Illicit Networks

the illicit networks category in flare aggregates data collected from dark web marketplaces, underground forums, ransomware extortion sites, encrypted messaging channels, and infostealer ecosystems together, these sources give you structured visibility into threat actor behavior, data exposure, and active extortion operations before they escalate ransom leaks ransomware groups regularly publish victim data on dedicated extortion sites to pressure organizations into paying a ransom publication typically follows a failed negotiation, meaning the data is already public when an event fires this event category covers key scenarios such as direct targeting of your organization, breaches at third party suppliers, and broader supply chain exposure learn more about ransom leaks docid\ v1dmpdzafwhy4ghp99ca0 types of ransom leak events there are two types of ransom leak events blog posts and file listings blog posts blog post events capture the victim information published on a ransomware group's extortion site, including company details, proof screenshots, and other data ransomware groups often publish in stages, with full victim details added in subsequent edits flare monitors these posts for updates and generates a new event each time the content changes file listings file listing events represent the actual files exfiltrated from a victim and published on a ransomware site unlike blog posts, which are text based and surface quickly, ransomware groups vary in how, when, and where they make these files available exfiltrated data is often extremely large, which means file listings may take longer to surface than blog posts understanding a ransom leak event each ransom leak event includes the following data summary displays the event metadata including source, creation date, first seen, and last seen, as well as ransom victim metadata such as the organization name, industry, country, and employee count a content preview is also shown content shows the full body of the ransomware blog post, including any file paths, urls, and threat statements published by the ransomware group severity explains why the event was assigned its severity level and contextual information about the ransomware group's activity leaked files lists files associated with the leak, searchable by name or path each file entry includes the file name, size, date created, first crawled at, and status date created reflects the date the file was posted on the ransomware website first crawled at reflects the date at which flare managed to ingest it, and the date when an alert docid\ eqfosnlszdt49 kdw6xts (if configured) was generated these dates can differ significantly depending on the size of the files and the mechanism used to host them ai assist provides an ai generated summary and contextual analysis of the event, including a description of the ransomware group's tactics and what the leak means for the victim organization advanced displays the raw event and header data for the event how flare tracks ransom leak updates ransomware groups often publish in stages the first blog post is commonly a teaser with minimal information full victim details, file listings, and download links are added in subsequent edits whenever a post is updated, flare creates a new, separate event to represent that update this update event has its own unique id (uid) and appears independently in your events feed each update event includes a diff view that shows exactly what changed between the previous version of the post and the current state this allows you to quickly identify what new information was added, such as a victim name being published, files being released, or a deadline being changed, without reading the full post each time note collecting and processing updates to file listings takes longer than blog post events due to the structure and size of exfiltrated files, and the mechanism used to host them therefore, updates to file listings can take days or weeks to surface in flare after they are first made available on the ransomware site an update event appears independently in your events feed, and includes the following information ransom victim metadata structured fields in a side by side table with changed values highlighted for quick scanning content full post text from the previous crawl alongside the updated version, making it easy to spot what was added or changed a drop down menu provides quick access to all previous versions of the event, so you can trace how the post evolved from initial publication to its current state watch the following demo for more information accessing events via api update events for ransom leaks are new as of june 2026 if you were monitoring ransom leaks prior to june 2026, here are a few things to keep in mind for your integrations a single ransomware post can now produce multiple event ids (uids) the original event retains its uid (e g , document/source/1) and a new uid is generated for each subsequent update event (e g , document/source/1/abc) the parent uid is no longer updated once an update event has been created if your integration queries the tenant events feed, no changes are required ransomware update events will surface in your feed alongside original events you may notice an increase in ransomware related events this is expected behavior and it reflects activity that was previously occurring but