Skip to content
NewCybercrime Report 2026 · Eight Chapters · A Post Is Not An Incident → Explore The ChaptersCybercrime Report 2026 → Explore
Brandefense research · 1 January–27 October 2026

Cybercrime Report 2026.

Eight chapters read what Brandefense Blackhole, our cybercrime database, collected this year. They cover ransomware leak-site claims, fraud services, data leaks, stolen accounts, infostealers, initial access, exploit and tool offers, and hacktivist DDoS claims.

Each chapter counts a different unit. Each one also says what that unit cannot show.

8 chapters · Research edition 1.0 (Ransomware chapter v1.3) Collected posts, not market totalsAdvertised terms, not tested services Method & disclosure →
ONE RULE ACROSS ALL EIGHT A post is not an incident. BLACKHOLE 1 JAN– 27 OCT 2026 8 CHAPTERS 01 RANSOMWARE UNIT · GROUPS · 8+ MONTHS OF CLAIMS 33 of 177 02 FRAUD UNIT · RETAINED ACCOUNT POSTS 831 of 2,448 03 DATA BREACH & LEAKS UNIT · POSTS SAYING "DATA BREACH" 63% 04 STOLEN ACCOUNTS & COMBOLISTS UNIT · HAND-READ BOTNET LOG POSTS 6.3% 05 INFOSTEALERS UNIT · RAW "STEALER" KEYWORD POSTS 97.5% 06 INITIAL ACCESS OFFERS UNIT · SAMPLED LABEL POSTS 38.2% → 4.9% 07 EXPLOITS, TOOLING & AI UNIT · 0-DAY SELLER POSTS 37 of 93 08 HACKTIVISM & DDOS UNIT · CLAIM EVENTS 578 ONE RULE ACROSS ALL EIGHT A post is not an incident. 01 RANSOMWARE GROUPS · 8+ MONTHS OF CLAIMS 33 of 177 02 FRAUD RETAINED ACCOUNT POSTS 831 of 2,448 03 DATA BREACH & LEAKS POSTS SAYING "DATA BREACH" 63% 04 STOLEN ACCOUNTS & COMBOLISTS HAND-READ BOTNET LOG POSTS 6.3% 05 INFOSTEALERS RAW "STEALER" KEYWORD POSTS 97.5% 06 INITIAL ACCESS OFFERS SAMPLED LABEL POSTS 38.2% → 4.9% 07 EXPLOITS, TOOLING & AI 0-DAY SELLER POSTS 37 of 93 08 HACKTIVISM & DDOS CLAIM EVENTS 578
A claim is not a confirmed breach, an ad is not a sale, and a keyword count can be one bot. Every number here names its unit. Read the shared limits
01Choose your starting point

Find Your Reading Route

02The chapters

Read the Chapters. Follow the Evidence.

The chapters examine how advertised work is packaged: who supplies access, who operates the service and what an asking price includes. They also trace how relays, labels and copied offers can change its apparent scale. Choose a chapter for the findings, source evidence and limits.

9,203 group–victim leak-site claims from 177 groups
+Definition & caveat
Definition – Ransomware

Canonical group–victim claims: the first UTC appearance of each normalized group–victim pair in collected relay posts, 1 January–27 October 2026. Group aliases are merged before de-duplication and 0APT is excluded.

Caveat – Ransomware

A claim is not a confirmed breach. July 22–28 is sampled and October ends on the 27th. Prices and service terms remain advertised claims.

The persistent core One square = one group. Coral = claims in eight or more months.
831 of 2,448 retained financial-account posts match one narrow recruitment signature (33.9%)
+Definition & caveat
Definition – Fraud

Retained financial-account records whose text matches a narrowly defined cash-withdrawal recruitment signature, recorded under 132 source names, 1 January–27 October 2026. All 831 complete texts differ; three recruitment phrases recur in every one.

Caveat – Fraud

The volume of the message is measurable; the number of people behind it is not. Source names describe placements, not people. Observed records, not market totals or verified transactions.

