The digital crime factory: a Dark Web threat intelligence report

By Kike Gandia · Research · 7 min read

Some weeks, cybercrime slows down. This wasn't one of them. Using 0data.es, our QuantumSec analysts processed 1,662 real records from Dark Web environments, including ransomware leaks, extortion posts and infostealer packages traded as if they were digital commodities. What emerges is an unsettling landscape: an industrialized market where corporate access is worth less than a cup of coffee, and where offensive actors are born, mutate or merge every single day.

A complete X-ray of the global ecosystem of attacks, leaks and stolen credentials

- Period: Week 11/2025 (Oct 24 – Nov 13)

- Dataset: 1,662 records analyzed

- Source (0data.es): Dark Web Intelligence

Data analyzed and key metrics

+500

ransomware victims

+500

infostealer packages

+500

data breaches

+22

stealer ecosystems

What's inside this week's dataset.

162

criminal leads

58

countries affected

+48

active groups

23.8

attacks per day on average

Global epicenter. 40.4% of all attacks are concentrated in the United States, which cements its position as the global epicenter of cybercrime.

36.6%

of the criminal market is controlled by just 3 groups (Qilin, Akira and Clop)

70%

of ransomware attacks could have originated from leaked credentials

Global epicenter: where is the most hacking happening?

Geographic distribution of attacks

The first layer of intelligence comes from companies listed as victims of ransomware or extortion attacks between October 24 and November 13, 2025. The map leaves no doubt: the epicenter is still the United States, but the shockwave spreads across Europe, Asia and LATAM.

Analyzing the data provided by 0data.es, we can infer the following:

• The United States is a permanent target: High digitalization, extensive critical infrastructure and the highest potential financial return. The 40% concentration of attacks is no coincidence.
• Europe shows micro-outbreaks: Targeted attacks on specific industrial supply chains, educational institutions and local governments with limited security budgets.
• LATAM is emerging as a growing target: A marked increase in attacks on retail, manufacturing and law firms, especially in Argentina, Mexico and Brazil.
• Spain shows steady activity: More surgical attacks aimed at regional portals, the healthcare sector and mid-sized companies without dedicated security teams.
• The “Unknown” category accounts for 18.4%: Evidence of advanced obfuscation techniques and transnational operations that make geographic attribution difficult.

Persistent threats: ranking the criminal groups

Ransomware group activity

The 500 records analyzed show that not all groups behave the same way. Some run massive, automated campaigns, while others operate with surgical precision, selecting high-value targets.

Analyzing the data provided by 0data.es, we can infer the following:

• Qilin and Akira are today's superpowers: Stable infrastructure, a daily publishing cadence, a well-established logistics chain and a diversified base of affiliate operators.
• Clop is reshaping the criminal model: “Ransom without encryption” minimizes technical noise but maximizes reputational impact. They don't need to encrypt systems, just threaten to publish data.
• Ecosystem fragmentation: Incransom and Play reflect the atomization of the market: smaller groups with short life cycles but extremely aggressive.
• The RaaS (Ransomware as a Service) model dominates: The top 3 groups operate as platforms where independent affiliates carry out attacks in exchange for 70-80% commissions.
• Tactical evolution: Nightspire, Warlock and Sinobi prioritize long periods of silent exfiltration before extortion, increasing the value of the stolen data.

Time patterns: the week seen from the inside

Daily attack trend

The time-based analysis reveals surprising patterns in criminal activity. In cybercrime, not every day is the same.

71

attacks on the peak day (within the period analyzed)

23.8

attacks per day on average

5

attacks on the quietest day

Analyzing the data provided by 0data.es, we can infer the following patterns:

• Peak on the 27th: Possible coordination among multiple groups or exploitation of newly discovered zero-day vulnerabilities.
• Extreme variability: The gap between the most active day (71 attacks) and the quietest (5 attacks) points to planned operations rather than random activity.
• There are no “safe days”: Criminal activity is constant, with at least 5 attacks even on the quietest day of the period analyzed.
• Upward trend: Activity increases toward the end of the period, suggesting preparation for year-end campaigns.

Black market: the infostealer ecosystem

The gateway to cybercrime

The most worrying part is not the ransomware attacks themselves, but the industrial volume of stolen credentials, ready to be resold. Infostealers are the raw material of modern cybercrime: without them, there is no initial access. Without access, there is no ransomware.

Critical statistic

Critical statistic. 70% of all the ransomware attacks analyzed could have originated from credentials leaked in these ecosystems. The infostealer is the front door. Ransomware is the final hammer blow.

Top 10: infostealer ecosystems

What's inside these packages?

What the infostealer packages analyzed contain.

The modern cybercrime cycle

1. 3-6 hours — Phase 1 · The keylogger gets in
   Malware activates a keylogger on the compromised device.
2. 24-72 hours — Phase 2 · The package goes on sale
   A credential package shows up on Dark Web channels.
3. 1-5 days — Phase 3 · The access changes hands
   The access is resold to a ransomware operator.
4. 3-14 days — Phase 4 · The hammer
   The full attack is executed (encryption/exfiltration).

From the first keylogger to encryption: the modern cybercrime cycle.