not being surfaced, specifically post publication edits that are now generating their own events if your integration polls a specific ransomware uid directly, update your logic to also query child uid, or switch to querying the tenant event feed, to avoid missing post publication updates chats chat events are messages ingested from encrypted and semi public messaging platforms, primarily telegram and icq, where threat actors coordinate in real time this sub category captures stealer log distribution, initial access brokering, and service advertisements, often providing earlier warning than a corresponding marketplace listing updates to chat events ( coming august 26, 2026 ) chat events can contain attachments which are files shared directly within a chat message, commonly used by threat actors to distribute malware, stealer logs, or stolen data each attachment added after the parent event is ingested is treated as a new event for example, a single chat message where an attachment was added after the parent event, will have two events in the events feed one for the main event and one for when an attachment was added each attachment event carries its own metadata and can be scored, filtered, and actioned independently this affects two areas of your workflow precise analysis each new attachment is evaluated on its own characteristics, so a high risk file is not diluted by a low risk message, or the reverse accurate searching attachments matching specific criteria can be found directly, without false matches from the parent chat message attachment events and their parent chat message are linked through the associated events section in the event summary, allowing you to navigate between the two and see the full context of what was shared accessing events via api starting august 26, 2026, the chat message search type will return both chat message and attachment events if you consume flare data programmatically, it is recommended to review any downstream automation, siem rules, or ticketing workflows that consume this event type ahead of the release date note to prevent duplicate events when the same attachment is shared multiple times in a conversation, the prevent events for identical attachments duplication policy is available and enabled by default see prevent events for identical attachments docid\ bpfemrwnyleqfmalmrst9 for details learn more about chats docid\ v1dmpdzafwhy4ghp99ca0 markets dark web marketplaces, also called crypto markets, are storefronts where threat actors list goods and services for sale, ranging from stolen credentials and malware to fraud tools and counterfeit documents transactions are typically settled in cryptocurrency, primarily bitcoin and monero this sub category surfaces activity relevant to your organization when your data or assets appear in listings learn more about markets docid\ v1dmpdzafwhy4ghp99ca0 account shops account shops are a specialized type of underground marketplace focused exclusively on the sale of compromised accounts to specific services and websites they provide a direct signal that credentials associated with your organization or your users are being actively monetized in the criminal ecosystem learn more about account shops docid\ v1dmpdzafwhy4ghp99ca0 infected devices (stealer logs) this sub category covers data from infostealer malware infections on end user machines, appearing in two forms marketplace listings advertising access to compromised devices, and fully parsed stealer logs containing credentials, session tokens, cookies, and detailed device information it is one of the highest signal sources in flare for detecting compromised employees, customers, or corporate systems learn more about infected devices docid\ v1dmpdzafwhy4ghp99ca0 forum posts underground forums are spaces where threat actors discuss, collaborate, and advertise, covering topics ranging from hacking and fraud to data breach announcements and initial access brokering each event includes the message body, author alias, thread context, and extracted indicators forums are often where deals are struck before they surface on marketplaces learn more about forum posts docid\ v1dmpdzafwhy4ghp99ca0 profiles this sub category aggregates identity pages from dark web markets and forums, including actor aliases, registration details, activity history, reputation scores, and contact handles such as telegram or tox usernames it supports threat actor tracking and persona correlation across platforms learn more about profiles docid\ v1dmpdzafwhy4ghp99ca0 blog posts illicit blogs are content publishing platforms within the criminal ecosystem where actors publish articles, technical guides, and cybercrime commentary some operate as solo publications while others function as open platforms with multiple contributors this sub category can surface leaked internal documentation, adversary tooling guides, or proprietary materials shared without authorization learn more about blog posts docid\ v1dmpdzafwhy4ghp99ca0 financial data criminal autoshops are automated storefronts where stolen payment card data is bought and sold via cryptocurrency with instant delivery this sub category surfaces cards issued by or associated with your organization that are actively being trafficked, enabling proactive fraud mitigation before financial damage occurs learn more about financial data docid\ v1dmpdzafwhy4ghp99ca0