Retained financial-account posts One square ≈ 1% of 2,448 retained financial-account posts. Coral = the 831 posts with one narrow recruitment signature (33.9%).
Chapter 03 · Data Breach & Leaks

Data Breach & Leaks

63% of Blackhole-collected posts that mention "data breach" are news retellings, not leak posts
+Definition & caveat
Definition – Data Breach & Leaks

Share of the ~9,400 posts matching the whole-word keyword "data breach" (47 of 48 weekly windows fetched in full) that fixed rules classify as news retelling (64%). We corrected that rule share for errors measured against 70 posts labelled by an AI reader working separately from the rules, giving 63% with a 95% range of 55–69%.

Roughly one in five (16–29%) shares, sells or relays data first-hand.

Caveat – Data Breach & Leaks

Counts are collected posts, mostly Telegram, not incidents or victims. One news aggregator channel carries 36% of the pool (without it news is still the largest type by rule, 44%). Calibrating on all 260 labels instead gives 49–61%.

Period-level only: forum post dates are partly day/month swapped, so no monthly trend is claimed.

Posts that say "data breach" One square = 1% of about 9,400 posts. Coral = news retellings, not leak posts.
Chapter 04 · Stolen Accounts & Combolists

Stolen Accounts, Botnet Logs and Combolists

6.3% of hand-read Botnet Log posts are strict stealer-log clouds (weighted estimate)
+Definition & caveat
Definition – Stolen Accounts & Combolists

160 kept (cleaned) Blackhole posts carrying the Botnet Log class label, 1 Jan-27 Oct 2026, drawn with stratum weights (set x quarter). We labelled them from full text, blind to our classifier. Strict stealer-log clouds are priced or joinable feeds and log packs said to come from infected machines.

Weighted estimate: 6.3% (95% interval 2.6-10.4); 7.4% with unpriced promotions. Unweighted, 9 of the 160 posts (5.6%). The same sample holds bank-account listings and requests 23.8% (17.1-31.1), game-account lots 21.3% (15.1-28.0) and buy-side rate sheets 17.0% (11.1-23.0).

Caveat – Stolen Accounts & Combolists

Shares of kept posts, not sellers, sales or exposure: one cloud post can front far more credentials than one game lot. The interval covers hand-sample error only; labels are from one AI labeller cross-checked by a second AI reader (94% agreement, kappa 0.90), not a human audit. Telegram-dominated collection; class labels changed May-July, so no trend is drawn.

Hand-read Botnet Log posts One square ≈ 1% (weighted, 160 posts read). Coral = strict stealer-log clouds; the rest are other post types.
Chapter 05 · Infostealers

Infostealers

97.5% of January-April raw "stealer" keyword posts carried one brand's notification template
+Definition & caveat
Definition – Infostealers

The word "stealer" appeared in 303,314 Blackhole posts dated 1 January to 30 April 2026 (exact totals over query windows of seven days or less). 295,819 of them (97.5%) carried one brand's constant notification-template label, posted about 2,700 times a day until it stopped on 25 April.

A raw keyword count here measures a bot's posting schedule, not infections, offers or market size.

Caveat – Infostealers

Telegram-dominated collected posts; a notification is a seller/bot claim, not a verified infection, victim or sale. The feed's brand, label and channels are not published.

Raw "stealer" posts, Jan–Apr One square ≈ 1% of 303,314 posts. Coral = 295,819 posts from one brand's notification template.
Chapter 06 · Initial Access Offers

Initial Access Offers

38.2% → 4.9% Share of posts under Blackhole's "Initial Access Selling" label that were access offers: 1 Jan–31 Aug vs 12 Sep–27 Oct 2026
+Definition & caveat
Definition – Initial Access Offers

Seeded, stratified random sample of posts carrying the classifier label (n=150 Jan–Aug, n=180 after 12 Sep). Each post was coded in full by an AI coder against a written codebook; shares are population-weighted with Wilson 95% intervals (28.1–49.5% and 2.0–11.4%). A blind second AI pass agreed on offer vs not-offer in 89 of 90 posts.

Caveat – Initial Access Offers

Blackhole-collected, Telegram-dominated posts; a post is not an access, a sale or a victim. Jan–Aug pools both sides of the May–July classifier taxonomy break, so this is a level comparison, not a trend.

