1. Dark Storm Team
Members: 500 | Focus: DDoS / Hacking services for hire | Connections: Anonymous Sudan (former)
Dark Storm Team is a hacktivist group known for pro-Palestinian cyber operations and past collaboration with Anonymous Sudan, which was dismantled by law enforcement in 2024. The group has conducted attacks against targets in Denmark, Egypt, France, Israel, the UAE, and the United States, frequently coordinating with other threat actor groups to amplify impact.
Dark Storm Team’s Telegram Channel
What distinguishes Dark Storm Team from purely ideological hacktivist groups is its commercial component. The group actively promotes hacking services for hire through its Telegram channel, offering DDoS attacks against protected websites and database dumps from organizations including banks and airports. All transactions are conducted through cryptocurrency, with coordination handled via Telegram contacts.
This combination of ideological motivation and commercial services makes Dark Storm Team harder to predict than groups driven by a single motive. Its targeting can shift based on both political developments and paying customers, which broadens the range of organizations that might be affected.
The group’s Telegram channel was previously removed due to Telegram policy changes, but Dark Storm Team reestablished its presence and continued operations. Its connection to the now-defunct Anonymous Sudan provided early operational experience and targeting methodology that continues to influence the group’s approach.
Why it matters for defenders: Dark Storm Team blurs the line between ideological hacktivism and cybercrime-as-a-service. Organizations in the group’s target countries should monitor its channel for both campaign announcements and indicators that their sector is being discussed as a potential service target.
To mitigate the risks posed by exposed credentials, organizations must actively monitor and respond to identity-related threats. SOCRadar’s Identity & Access Intelligence module enables security teams to detect compromised credentials across various Dark Web sources, including stealer logs, data breaches, and Telegram-based cybercrime ecosystem.
SOCRadar’s Identity & Access Intelligence module page
By leveraging this intelligence, organizations can proactively secure accounts, enforce password resets, and prevent unauthorized access attempts before they escalate into full-scale breaches.
2. NoName057(16)
Subscribers: 2,200 | Focus: Pro-Russian hacktivism
NoName057(16) is a pro-Russian hacktivist group that emerged during the early months of the Russia-Ukraine war. Since 2022, the group has conducted sustained DDoS campaigns primarily targeting Ukraine, NATO-aligned countries, and nations providing military or economic support to Ukraine. Targets have included government portals, financial institutions, transportation systems, and critical infrastructure across Europe and North America.
Telegram channel of NoName057(16)
The group’s operational model centers on its DDoSia Project, a volunteer-driven DDoS tool distributed through Telegram. Participants download the tool, contribute their bandwidth to coordinated attacks, and receive cryptocurrency payments based on the volume and effectiveness of their contribution. This crowdsourced approach allows NoName057(16) to scale attack capacity without maintaining dedicated botnet infrastructure.
The channel has gone through multiple disruptions. Telegram’s updated moderation policies led to the removal of its primary channel, which previously held over 30,000 subscribers. The group rebuilt under a new handle within days, recovering roughly 2,200 subscribers so far. This pattern of rapid reconstruction is consistent across hacktivist groups operating on Telegram and illustrates why static channel lists lose value quickly.
NoName057(16) also operates multiple secondary channels for different languages and operational functions, including dedicated DDoSia distribution channels and regional targeting coordination groups.
Why it matters for defenders: NoName057(16) publicly announces targets before and during campaigns. Monitoring their channels gives security teams advance warning of DDoS operations, particularly for organizations in NATO-aligned countries, government services, financial institutions, and critical infrastructure.
3. RipperSec
Members: 1,000 | Focus: Pro-Palestinian hacktivism
RipperSec is a Malaysia-based pro-Palestinian hacktivist group that has been active on Telegram since mid-2023. The group targets Israel and its allies, but its operations have expanded through alliances with pro-Russian threat actors, broadening its targeting scope beyond the Israel-Palestine conflict.
RipperSec’s new DDoS channel
While DDoS attacks are RipperSec’s primary method, the group has also conducted website defacement campaigns and claimed intrusions into SCADA-like systems. These operational upgrades reflect a broader trend among hacktivist groups moving beyond simple volumetric attacks toward more disruptive capabilities.
