RT by @stealthmole_int: Government-Related Darkweb/Deepweb Leak Activity — First Week of June 2026 Observed activity consists of 26 government-related leak or sale postings and 4 ransomware/extortion listings tied to public-sector or government-associated entities. The activity is distributed across multiple underground forums and Tor-hosted leak sites, with visible concentration on darkforums, spear, and craxpro.
StealthMole cyber threat intelligence on ransomware, data leaks and criminal underground ecosystems.
Government-Related Darkweb/Deepweb Leak Activity — First Week of June 2026 Observed activity consists of 26 government-related leak or sale postings and 4 ransomware/extortion listings tied to public-sector or government-associated entities. The activity is distributed across multiple underground forums and Tor-hosted leak sites, with visible concentration on darkforums, spear, and craxpro. The reporting period shows notable clustering around Argentina and Mexico, repeated use of the same seller identities across multiple listings, and several cases that include supplementary indicators such as Telegram channels, email addresses, Tox IDs, domains, IP ranges, session values, and file hashes. A subset of listings is also associated with large volumes of credential-related exposure counts. Indicators of Leakage @ StealthMole (@stealthmole_iol) [Weekly case] Government leaks on Darkweb/Deepweb in 1st Week, June 2026 platform.stealthmole.com/cas… — https://nitter.net/stealthmole_iol/status/2064275172534972806#m
