New Extortion Gang Lists Companies on the Dark Web and Counts Down to Data Leaks

ScarlettGroup, a newly observed cyber extortion gang, is naming companies on a dark web leak site and using countdown timers to threaten the release of allegedly stolen data.

The operation applies public pressure to organizations before breach claims have been independently verified. The group first appeared in threat monitoring records around September 2026 and became more visible during October 2026.

Listings attributed to ScarlettGroup cover multiple sectors including technology, education, government, and entertainment. Available evidence does not indicate a clear industry focus or confirm the overall scale of the group’s activity.

Researchers from Foresiet documented ScarlettGroup’s activity in a report published on October 21, 2026. Foresiet’s threat intelligence frames ScarlettGroup as an emerging extortion operation rather than a confirmed malware family. The researchers have not determined how the attackers gain access to networks or whether they deploy ransomware that encrypts files.

A new extortion gang is naming companies on the dark web

ScarlettGroup’s Tor leak site lists alleged victims alongside publication dates, industry labels, disclosure status, and countdown timers. Those details convert an unverified claim of a breach into a visible deadline.

The apparent purpose is to push targeted organizations to initiate contact before the group publishes the information it claims to hold.

The tactic resembles the public-pressure approach seen in the alleged Everest breach of BMW, where a leak site countdown accompanied claims about stolen internal records. That comparison refers only to the pressure technique; it does not establish any connection between Everest and ScarlettGroup or verify either group’s claims.

Foresiet describes ScarlettGroup’s process as consisting of three stages: a public listing, a negotiation window, and either removal or disclosure. During the negotiation phase, an organization can communicate with the operators.

The group claims that a settlement results in the listing being removed and the data deleted, while failure to settle may lead to publication. These are criminal claims and are not independently guaranteed.

Foresiet cautions there is no independent assurance that information will be deleted after a settlement. A removed listing should not be interpreted as proof that copies no longer exist or that any possible unauthorized access to networks has ended.

What researchers have actually observed

Foresiet documented ScarlettGroup activity on PwnForums, including alleged breach announcements and data offerings. Reported links involving BreachForums and DarkForums remain unverified.

Forum posts can spread allegations beyond a single leak site, increasing public attention while also providing defenders with leads for further investigation.

The absence of confirmed encryption is notable. In a separate case involving the PAYLOAD group, attackers did not encrypt files but used Windows domain policies and stolen data to create pressure. ScarlettGroup’s publicly documented activity differs: the extortion threats are visible, but comparable technical details about intrusion methods have not been established.

The report does not identify an exploited vulnerability, malware samples, or a verified route into victim networks. It also does not provide a confirmed victim count.

Interpreting those gaps as evidence of a specific attack method would exceed the report’s findings and could mislead security teams investigating an alert.

Foresiet recommends validating criminal claims against independent evidence, preserving forensic artifacts, and monitoring for unusual downloads and data transfers. A company named on the site should investigate potential unauthorized access without treating the listing itself as confirmation of a breach.

Access controls remain central to prevention. Coverage of a separate operation known as Pink, which involved cloud credential theft, illustrates how extortion groups can target accounts and cloud files. Although that case is distinct from ScarlettGroup, it reinforces Foresiet’s advice to strengthen multi-factor authentication, limit account permissions, and review exposed credentials.

Organizations should also assess internet-facing systems and keep incident response procedures ready. Monitoring leak sites and underground discussions can help identify claims early, but useful intelligence requires context.

The priority is to determine what occurred, which information may be affected, and whether unauthorized activity is ongoing. At present, the clearest evidence relates to the gang’s public extortion process rather than to specific tools or intrusion techniques.

That distinction matters for defenders: a visible countdown may force urgent decisions, but it does not establish the origin, age, or ownership of the advertised records. Investigators need evidence from their own systems before assessing a claim’s scope, linking it to a broader incident, or planning a response. The deadline itself is not forensic evidence.

Indicators of compromise (IoCs)

Note: IP addresses and domains have been intentionally defanged (for example, [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from security operations centers.