RipperSec’s most notable technical contribution is MegaMedusa, a NodeJS-based Layer-7 Web DDoS tool developed by a group member. MegaMedusa is designed for accessibility: it runs on Debian, Ubuntu, Kali Linux, Termux, and Windows, which means users with minimal technical skill can launch scalable application-layer DDoS attacks. The tool’s cross-platform compatibility has contributed to its spread beyond RipperSec’s own membership.
The group’s alliance network is a significant attribute. Coordination with pro-Russian hacktivist groups gives RipperSec access to shared targeting lists, amplification support, and operational knowledge that extends its reach well beyond what a group of its size would normally achieve.
Why it matters for defenders: RipperSec’s cross-platform DDoS tooling and alliances with pro-Russian groups mean its targeting scope extends beyond the Israel-Palestine conflict. Organizations in allied nations and sectors previously targeted by RipperSec’s partners should treat this channel as an early warning source for coordinated hacktivist campaigns.
4. Observer Cloud
Members: 1,700 | Focus: Log aggregation / Combo lists
Observer Cloud is a Telegram-based aggregation channel that collects and republishes credential logs and combo lists sourced from other Telegram channels and underground communities. The channel does not generate its own data. Instead, it functions as a centralized redistribution point, gathering leaked credentials from scattered sources and consolidating them for easy access.
Observer Cloud’s Telegram channel
This aggregation model is what makes Observer Cloud operationally significant. Stolen credentials that might otherwise sit in low-visibility channels get amplified to a much larger audience once reposted here. The channel’s 12,750+ subscriber base means that credential exposure accelerates rapidly once material appears on the feed.
Beyond its core log-sharing function, Observer Cloud offers custom-built tools, maintains a scam list to flag unreliable sellers, and runs chat groups for discussions and transactions related to logs. The community has continued to expand, building out its infrastructure to strengthen its position in the underground credential trading ecosystem.
Why it matters for defenders: Observer Cloud is a high-visibility aggregation point for stolen credentials. Monitoring it helps security teams detect early exposure of organizational credentials before they spread into downstream cybercrime channels and active attack campaigns.
Is Your Data on the Dark Web? Get a Free Dark Web Report
As cybercriminals continue to exploit Dark Web markets, Telegram channels, and underground forums, organizations must take a proactive approach to identifying potential risks. Many underground platforms facilitate the sale of stolen credentials, financial data, and corporate information, making it crucial for businesses to monitor whether their sensitive assets have been exposed.
SOCRadar Labs Free Dark Web Report
With SOCRadar’s Free Dark Web Report, you can instantly check if your email addresses, domain names, or company assets have been leaked on Dark Web forums, black markets, leak sites, or Telegram channels. This free tool provides insights into:
Dark Web Threat Severity – Understand how exposed your organization is.
Dark Web Mentions – Find out who is talking about your company on underground platforms.
Employee Credentials – Detect whether your employees’ credentials have been compromised.
Data from Infected Machines – Identify malware infections affecting your network.
Latest Exposure – Discover the last time your sensitive data appeared in leaks.
Data for Sale – Check if cybercriminals are selling your information on black markets.
5. Omega Cloud
Members: 6,200 | Focus: Stealer log distribution
Omega Cloud is a Telegram-based platform that distributes stealer logs obtained from infostealer malware infections. The channel operates a tiered service model. A free tier provides limited access to logs, while paid subscriptions unlock higher-volume feeds and real-time delivery.
Omega Cloud’s Telegram Channel
The platform offers Live Traffic, delivering logs in real time, and Private Cloud, which provides up to 5,000 logs daily, amounting to 120,000 logs per month. Additionally, Omega Cloud maintains a database exceeding 2 billion records, accessible through a subscription-based model.
The regional focus is notable. Omega Cloud’s logs are heavily weighted toward Europe, the United States, Canada, and Brazil, with credentials sourced from platforms like YouTube and Google Ads. This geographic targeting means the channel is particularly relevant for organizations with employees, customers, or infrastructure in those regions.
Why it matters for defenders: Omega Cloud’s scale and real-time delivery model mean compromised credentials can reach buyers within hours of theft. Organizations with employees or customers in Europe, the US, Canada, or Brazil should treat this channel as a priority monitoring target for credential exposure.