Access offers under the label Share of sampled posts under Blackhole's "Initial Access Selling" label that were access offers.
37 of 93 exploit seller posts using the word 0-day that were coded as unnamed-exploit claims
+Definition & caveat
Definition – Exploits, Tooling & AI

182 exploit seller posts (193 minus 11 off-topic) in a stratified sample of 700 classified Blackhole posts, 1 Jan-27 Oct 2026. Of these, 93 use 0-day or zero-day in any form, and none gives a CVE. Only 37 were coded as unnamed-exploit claims, a broad code that also covers research services, multi-exploit lists and chains.

The rest are menus and other goods (25), mass tools (12), unlicensed/shared-tool bundles (8), feeds (5), kits (3) and 3 other items.

Caveat – Exploits, Tooling & AI

A 0-day may have no public CVE yet and sellers may omit identifiers, so a missing CVE alone does not show a claim is false. Sample post IDs, not offers or sellers; Telegram supplies 63% and forums 33% of this sample; closed forums, brokers and Tor are barely collected. Not a market measure.

Seller posts that say 0-day One square = one post. Coral = 37 coded as unnamed-exploit claims (not always one flaw); for the rest, the word is sales vocabulary on tools, bundles and menus.
Chapter 08 · Hacktivism & DDoS

Hacktivism & DDoS

578 distinct NoName057(16) DDoS claim events (1 Jan–27 Oct 2026), carrying 2,920 claimed target entries
+Definition & caveat
Definition – Hacktivism & DDoS

A claim event is one claim by one group against one set of targets on one day, after exact and near-duplicate posts are merged across channels and languages. Claimed target entries are the sites listed inside those claims. Both are counts of Blackhole-collected, Telegram-dominated posts, not confirmed attacks, outages or victims.

Caveat – Hacktivism & DDoS

Claimed, not verified. The group annotates about three in ten of its own listed entries (851 of 2,883 parsed entries, 29.5%) as geo-blocked, dead-by-ping or behind a placeholder page. Outage wording appears in the header of only 77 of 578 events (13%).

We did not open the third-party check reports or hold any availability data.

NoName057(16), 1 Jan–27 Oct Merged across channels and languages. Claims, not confirmed outages.
03Cybercrime Report 2026 / Cross-chapter analysis

How Cybercrime Works

Who provides the service, who divides the work and who may pass access onward? Four selected offers reveal different advertised roles, permissions and dependencies.

Explore the work and control analysis ↗
Four relationships in the offers

Four selected offers across three catalogues. Advertised arrangements, not verified transactions or a reconstructed criminal network.

04Key findings

What The Chapters Found.

One finding from each chapter. Read them as statements about collected posts in their own unit, not as a ranking of threats.

  1. 01
    Ransomware →

    64.7% of claims (5,950 of 9,203) came from just 33 of 177 groups, each with claims in eight or more months.

  2. 02
    Fraud →

    One dashboard ad included templates in a seven-day subscription and billed messaging separately by segment. The advertised panel was only part of the offer.

  3. 03
    Data Breach & Leaks →

    Automated leak-monitor cards tagged "Data leak" re-post forum thread titles. Of 200 cards read by an AI reader, 0 had an organisation's own database as the topic (upper bound 1.9%). Service/SEO adverts, chat and combolists dominated.

  4. 04
    Stolen Accounts & Combolists →

    Under the Botnet Log label, bank-account listings and requests (23.8%), game-account lots (21.3%, moderate confidence) and buy-side rate sheets (17.0%) each outnumber strict stealer-log clouds (6.3%) in 160 hand-read posts. All are weighted estimates.

  5. 05
    Infostealers →

    Of 393 offer-like posts in the candidate set, 182 carried an amount and 150 (82%) priced a time period or licence term rather than the thing itself. Time-limited access dominates the two largest roles, log clouds and stealer licences; only a minority price per log, per install, per request quota or per terabyte.

  6. 06
    Initial Access Offers →

    A label count is not a threat level. Posts labelled as access sales stepped up 4.3x on 12 September 2026, while de-duplicated offer posts per day did not change detectably.

  7. 07
    Exploits, Tooling & AI →

    Among 193 seller posts (the base for object and price counts), 56 sell a mass-exploitation tool or the web shells it produces. Another 47 are coded exploit-claim posts (unnamed-exploit, CVE-named or public-PoC codes). Web software is the largest stated target class (95 of 221 records, 43.0%); 71 name no target.

