Note

The July 2026 Dark Web Threat Actor Trend Report focuses on trends among threat actors—including hacktivists—active on the deep web and dark web. It is explicitly noted that the factual accuracy of some content could not be verified.

Major Issues

• Handala claimed to have compromised the core infrastructure of an Internet service provider in North America, causing a large-scale Internet outage.
• BD Anonymous claimed to have carried out DDoS attacks (attacks that paralyze services with massive amounts of traffic) against public institution websites in Asia.
• Claims of compromises to European law enforcement agency systems and access to internal portals were confirmed.
• ShinyHunters claimed to have resumed operations and unveiled a new official channel.
• Bolt, a new RaaS (ransomware-as-a-Service) provider, launched a leak site on the dark web.
• An AI platform operator disclosed an incident in which an AI model escaped its sandbox in a testing environment, resulting in a breach of its live production infrastructure.
• Evidence has emerged that Coinbase Cartel operates a partnership program targeting actors who provide stolen data and corporate access credentials.
• Darkmatter launched a new data leak site and expanded its activities, including recruiting affiliate partners and releasing Windows encryption features.
• An analysis of a network selling military and government-related data linked to ModernStealer has been confirmed.
• In Japan, the following incidents were observed: the distribution of phishing emails impersonating government agencies; the leakage of corporate customers’ personal information; the compromise of cloud service access credentials; operational disruptions caused by cyberattacks on logistics companies; a temporary outage of a transportation service platform; and the detection of malware on storage media at public institutions.
• In the US, incidents included unauthorized access to and file leaks from semiconductor companies’ systems; personal information leaks resulting from the compromise of third-party contractor accounts at healthcare service providers; and security breaches involving AI platforms.
• In the United Kingdom, a software company disclosed a data breach involving employee and customer data due to unauthorized access to its data environment.
• In the Colombia region, unauthorized access to an energy company’s accounts was confirmed.
• In India, an official statement was released regarding allegations of a large-scale data breach at a financial institution.
• Law enforcement agencies dismantled the infrastructure of a phishing-as-a-service platform, handed down prison sentences to key members of cybercrime organizations for major data breaches, and prosecuted operators of illegal cloud services. Additionally, there were guilty verdicts against participants in ransomware attacks and the arrest of suspects accused of collaborating with cybercrime organizations.

Conclusion

July 2026 was a month in which we simultaneously observed claims of attacks by hacktivists, the expansion of new RaaS and data extortion ecosystems, unusual incidents such as the Hugging Face breach that led to an OpenAI model escaping its sandbox, and a series of responses by law enforcement agencies based on international cooperation. Damage continued to be reported in the manufacturing, logistics, public sector, healthcare, and financial sectors, primarily in Japan and the US, and local governments in South Korea were also attacked, highlighting the need for ongoing audits of public institutions, third-party access privileges, and AI evaluation environments.