6. Data Leak Monitor
Members: 26,500 | Focus: Leak tracking / Ransomware monitoring
Data Leak Monitor is one of the larger Telegram channels dedicated to tracking data leaks, breach announcements, and ransomware victim claims. With over 26,500 subscribers, the channel reposts content from ransomware groups, underground forums, and other cybercrime communities, acting as a secondary distribution layer for breach-related intelligence.
Data Leak Monitor Telegram Channel
The channel’s value comes from its speed and subscriber reach. When a ransomware group publishes a new victim claim or a breach sample surfaces on an underground forum, Data Leak Monitoring often picks it up and reposts it to a much wider Telegram audience within hours. For organizations that are not directly monitoring ransomware leak sites or underground forums, this channel can serve as an early signal that something has surfaced.
The limitation is coverage depth. The channel does not track all major underground platforms. Several key forums listed in SOCRadar’s Top 10 Dark Web Hacker Forums research are absent from its monitoring scope. This means relying on Data Leak Monitoring alone would leave gaps in breach visibility.
Why it matters for defenders: Data Leak Monitoring functions as a secondary early warning layer for ransomware victim announcements and breach disclosures. Its high subscriber count and active reposting make it one of the faster distribution points for leak-related intelligence on Telegram.
7. BidenCash Shop
Members: 14,000 | Focus: Stolen card data monitoring | Connections: BidenCash Dark Web market
BidenCash is a dark web carding marketplace that runs a dedicated Telegram channel as a showcase for its automated card monitoring system. The system scans Telegram, Discord, and hacker forums for stolen credit card data, and the Telegram channel publishes real-time updates when card data is detected across these platforms.
Telegram channel of BidenCash
The channel is unusual in how openly it operates. Some posts visibly display card numbers and financial details. BidenCash claims to impose fines or bans on suppliers whose card listings are repeatedly found circulating on public sources, framing the monitoring system as a quality control mechanism for its marketplace operations.
Why it matters for defenders: The BidenCash Telegram channel provides direct visibility into how stolen financial data circulates across platforms. Monitoring it helps fraud teams and financial sector security analysts identify exposed card data and track the operational patterns of one of the more active carding marketplaces.
8. EMP/mailpass/sqli Chat
Members: 9,300 | Focus: Credential trading / Cybercrime discussion
EMP/mailpass/sqli Chat started in April 2019 as a Russian-language group and has since expanded into a multilingual cybercrime discussion platform. With roughly 9,300 members, the group covers a broad range of underground activity: stolen account sales, financial fraud, SQL injection techniques, malware deployment, stealer data distribution, and trading compromised credentials for platforms ranging from streaming services and social media to financial accounts and VPN access.
EMP/mailpass/sqli Chat Telegram group
The channel’s longevity is worth noting. Many Telegram-based cybercrime groups appear and disappear within months. EMP/mailpass/sqli Chat has maintained continuous activity for over five years, which suggests a stable core community and moderation structure that has survived multiple rounds of Telegram policy enforcement.
The group functions as both a discussion forum and a marketplace. Members share logs, stealer data, and access credentials alongside technique discussions. Some members offer daily-updated data sources and private datasets for a fee. Buyers and sellers connect directly, with the group acting as the initial matchmaking layer.
The breadth of topics is the defining characteristic. Unlike channels that specialize in one type of cybercrime (carding, DDoS, ransomware), EMP/mailpass/sqli Chat covers the full spectrum of credential-related crime. This makes it useful for understanding how stolen data moves from initial theft through various monetization stages.
Why it matters for defenders: EMP/mailpass/sqli Chat’s longevity and broad scope make it a useful indicator of current credential trading patterns and active exploitation techniques. Its mix of discussion and commerce provides context about how stolen data moves from initial theft to monetization.
9. Z-Pentest Alliance
Members: 300 | Focus: OT/ICS intrusion | Connections: Cyber Army of Russia (defunct), NoName057(16)
Z-Pentest Alliance is a Russia-linked threat group that targets critical infrastructure, with a specific focus on operational technology (OT) environments. Since October 2024, the group has claimed intrusions into oil and gas facilities, water treatment plants, and industrial control systems. Unlike most hacktivist groups that rely on DDoS campaigns, Z-Pentest demonstrates actual intrusion capability, publishing screenshots and videos of interactions with critical process automation tools.