The criminal market works like a perfectly orchestrated supply chain.

Correlation matrix: groups vs. geography

Criminal activity heat map

This cross-analysis reveals which groups are attacking which countries most often, exposing geopolitical patterns and operational preferences.

Analyzing the data provided by 0data.es, we can infer the following geopolitical patterns:

• Qilin dominates in the US: The most active group has a clear preference for American targets, probably because of their greater ability to pay.
• Geographic diversification: The top groups operate in multiple countries at once, evidence of decentralized infrastructure.
• Regional specialization: Some small groups show a specific geographic concentration, suggesting local knowledge or regional affiliates.
• The “Unknown” factor: The high correlation with unknown countries points to heavily obfuscated operations or transnational attacks.

Sectors under siege

Distribution by industry

Attackers look for sectors where downtime is critical → a higher likelihood that the ransom gets paid.

Analysis by vertical

Why these sectors

• Healthcare = life or death: Hospitals and clinics cannot afford downtime. Patients' lives depend on operational systems → maximum pressure to pay.
• Legal = attorney-client privilege: Law firms handle extremely sensitive information. A leak can destroy careers and legal cases.
• Technology = ironically vulnerable: Tech companies hold valuable data but often prioritize development over internal security.
• Manufacturing = supply chain: Disrupting production has cascading effects on customers and contracts.
• Finance = strict regulation: Financial data breaches bring massive fines and loss of licenses.

Global trends detected

• +22% increase in healthcare victims across multiple geographies (US, India, UK) ↗️
• Explosion of the “ransom without encryption” model, exemplified by Clop ☁️
• Rise of infostealer clouds in a “cloud-as-a-crime” format 🤫
• Quieter, longer-running attacks that prioritize exfiltration 🌎
• LATAM is growing as a target market (Argentina, Peru, Costa Rica) 🔄
• Fragmentation of the ecosystem, with more small but aggressive groups

Cybercrime in 2025 has evolved from opportunistic attacks into a highly specialized, segmented industry. We observe:

• Role specialization: Initial Access Brokers, Data Exfiltration Specialists, Ransomware Operators and Negotiators operate like corporate teams.
• Consolidated marketplaces: Platforms such as boxed.pw work like an “Amazon of crime”, complete with reviews, reputation and payment systems.
• Shorter attack times: What used to take weeks is now carried out in days thanks to automated tools.
• The price of access is in free fall: Corporate credentials sell for $10-50, democratizing cybercrime.

QuantumSec recommendations

️

For mid-sized and large companies

• Implement phishing-resistant MFA (FIDO2 / passkeys) on ALL access, no exceptions.
• Monitor for anomalous cookie replay events that indicate the use of stolen sessions.
• Avoid persistent sessions on critical SaaS - force re-authentication every 4-8 hours.
• Deploy EDR with anti-infostealer capabilities that detects keyloggers and credential exfiltration.
• Run an initial exposure audit - check whether corporate credentials are already for sale.
• Enforce strict network segmentation - limit lateral movement even with valid credentials.
• 3-2-1 backups with an air gap - the last line of defense when everything else fails.

For startups and SMBs

• Zero Trust from day one - don't assume the internal network is safe.
• Automatic monthly rotation policies for critical credentials.
• Browser log analysis on shared or personal endpoints.
• Ongoing anti-phishing training - the weakest link is still human.
• Centralized business password management (1Password, Bitwarden).

For public administrations

• Strict segmentation by sensitivity of data and services.
• Disable SMBv1 and Internet-exposed RDP.
• Detect data staging patterns that precede mass exfiltration.
• Quarterly security audits by independent third parties.
• A tested incident response plan, updated every six months.

Book a meeting with our team

“Cybercrime is no longer an attack; it's an economy”

This week's analysis reveals a hyperactive, industrial and perfectly organized ecosystem. Stolen credentials are no longer a by-product: they are the raw material that feeds the ransomware machine. Every package sold is a future attack incubating in the shadows.

For many organizations, the question is not whether they will show up in these listings… but when. Spotting it before your name gets posted is the job of threat intelligence.

0data will keep monitoring, correlating and alerting with reports of this depth.

Intelligence Report | Week 11/2025 Dataset analyzed: 500 ransomware victims | 500 infostealer packages | 500 data breaches | 162 criminal leads Period: October 24 – November 13, 2025 Sources: 0data.es - Dark Web Intelligence, Ransomware Leak Sites, Stealer Logs Markets

This report contains intelligence gathered from public Dark Web sources for research and cyber defense purposes.

This information is provided for educational purposes and to raise awareness of current threats.

Related service

Offensive security services

Topics

#War-Algorithms #Hybrid-Threats #Cybersecurity #Report #Intelligence #Quantumsec-Threat-Hunting

Keep reading

• Operation Guacamaya | Checkmate to the Dictator: The Perfect Move
• MCP: Blind Trust, Maximum Risk
• Honeypots and canary tokens: defending corporate networks against sophisticated adversaries
• Elite hunters: threat hunting as a strategic advantage
• Cleverium: Which Executives Really Get It Right When They Buy Their Own Shares

Book a call