September 2026 Dark Web Threat Actor Trend Report

The September 2026 Dark Web Threat Actor Trend Report focuses on threat actors active on the deep web and dark web, as well as publicly reported cyberattack incidents. It is noted that the factual accuracy of some content cannot be independently verified.

Some hacktivist groups claimed responsibility for DDoS attacks targeting the websites of financial institutions, universities, private companies, and research institutions in Japan. Another threat group claimed responsibility for attacks targeting the websites of government agencies and affiliated organizations in the Middle East. However, these claims are based solely on the threat actors’ own assertions, and it has not been confirmed whether actual service disruptions occurred.

In the Region of Japan, a series of officially disclosed data breaches were confirmed. A car-sharing service provider announced the leak of millions of personal records due to unauthorized access to its web systems, while a government joint information system disclosed the potential for personal data leaks resulting from unauthorized access via an exploited VPN vulnerability. In addition, companies across various sectors—including transportation, e-commerce and ticket booking, and hotels and lodging—announced that they had suffered from ransomware attacks or unauthorized access.

In Nepal, a ransomware attack targeting an IT service provider caused disruptions to the trading systems of numerous securities firms, and it was reported that stock market trading was temporarily suspended.

In the US, federal law enforcement agencies announced that they are investigating allegations of a breach of a recruitment system and the leakage of employee personal information. Additionally, an energy company and a healthcare IT company disclosed personal information leaks caused by a breach of external systems and the compromise of third-party supply chain accounts, respectively.

In Europe, an AI development company issued an official statement regarding allegations of unauthorized access following claims that its source code had been sold, while a security firm officially confirmed a incident involving the leak of proprietary source code.

A specific threat actor denied any connection to a suspect arrested in the Netherlands. Meanwhile, Dutch law enforcement officially confirmed the arrest in connection with an investigation into that hacking group, and another well-known cybercrime organization announced plans to resume operations and disclose new victims.

On a cybercrime forum, a post offering to sell access to corporate networks was identified, and on a separate criminal community, a post recruiting developers of attack tools was observed. Additionally, the activities of a new data extortion group were confirmed, and information was shared a threat actor with a history of developing and operating Android financial malware.

Law enforcement agencies worldwide continued their efforts to combat cybercrime, including the arrest of suspects linked to hacking groups, the imposition of prison sentences on ransomware participants, the prosecution of cybercrime accomplices, the seizure of DDoS service infrastructure, the takedown of botnets, and the apprehension of suspects involved in hacking incidents targeting government agencies.

In the Japan Region, claims of DDoS attacks by hacktivists were observed concurrently with actual security breaches at Times CAR, the Digital Agency’s GSS, and Keio Corporation. The hacktivists’ claims require independent verification and must be evaluated separately from officially reported incidents. As demonstrated by the DataHub incident in Nepal, a breach at a single infrastructure provider can lead to service disruptions at multiple organizations, underscoring the importance of security audits for supply chains and third-party vendors. Furthermore, the LAPSUS$ Group’s announcement of its return, the emergence of Montage, and the trading of access credentials and recruitment efforts on PwnForums and T1ER0NE demonstrate the need for continuous monitoring of Initial Breach asset trading and trends among new groups. Law enforcement actions—including domain seizures, botnet takedowns, arrests, and convictions—continue to be reported, making it necessary to track investigative trends.