Dark Web Intelligence

Reddit remains one of the most valuable sources for OSINT, threat intelligence, and cyber investigations, but finding the right information often requires more than Reddit's native search. We've compiled a list of some of the best Reddit search tools to help security researchers, investigators, and analysts search posts, comments, users, and historical discussions more efficiently. Featured tools include: • Arctic Shift • Reddit Comment Search • PullPush • Redective • Better Reddit Search • OSINT.IO • Social Searcher • Reddit Insight Analyst Note: Since Reddit restricted access to the original Pushshift API, many legacy tools have become unreliable. Modern alternatives now provide the best capabilities for historical searches, user profiling, and OSINT investigations. Which Reddit search tool is your favorite, and which one should we add to our next list? #DDW #OSINT #Reddit #CyberSecurity

🚨 Doxbin Administrator “KT” Sentenced to Prison Callum Dare, a Doxbin administrator known online as “KT” and “Chans,” has been sentenced in Wales to two years and three months in prison for encouraging swatting attacks. * Dare encouraged and assisted swatting incidents targeting victims in the UK, U.S., and Canada. * He created and shared compilation videos of armed police responses to promote further attacks. * Investigators linked Doxbin activity to a PayPal account and email address that identified him. * Police also recovered phishing software designed to imitate dark-web marketplaces and steal credentials. Analyst Note: Swatting is not an online prank. False reports can trigger armed police deployments, place innocent people in immediate danger, and divert emergency resources from genuine incidents. This case also shows how small operational-security mistakes can expose administrators behind anonymous cybercrime platforms. #DDW #Intelligence #DarkWeb #Doxbin

🚨 EU and UK Launch First Joint Cyber Sanctions Against Russia The European Union and the United Kingdom have announced their first coordinated cyber sanctions package, targeting Russian intelligence officers, hackers, and organizations accused of years of cyberattacks and hybrid operations across Europe. * 🇪🇺 EU sanctioned 9 individuals and 4 entities. * 🇬🇧 UK sanctioned 24 individuals and organizations. * Targets include GRU officers, cyber operators, and infrastructure supporting Russian cyber operations. * Measures include asset freezes, travel bans, and financial restrictions. Analyst Note: This marks one of the strongest coordinated Western responses to state-sponsored cyber operations. Rather than focusing solely on malware campaigns, the sanctions target the broader ecosystem; including intelligence officers, cybercriminal proxies, and enabling organizations, signaling a continued shift toward imposing tangible costs on offensive cyber activity. #DDW #Intelligence #DarkWeb #Russia

🇫🇷 TotalEnergies Customer Database Allegedly Offered for Sale A threat actor has advertised the alleged sale of a TotalEnergies customer database on an underground forum, claiming the dataset contains approximately 20 million customer records. According to the forum post: * The database allegedly contains around 20 million customer records. * Claimed fields include names, phone numbers, addresses, postal codes, municipalities, customer categories, supplier identifiers, tariff plans, contracted power, and other account-related information. * The seller shared sample records purportedly linked to TotalEnergies France. * The dataset is being advertised for sale for €650. Analyst Note: These claims have not been independently verified. If authentic, the exposure could affect a significant number of TotalEnergies customers and increase the risk of phishing, identity fraud, and targeted social engineering. Organizations should validate the authenticity of the samples, investigate the source of the data, and notify affected parties if necessary. #DDW #Intelligence #DarkWeb #France

🇦🇷 Argentine Judiciary Data Allegedly Leaked by Threat Actor A threat actor claiming affiliation with Jama'at Al has posted what they describe as a leak of sensitive records from Argentina's judiciary system. According to the post, the exposed data allegedly includes: * Full names * Case and file numbers * Incident numbers * Document identifiers * Associated records * Account IDs and account creation dates * Jurisdiction information The threat actor claims the data originates from restricted judicial records and attributes the intrusion to one of its sub-groups. Analyst Note: These claims have not been independently verified. If authentic, the exposure of judicial records could present significant privacy, legal, and operational risks for affected individuals and government entities. Authorities should investigate the claims, assess the authenticity of the shared data, and determine whether any unauthorized access occurred. #DDW #Intelligence #DarkWeb #Argentina

Ransomware groups increasingly rebrand to evade tracking and enforcement A new analysis describes accelerating rebranding among ransomware and extortion groups, with operators changing names, infrastructure, payment methods, and business models while retaining operational continuity. The report cites overlaps among several ostensibly separate brands and notes 1,885 ransomware and extortion attacks during the previous three months. #DDW #Intelligence #ransomware #wsj