Telegram channel of Z-Pentest Alliance
This operational approach represents a significant escalation in hacktivist activity. Most hacktivist groups cause temporary service disruption through volumetric attacks. Z-Pentest’s claimed access to industrial control systems suggests the potential for physical-world impact, even if the group’s actual ability to cause damage remains debated.
Z-Pentest built visibility through collaborations with the now-defunct Cyber Army of Russia (formerly one of the most prominent pro-Russian threat groups) and NoName057(16). These alliances provided targeting intelligence, operational coordination, and audience amplification that a 300-member group would not achieve independently.
Following Telegram’s policy changes, Z-Pentest’s original channel was taken down. The group established a new channel under the same name to maintain continuity. This rapid reconstruction followed the same pattern seen across other hacktivist groups operating on the platform.
Why it matters for defenders: Z-Pentest Alliance is one of the few hacktivist-aligned groups that demonstrates actual OT intrusion capability rather than relying on DDoS alone. Organizations operating industrial control systems, particularly in energy, water, and manufacturing, should treat this channel as a direct threat indicator.
10. CTI Now
Subscribers: ~35,000 | Focus: CTI news aggregation
CTI Now is a Telegram channel focused on aggregating and distributing cybersecurity news from major industry sources. With nearly 35,000 subscribers, The Telegram channel functions as a high-volume news feed, sharing headlines and article links covering vulnerability disclosures, data breaches, threat actor campaigns, and security tool developments.
Telegram Channel of CTI Now
According to its bio, “Cyber Threat Intelligence (CTI) is an organised, analysed and refined information about potential or current attacks that threaten an organisation(s) or individual(s).”
The channel posts upwards of 30 articles per day, pulling from sources such as BleepingComputer, SecurityWeek, Security Affairs, CyberScoop, Schneier on Security, and SANS Internet Storm Center. Posts are automated, meaning the channel operates as a passive RSS relay rather than producing original analysis.
CTI Now has a clear limitation: everything it posts is sourced from public reporting. It does not surface underground intelligence, threat actor chatter, or pre-disclosure breach signals. Treating it as a standalone intelligence source would miss the deeper layers of threat activity that only appear in underground ecosystems.
Why it matters for defenders: CTI Now serves as a low-effort early warning layer for SOC teams. Active exploitation reports, major breach disclosures, and law enforcement actions often surface here within hours. It supplements direct threat intelligence feeds by consolidating public reporting into a single monitored source.
Note on Content Scope: SOCRadar’s research and monitoring activities focus strictly on cybercrime and threat actor behaviors relevant to organizational security.
1. Dark Storm Team
Members: 500 | Focus: DDoS / Hacking services for hire | Connections: Anonymous Sudan (former)
Dark Storm Team is a hacktivist group known for pro-Palestinian cyber operations and past collaboration with Anonymous Sudan, which was dismantled by law enforcement in 2024. The group has conducted attacks against targets in Denmark, Egypt, France, Israel, the UAE, and the United States, frequently coordinating with other threat actor groups to amplify impact.
Dark Storm Team’s Telegram Channel
What distinguishes Dark Storm Team from purely ideological hacktivist groups is its commercial component. The group actively promotes hacking services for hire through its Telegram channel, offering DDoS attacks against protected websites and database dumps from organizations including banks and airports. All transactions are conducted through cryptocurrency, with coordination handled via Telegram contacts.
This combination of ideological motivation and commercial services makes Dark Storm Team harder to predict than groups driven by a single motive. Its targeting can shift based on both political developments and paying customers, which broadens the range of organizations that might be affected.
The group’s Telegram channel was previously removed due to Telegram policy changes, but Dark Storm Team reestablished its presence and continued operations. Its connection to the now-defunct Anonymous Sudan provided early operational experience and targeting methodology that continues to influence the group’s approach.
Why it matters for defenders: Dark Storm Team blurs the line between ideological hacktivism and cybercrime-as-a-service. Organizations in the group’s target countries should monitor its channel for both campaign announcements and indicators that their sector is being discussed as a potential service target.
To mitigate the risks posed by exposed credentials, organizations must actively monitor and respond to identity-related threats. SOCRadar’s Identity & Access Intelligence module enables security teams to detect compromised credentials across various Dark Web sources, including stealer logs, data breaches, and Telegram-based cybercrime ecosystem.
