Alert

• this report is a summary of deep web and dark web source-based material and contains some facts that cannot be fully verified due to the nature of the sources.

Major Issues

• BreachForums’ internal collapse and attempts to rebuild were observed. trust was undermined by the betrayal of moderators and the movement of funds, and user confusion was exacerbated by the proliferation of clones (.ac, .us, etc.) and fake domains.
• BreachForums attempted to reorganize with alliances with Vect and Spear and a user absorption strategy, but failed to stabilize due to cross-clone hacking and mutual attacks.
• LeakBase was seized and shut down in the FBI-Europol-led “Operation Leak,” and after a period of securitization, we saw attempts to re-emerge through Russian bulletproof hosting and the arrest of its operators by Russia’s MVD, leading to its final closure.
• The emergence of new platforms such as DragonHub and independent payment portals suggests the formation of a new ecosystem that bypasses the traditional forum-centric transaction structure.
• The emergence of Onion services dedicated to the sale of Android attack tools, confirming a threat landscape where mobile-targeted attack tools are becoming more commoditized and accessible.
• The alignment of TeamPCP, Vect, and BreachForums indicates the proliferation of an industrialized ransomware landscape that decentralizes ransomware development, distribution, data exfiltration, and blackmail.
• forum collapses and seizures have led to mass user churn and decentralization of the ecosystem, making it more difficult to track.

Conclusion

• the March 2026 trends show that the structural instability of major forums, the decentralization of platforms, and the commoditization of attack tools are evolving the dark web beyond simple information exchange into an organized attack infrastructure.
• organizations should continue to monitor forum infrastructure shifts and decentralization trends and expand their threat intelligence collection.