New extortion gang names companies on dark web, threatens data leaks

Key Takeaways

• A new cyber extortion collective, ScarlettGroup, has emerged on the dark web, publicly naming alleged victim companies.
• The group employs a pressure tactic involving countdown timers, threatening to leak stolen data if demands are not met.
• ScarlettGroup’s activities, first noted in September 2026, span various sectors including technology, education, government, and entertainment.
• Researchers have not yet identified the specific methods of initial access, malware used, or confirmed instances of data encryption.
• Organizations should prioritize independent forensic investigation of any claims rather than relying solely on the public listings.

A New Extortion Gang Is Naming Companies on the Dark Web

A new cyber extortion group identified as ScarlettGroup has surfaced, employing a high-pressure tactic by listing alleged victim companies on a dark web leak site. This emerging threat leverages countdown timers to publicly announce impending data leaks, aiming to coerce organizations into negotiations before their claims of compromise are independently verified. This strategy places immediate public scrutiny on targeted entities.

ScarlettGroup’s activities were first detected in threat monitoring records around September 2026, gaining more prominence throughout October. The group’s listed targets represent a broad spectrum of industries, including technology, education, government, and entertainment. However, current evidence does not indicate a specific industry focus or definitively confirm the full scale of its operations.

ScarlettGroup’s Extortion Methodology

Researchers from Foresiet’s threat intelligence research, detailed in a report published on October 21, 2026, describe ScarlettGroup as an evolving extortion operation. Importantly, this research does not confirm the use of a specific malware family or establish whether the attackers deploy ransomware for file encryption. The precise methods by which ScarlettGroup gains initial access to victim networks also remain unconfirmed.

The group’s Tor-based leak site prominently displays alleged victims, accompanied by publication dates, industry classifications, disclosure statuses, and critical countdown timers. These timers transform unverified breach allegations into explicit deadlines, intensifying pressure on affected organizations. The primary objective appears to be forcing targeted entities to engage in communication before the group releases the data it purports to possess.

This public pressure tactic mirrors approaches observed in other high-profile incidents, such as the alleged BMW breach attributed to the Everest group, where a similar leak site countdown accompanied claims of stolen internal records. It is crucial to note that while the tactics are comparable, this observation does not imply any connection between Everest and ScarlettGroup, nor does it independently validate either group’s claims of compromise.

ScarlettGroup outlines a three-stage process: public listing, a negotiation window, and then either closure or data disclosure. During the negotiation phase, organizations are reportedly able to communicate with the threat actors. The group claims that a successful settlement results in the removal of the listing and the deletion of the exfiltrated data. Conversely, failure to reach an agreement is stated to trigger the public release of the information.

However, these are merely assertions made by the criminals. Foresiet emphasizes that there is no independent assurance that data will be permanently deleted post-settlement. Therefore, the removal of a listing should not be interpreted as definitive proof that data copies no longer exist or that unauthorized network access has been fully remediated.

What Researchers Have Actually Observed

Foresiet’s investigation has documented ScarlettGroup’s presence and activity on PwnForums, including announcements of alleged breaches and offers of data. While there are reported links to BreachForums and DarkForums, these associations require further independent verification. The dissemination of such claims across multiple forums can amplify public attention and provide initial leads for defenders to investigate.

The absence of confirmed encryption in ScarlettGroup’s operations is a significant detail. This distinguishes it from traditional ransomware attacks. For instance, the PAYLOAD attack, which also lacked encryption, relied on manipulating Windows domain policies and leveraging stolen data to exert pressure. ScarlettGroup’s documented activities currently focus on public threats, with a lack of established technical details regarding its intrusion methods.

The Foresiet report does not specify any exploited vulnerabilities, identified malware payloads, or verified entry points into victim networks. Furthermore, it does not provide a confirmed count of actual victims. Interpreting these gaps as evidence of a particular attack method would be speculative and could misdirect security teams investigating potential alerts.

What You Should Do

• Independently Verify Claims: Do not treat a listing on a dark web leak site as definitive proof of a breach. Conduct a thorough forensic investigation of your own systems to confirm any unauthorized access.
• Preserve Evidence: If a listing appears, immediately initiate incident response protocols. Preserve all potential forensic material, including logs, network traffic, and system images.
• Monitor for Anomalies: Continuously monitor your network for unusual downloads, suspicious data transfers, and any unauthorized activity that aligns with the claimed breach.
• Strengthen Access Controls: Implement and enforce strong multi-factor authentication (MFA) across all accounts. Review and limit user account permissions to the principle of least privilege. Regularly audit and rotate exposed credentials.
• Assess External Systems: Conduct regular vulnerability assessments and penetration tests on all internet-facing systems to identify and remediate potential entry points.
• Develop Incident Response Plans: Ensure your incident response plan is up-to-date and regularly tested. This includes procedures for communication, containment, eradication, recovery, and post-incident analysis.
• Contextualize Threat Intelligence: While monitoring leak sites and underground forums can provide early warnings, always contextualize this intelligence with verifiable evidence from your own systems. The threat actor’s deadline is not forensic evidence; your internal investigation is.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.