  8. 08
    Hacktivism & DDoS →

    A hacktivist DDoS claim post is a campaign notice. It has a political header tied to a news trigger in 216 of 578 events (37%), about five listed sites (median 5), and an outside reachability-check link for most entries. It records a claim, not an outage.

05Shared limits

Limits Every Chapter Shares.

These boundaries apply across the report. Each chapter adds its own, listed beside its headline measure.

Shared by all 8 chapters
The unit

Posts, not events.

Counts are posts, distinct texts, claims or coded samples from the Brandefense Blackhole collection. They are not incidents, victims, sellers, buyers or transactions.

The source

One collection, not the whole underground.

The six newer chapters draw on a mostly Telegram-based collection. Closed forums, brokers and Tor sites are barely covered, so no chapter states a market total.

The timeline

No trend across the label change.

Where a chapter counts posts by classifier label, counts are not compared across the May–July 2026 label change. October ends on the 27th.

The price

Advertised, not market prices.

Prices and terms are what posts advertise, in their own unit and currency, and are never averaged across units. Nothing was bought, run or tested.

The reader

AI labels, AI checks.

Posts were read and labelled by AI agents. Where a second pass exists, it was also AI, so agreement shows consistency, not accuracy.

The sign-off

Approved by Brandefense analysts.

Claude Opus 5.5 prepared each chapter, Codex Astra checked its numbers against the chapter's data files, and Brandefense analysts approved the findings.

06 / Method & disclosure

Read The Unit Before The Number.

Brandefense Blackhole · 1 January–27 October 2026, by post time. Each chapter publishes its own method and reuse terms; the six newer chapters add an evidence catalogue.

Each kind of activity leaves a different trace. Ransomware groups post claims, fraud and access sellers post ads, and hacktivists post campaign notices.

A single unit would hide those differences, so each chapter defines its own and states it next to every number.

08The reports

Eight Reports. Free To Read.

Each chapter has its own report as an accessible web edition. The full-year PDF edition follows in early 2027.

Ransomware Ransomware Leak-Site Claims Accessible edition · 1 Jan–27 Oct 2026
Fraud Inside the Fraud Service Economy Accessible edition · 1 Jan–27 Oct 2026
Data Breach & Leaks Data Breach & Leaks: The Report Accessible edition · 1 Jan–27 Oct 2026
Stolen Accounts & Combolists Stolen Accounts, Botnet Logs and Combolists Accessible edition · 1 Jan–27 Oct 2026
Infostealers Infostealers: The Report Accessible edition · 1 Jan–27 Oct 2026
Initial Access Offers Initial Access Offers: The Report Accessible edition · 1 Jan–27 Oct 2026
Exploits, Tooling & AI Exploits, Malware Tooling and AI-Assisted Crime Accessible edition · 1 Jan–27 Oct 2026
Hacktivism & DDoS Hacktivism & DDoS: The Report Accessible edition · 1 Jan–27 Oct 2026

30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.

09Cybercrime Report 2026 / For your team

What This Means for Your Team

Explore a finding from the report, see the employee reminder it informs and take the poster back to your team.

Pause Before You Approve poster, with a pause symbol and a reminder to verify unexpected requests.
Fraud

Pause Before You Approve

In the report

One offer advertised a hosted phishing dashboard with a template library and separately billed messaging.

For your team

When a request is unusual, confirm it using a contact method you already know.

A Familiar Name Is Not Proof poster, with a question mark and a reminder to verify unusual requests.
Data Breach & Leaks / Fraud

A Familiar Name Is Not Proof

In the report

Claimed field lists included names and email addresses. A separate offer listed identity-document and selfie options.

For your team

A familiar detail does not settle an unusual request. Verify it through contact details you already know.

Your Account Is More Than a Password poster, with a plus symbol and a reminder to report unexpected account changes.
Stolen Accounts & Combolists

Your Account Is More Than a Password

In the report

A buy-side rate sheet requested account names, passwords, and cookies or a two-factor authentication secret.

For your team

Report unexpected sign-ins or account changes through your organization's approved channel.

Offers and claimed fields describe what posts said, not verified records or working services. The employee reminders follow NIST guidance; this study did not test their effectiveness.

Free exposure check

Check Your Domain.

Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.

Request a demo