A New Extortion Gang Is Naming Companies on the Dark Web and Counting Down to Data Leaks

ScarlettGroup, a newly observed cyber extortion gang, is naming companies on a dark web leak site and using countdown timers to threaten the release of allegedly stolen data.

The operation puts public pressure on organizations before their breach claims have been independently verified. The group began appearing in threat monitoring records around September 2026 and became more visible during October.

Its listings span technology, education, government, and entertainment, but available evidence does not show a clear focus on one industry or confirm the scale of its activity.

Researchers from Foresiet documented ScarlettGroup’s activity in a report published on October 21, 2026. Foresiet’s threat intelligence research describes an emerging extortion operation, not a confirmed malware family. The researchers have not established how the attackers gain access or whether they deploy ransomware that encrypts files.

A New Extortion Gang Is Naming Companies on the Dark Web

ScarlettGroup’s Tor leak site displays alleged victims alongside publication dates, industry labels, disclosure status, and countdown timers. These details turn an unverified breach claim into a visible deadline.

The aim appears to be pushing targeted organizations toward contact before the group releases the information it claims to hold.

The approach resembles pressure seen in Everest’s alleged BMW breach, where a leak site countdown accompanied claims about stolen internal records.

That comparison concerns the public pressure tactic only; it does not establish any connection between Everest and ScarlettGroup or prove either group’s claims.

ScarlettGroup describes a process with three stages: public listing, a negotiation window, and closure or disclosure. During negotiations, an organization can communicate with the operators.

The group claims a settlement leads to removal of the listing and deletion of the data, while failure to settle may trigger publication. Those promises remain claims made by criminals.

Foresiet notes there is no independent guarantee that information will be deleted after a settlement. A removed listing therefore should not be treated as proof that copies no longer exist or that any possible network access has ended.

What Researchers Have Actually Observed

Foresiet documented ScarlettGroup activity on PwnForums, including alleged breach announcements and data offerings. Reported links involving BreachForums and DarkForums still require verification.

Forum posts can spread allegations beyond a single leak site, increasing attention while also giving defenders leads for further checks.

The lack of confirmed encryption is important. In the separate PAYLOAD attack without encryption, attackers used Windows domain policies and stolen data to create pressure.

ScarlettGroup’s known activity is different: its public threats are documented, but comparable technical details about its intrusion methods have not been established.

The report does not identify an exploited vulnerability, a malware payload, or a verified route into victim networks. It also provides no confirmed victim count.

Treating those gaps as evidence of a particular attack method would go beyond the findings and could mislead security teams investigating an alert.

Foresiet recommends checking criminal claims against independent evidence, preserving forensic material, and monitoring unusual downloads and data transfers.

A company named on the site should investigate possible unauthorized access without presenting the listing itself as confirmation that a breach occurred.

Access controls remain central to prevention. Coverage of Pink’s cloud credential theft shows how another extortion operation targeted accounts and cloud files.

That case is separate from ScarlettGroup, but it underlines the value of Foresiet’s advice to strengthen multifactor authentication, limit account permissions, and review exposed credentials.

Organizations should also assess internet facing systems and keep incident response procedures ready. Monitoring leak sites and underground discussions can help identify claims early, but useful intelligence requires context.

The priority is to establish what happened, which information may be affected, and whether unauthorized activity is continuing. For now, the clearest evidence concerns the gang’s public extortion process, not its tools.

That distinction matters for defenders: a timer can force urgent decisions, but it cannot establish the origin, age, or ownership of the advertised records.

Investigators need evidence from their own systems before judging the claim’s scope or linking it to a wider security incident and planning a response. The deadline itself is not forensic evidence.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post A New Extortion Gang Is Naming Companies on the Dark Web and Counting Down to Data Leaks appeared first on Cyber Security News.