ScarlettGroup names companies on a leak site with countdown timers
Original title: A New Extortion Gang Is Naming Companies on the Dark Web and Counting Down to Data Leaks
Foresiet has not confirmed access methods, file encryption, or a victim count, and published no indicators of compromise.
ScarlettGroup, seen in monitoring around September 2026 and more visible in October, lists alleged victims on a Tor leak site with industry labels and countdown timers. Foresiet’s October 21 report describes public listing, a negotiation window, and closure or disclosure, and treats it as extortion rather than a confirmed malware family. Listings span technology, education, government, and entertainment without a demonstrated single-industry focus. Activity on PwnForums is documented; reported links to BreachForums and DarkForums still need verification. No exploited vulnerability, payload, or verified intrusion path is identified.
Unconfirmed: Victim claims are unverified, and access method, encryption, victim count, and some forum links are not established.
- The group claims a settlement removes the listing and deletes the data.
- Foresiet says payment does not independently prove the data was deleted.
- Hashes, malware names, IP addresses, domains, and the Tor address were not published.
- A removed listing is not proof that copies or network access no longer exist.
Impact: Alleged stolen data threatened with public release
- 1.Check leak-site claims against independent evidence before treating a breach as confirmed.
- 2.Preserve forensic material and monitor unusual downloads and data transfers.
- 3.Strengthen multifactor authentication, limit permissions, and review exposed credentials.
- Threat actors
- ScarlettGroup
- Organizations
- Foresiet
From the original article
4 min read at cybersecuritynews.com
ScarlettGroup, a newly observed cyber extortion gang, is naming companies on a dark web leak site and using countdown timers to threaten the release of allegedly stolen data. The operation puts public pressure on organizations before their breach claims have been independently verified. The group began appearing in threat monitoring records around September 2026 and […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.