysts verify credibility, match findings to your environment and rate severity and urgency.
Early warning with recommended actions, incident activation where needed and follow-up until closure.
Clear, usable outputs for executives, technical teams, insurers and regulators.
Through documented methods that respect the law of the jurisdictions involved and our Code of Ethics. We do not buy stolen data, we do not pay criminals and we do not take actions that could compromise investigations.
You receive an assessment of what it is, how credible the listing is and what it means. If it indicates an intrusion, our incident response team is activated. If it is a breach at a third party, we help you quantify exposure and meet your obligations.
Yes. Leak-site and underground monitoring extends to the third parties you define, which is often where the first warning of a supply chain incident appears.
They are complementary. Credential exposure focuses on stolen logins and sessions with remediation. Underground monitoring covers access sales, data listings, actor activity and threats, with assessment and early warning.
Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.
Read article
Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.
Read article
In September 2025 a single supplier's passenger handling system went down and three of Europe's busiest airports fell back to pen and paper. A year on, September 2026 brought a state government leak, a hypervisor exploit in ransomware hands and a transport group knocked offline. The pattern holds.
Read articleWant to know whether your organisation is being discussed, sold or targeted in the underground? Ask for a scoping call.