Daily Dose of Dark Web Informer - January 28th, 2026

🌐

DARK WEB INFORMER

⚡ Daily Threat Intelligence Digest

🔑 API Access Now Available

High-volume threat intelligence, ransomware data, IOC exports, and comprehensive feed access for security teams and researchers.

🔥 Advertising Opportunities

Reach a highly engaged audience of 42,400+ unique users monthly and growing. View details

📅 Last 30 days (as of Dec 30, 2025). Next update on Jan 31st.

💚

Your contributions help continue monitoring threats and keeping the community informed.

Click address to copy • ETH address accepts USDT, USDC, and other ERC-20 tokens

📌 Legend

📰 Law Enforcement – LEA updates, investigations

⚠️ Dark Web Notices – forums, markets, announcements

❗️ Urgent Threats – breaches, ransomware, vulnerabilities

💡 Insights & Tools – guides, OSINT, learning resources

Website Posts

❗️ CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability FREE

📰 Slovakian National Pleads Guilty to Operating Darknet Marketplace FREE

📰 Empire Market Co-Creator Pleads Guilty to Federal Drug Conspiracy Charge FREE

💡 Threat Feed 2.0 - What's New FREE

💡 Brakeman: Static Analysis Security Scanner for Ruby on Rails Applications FREE

❗️ CVE-2025-52691: SmarterMail Authentication Bypass and RCE PoC FREE

💡 Ransomware Attack Update - January 28th, 2026 FREE

💡 Threat Attack Update - January 28th, 2026 FREE

X/Twitter Updates

‼️ BREAKING: Cybercrime Forum http://ramp4u.io has been seized by law enforcement

📰 A 33-year-old Slovakian man has admitted to his role in running Kingdom Market, a darknet marketplace that facilitated the sale of narcotics and stolen personal data.

❗️ Stallman the owner of Ramp had this to say about the seizure.

❗️ Sorb claims to sell 897K Cuban student records from Ministry of Higher Education including ID cards, political affiliation, military details, and parents' information

📰 A 30-year-old Virginia man who helped create and run Empire Market, one of the largest dark web marketplaces of its era, pleaded guilty Monday to federal drug conspiracy charges in Chicago.

‼️ New Ransomware Group Identified: 0APT

‼️ 🇺🇸 Threat actor leaks Resist[.]Mobi I.C.E. protest website database exposing 3,700 users including emails, names, social media usernames, locations, and I.C.E. reports

‼️ 🇨🇦 Threat actor leaks TechJobs[.]ca data exposing 56K company records and 5K job applicants including names, emails, phone numbers, addresses, and resumes

⚠️ The main Dread mirror is back up and running.

‼️ 🇺🇸 Threat actor leaks FirstEditing[.]com data set including source code and SQL files

‼️ Threat actor releases fully parsed 2019 Facebook data set containing 502 million+ records across 100+ countries including phone numbers, names, gender, location, emails, and profile URLs

‼️ 🇺🇸 Threat actor leaks RemoteCOM US law enforcement spyware data including 821 agencies, 26K alerts, 133K cases, 26K clients, 26K NR history records, 6.8K officers, 88 employees, training videos, and PDF manuals

‼️ 🇬🇧 Threat actor claims to sell 50K Binance UK leads including first names, last names, and email addresses

💡 Lol no way.

📰 The U.S. Marshals Service has confirmed it is investigating a potential compromise of government digital-asset accounts by John (Lick), according to Bloomberg News, which cited an email from the agency. The incident was initially uncovered by blockchain investigator @zachxbt .

‼️ Bumble Inc has been claimed a victim to ShinyHunters

📰 The acting head of CISA uploaded sensitive internal documents to the public version of ChatGPT.

‼️ 🇩🇿 Tahkout Group has been claimed a victim to TENGU Ransomware

💡 Leaking the phone number of any Google user ($5k bounty)

💡 I created a donations page, but you are obviously not obligated to donate.