🇫🇷 Tech-in-Order Database Allegedly Leaked on Underground Forum A threat actor has published what they claim is the database of Tech-in-Order's management platform (mcs.tech-in-order.com), making the dataset available for download on an underground forum. According to the post: * The leaked database allegedly contains 1,376 user accounts. * A sample SQL dump was shared as proof of the claimed compromise. * The exposed data appears to include user account information and authentication-related records. * The full database is being distributed to forum members. Analyst Note: These claims have not been independently verified. Organizations using the affected platform should investigate the authenticity of the leaked data, review authentication logs for suspicious activity, rotate credentials if necessary, and monitor for any signs of unauthorized access. #DDW #Intelligence #DarkWeb #CyberSecurity

🇻🇪 Venezuelan Maritime Authority Allegedly Breached, 127K+ Records Claimed A threat actor has published a post claiming to have compromised Venezuela's National Institute of Aquatic Spaces (INEA), alleging the theft of sensitive government and maritime sector data. According to the post: * 114,265 mariner records were allegedly obtained, including personal information and photographs. * 13,485 maritime company records were also reportedly compromised. * The actor claims the dataset includes legal documents, company information, and employee records. * Proof-of-concept (PoC) samples were shared on the underground forum to support the claim. Analyst Note: These claims have not been independently verified. If confirmed, the exposure could impact both individual mariners and organizations operating within Venezuela's maritime sector. Government agencies and affected organizations should investigate the claims, validate the authenticity of the shared samples, and monitor for potential misuse of the exposed data. #DDW #Intelligence #DarkWeb #Venezuela

🇫🇷 France Pare-Brise Claims New Leak Surface on Underground Forum A threat actor has published a new post claiming to have compromised France Pare-Brise through an alleged IDOR (Insecure Direct Object Reference) vulnerability. According to the forum post: * The actor claims to have scraped data from more than 100,000 users. * Around 5,000 complete user files were allegedly leaked as proof of compromise. * The post attributes the exposure to an IDOR vulnerability affecting customer records. * The actor claims the leaked files contain complete user documents related to the alleged breach. Analyst Note: These claims remain unverified at this time. However, if confirmed, an IDOR vulnerability could allow unauthorized access to sensitive customer information without requiring traditional authentication bypasses. Organizations should investigate any reports promptly, review access controls, and monitor for signs of exploitation. #DDW #Intelligence #DarkWeb #France

🇺🇸 MC Hypermine Database Resurfaces on Underground Forum A threat actor has reposted the MC Hypermine database, a breach originally linked to the U.S.-based Minecraft server MC Hypermine. According to the forum post: * The dataset allegedly contains approximately 269,500 user records. * Exposed data reportedly includes usernames, SHA-1 password hashes, and IP addresses. * The breach is stated to have originally occurred in June 2020. * The actor is redistributing the dataset on an underground forum, making historical compromised data accessible once again. Analyst Note: While this appears to be a re-release of an older breach rather than a new incident, recycled databases remain valuable to threat actors for credential stuffing, password-cracking campaigns, and victim profiling. Users who may have reused passwords from older accounts should ensure those credentials have been changed and that MFA is enabled wherever possible. #DDW #Intelligence #DarkWeb #USA

🇧🇪 Betrail.run Allegedly Suffers Data Exposure Affecting 2.8 Million Runner Records A threat actor has published what they claim is a partial database from Betrail.run, a Belgium-based platform used by trail running enthusiasts to discover races, track results, and monitor performance. According to the forum post: * The leaked dataset allegedly contains approximately 2.8 million runner records. * The actor claims the "runners.jsonl" file contains publicly available runner information, while additional files were obtained by exploiting vulnerabilities. * The dataset is said to primarily include records from France, Belgium, Spain, the United States, Italy, Switzerland, Germany, the Netherlands, Australia, Canada, and the United Kingdom. * No technical evidence has yet been released to independently verify the alleged vulnerability or the authenticity of the non-public data. Analyst Note: At this stage, these claims remain unverified. Organizations should wait for official confirmation while monitoring for any security advisories or disclosure from Betrail.run. If confirmed, users should be alert for phishing attempts and consider updating credentials if reused across multiple services. #DDW #Intelligence #DarkWeb #Belgium

🪖 Alleged "NATO TOP SECRET" Documents Offered for Sale on Underground Forum A threat actor is advertising what they claim are classified NATO strategic documents dated 2025–2026. According to the marketplace listing, the package allegedly contains documents related to: * The 2026 NATO Summit in Ankara * Eastern Flank strategy and force posture * Intelligence collection and covert rotation concepts * OPLAN 41026 "Enhanced Deterrence East" * Supply chain and fuel logistics vulnerabilities * Nuclear weapon transportation doctrine * SHAPE C4ISR architecture * Allied Joint Force Command planning * Multinational submarine and anti-submarine exercise manuals The seller labels the material as "NATO TOP SECRET" and is offering the collection for sale for approximately $2,500. Analyst Note: There is currently no evidence that these documents are authentic or classified. Underground forums frequently advertise fabricated, outdated, publicly available, or recycled military documents to attract buyers. Any claims regarding classified NATO material should be treated with caution until independently verified. #DDW #Intelligence #DarkWeb #NATO