Note

The June 2026 Dark Web Threat Actor Trend Report focuses on trends among threat actors—including hacktivists—operating on the deep web and dark web. It is noted that the accuracy of some information could not be verified.

Major Issues

• In Malaysia, a series of website defacement and compromise incidents targeting local development agencies and public health sector websites was confirmed. Additionally, evidence of document-based attacks against government agencies by a threat actor known to be a China-linked APT group was observed in the same region.
• A pro-Russian hacktivist group claimed to have carried out DDoS attacks against public institutions in Europe. DDoS attacks involve flooding a system with a large number of requests to disrupt service availability.
• In Japan, an incident involving unauthorized access to and data leakage from the email system of a telecommunications service provider was confirmed. Furthermore, credential stuffing attacks (attacks using leaked account credentials) were detected on online services in the job recruitment sector and the Manufacturing sector.
• Concerns were raised regarding the potential exposure of customer account information at European retail and e-commerce companies, while a central bank in North Africa disclosed that it had responded to a cyberattack but stated that customer accounts were not affected. Furthermore, a funds theft incident occurred on a prediction market platform through a third-party breach.
• ShinyHunters announced it would discontinue the use of its active clearnet domains, and there were indications that the group intends to shift its operations primarily to the dark web.
• North Korea-linked threat actors were identified as being behind supply chain attacks targeting open-source package repositories related to AI frameworks.
• An analysis of a ransomware-as-a-service (RaaS) group’s set of tools for bypassing and neutralizing EDR was published; the group was noted to have continuously targeted various companies, including those in the defense and aerospace sectors in Europe.
• Evidence of a link between a threat actor and the Web Inject framework was confirmed. Analysis indicated that this framework was associated with initial access techniques utilizing fake browser updates.
• The death of a key operator within a threat actor group known to be a state-sponsored hacking organization in the Middle East was officially confirmed for the first time. However, the group is assessed to have continued its activities even after the leadership vacuum.
• A new ransomware threat actor has emerged, and it has been suggested that this may be a rebranded version of a ransomware group that had previously declared a halt to its activities. Additionally, evidence was found of Python-based information-stealing malware being promoted through cybercrime forums.
• In the US, suspicions of an insider connection arose after internal information from a cybersecurity firm was reportedly leaked to a ransomware group.
• On the law enforcement front, it was confirmed that numerous threat actors involved in cybercrimes—including ransomware, SIM swapping, cryptocurrency theft, and personal data breaches—were arrested or indicted, primarily in Europe.

Conclusion

In June 2026, key trends included website defacement and hacking by hacktivists centered in Malaysia, account-based breaches in Japan, fund theft from global platforms such as Polymarket, and the alleged Mastra npm supply chain breach by Sapphire Sleet. At the same time, law enforcement achievements continued, including a guilty verdict related to Scattered Spider, the arrest of a SIM-swapping ring, the indictment of AudiA6, and the arrest of a Spanish doxer. The need to conduct supply chain security audits, defend against credential stuffing, and strengthen detection and response systems for website defacement was emphasized.