Note

The July 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. Due to the nature of some sources, it may be difficult to fully verify the accuracy of certain information; therefore, it is necessary to cross-check these details against official announcements.

Major Issues

• RaidForums changed its main domain, ceased operations on the previous domain, and transitioned to the new domain. The launch of the new RaidBin Service was also confirmed, and the operating rules for the Ransomware-as-a-Service (RaaS) section were disclosed.
• On Hasan’s BreachForums, an announcement regarding the retirement of operator HasanBroker and the handover of operations was confirmed.
• A website claiming to be LAPSUS$ declared a permanent cessation of activities, citing the achievement of its financial goals.
• The Leaked forum promoted its beta launch and revealed its structure, and the BreachStars 2.0 Forum was also announced.
• A banner indicating seizure by international law enforcement agencies was posted on the Sevyware ransomware leak site, though no official statement regarding this has been confirmed.

Conclusion

In July 2026, the dark web was characterized by infrastructure overhauls and announcements of leadership changes at major existing forums, as well as the continuous emergence of new platforms. The launch of RaidForums’ RaaS section demonstrated the trend toward integration between data leak forums and the ransomware landscape, while Hasan’s announcement regarding the succession of BreachForums hinted at potential shifts in the future direction of major leak hubs. The announcement by the website claiming to be LAPSUS$ that it would suspend operations—along with the possibility of its relaunch—and the case of the seizure banner on the Sevyware leak site demonstrated the importance of verifying the authenticity of dark web posts through official announcements.