SOCRadar’s Identity & Access Intelligence module page
By leveraging this intelligence, organizations can proactively secure accounts, enforce password resets, and prevent unauthorized access attempts before they escalate into full-scale breaches.
2. NoName057(16)
Subscribers: 2,200 | Focus: Pro-Russian hacktivism
NoName057(16) is a pro-Russian hacktivist group that emerged during the early months of the Russia-Ukraine war. Since 2022, the group has conducted sustained DDoS campaigns primarily targeting Ukraine, NATO-aligned countries, and nations providing military or economic support to Ukraine. Targets have included government portals, financial institutions, transportation systems, and critical infrastructure across Europe and North America.
Telegram channel of NoName057(16)
The group’s operational model centers on its DDoSia Project, a volunteer-driven DDoS tool distributed through Telegram. Participants download the tool, contribute their bandwidth to coordinated attacks, and receive cryptocurrency payments based on the volume and effectiveness of their contribution. This crowdsourced approach allows NoName057(16) to scale attack capacity without maintaining dedicated botnet infrastructure.
The channel has gone through multiple disruptions. Telegram’s updated moderation policies led to the removal of its primary channel, which previously held over 30,000 subscribers. The group rebuilt under a new handle within days, recovering roughly 2,200 subscribers so far. This pattern of rapid reconstruction is consistent across hacktivist groups operating on Telegram and illustrates why static channel lists lose value quickly.
NoName057(16) also operates multiple secondary channels for different languages and operational functions, including dedicated DDoSia distribution channels and regional targeting coordination groups.
Why it matters for defenders: NoName057(16) publicly announces targets before and during campaigns. Monitoring their channels gives security teams advance warning of DDoS operations, particularly for organizations in NATO-aligned countries, government services, financial institutions, and critical infrastructure.
3. RipperSec
Members: 1,000 | Focus: Pro-Palestinian hacktivism
RipperSec is a Malaysia-based pro-Palestinian hacktivist group that has been active on Telegram since mid-2023. The group targets Israel and its allies, but its operations have expanded through alliances with pro-Russian threat actors, broadening its targeting scope beyond the Israel-Palestine conflict.
RipperSec’s new DDoS channel
While DDoS attacks are RipperSec’s primary method, the group has also conducted website defacement campaigns and claimed intrusions into SCADA-like systems. These operational upgrades reflect a broader trend among hacktivist groups moving beyond simple volumetric attacks toward more disruptive capabilities.
RipperSec’s most notable technical contribution is MegaMedusa, a NodeJS-based Layer-7 Web DDoS tool developed by a group member. MegaMedusa is designed for accessibility: it runs on Debian, Ubuntu, Kali Linux, Termux, and Windows, which means users with minimal technical skill can launch scalable application-layer DDoS attacks. The tool’s cross-platform compatibility has contributed to its spread beyond RipperSec’s own membership.
The group’s alliance network is a significant attribute. Coordination with pro-Russian hacktivist groups gives RipperSec access to shared targeting lists, amplification support, and operational knowledge that extends its reach well beyond what a group of its size would normally achieve.
Why it matters for defenders: RipperSec’s cross-platform DDoS tooling and alliances with pro-Russian groups mean its targeting scope extends beyond the Israel-Palestine conflict. Organizations in allied nations and sectors previously targeted by RipperSec’s partners should treat this channel as an early warning source for coordinated hacktivist campaigns.
4. Observer Cloud
Members: 1,700 | Focus: Log aggregation / Combo lists
Observer Cloud is a Telegram-based aggregation channel that collects and republishes credential logs and combo lists sourced from other Telegram channels and underground communities. The channel does not generate its own data. Instead, it functions as a centralized redistribution point, gathering leaked credentials from scattered sources and consolidating them for easy access.
Observer Cloud’s Telegram channel
This aggregation model is what makes Observer Cloud operationally significant. Stolen credentials that might otherwise sit in low-visibility channels get amplified to a much larger audience once reposted here. The channel’s 12,750+ subscriber base means that credential exposure accelerates rapidly once material appears on the feed.
Beyond its core log-sharing function, Observer Cloud offers custom-built tools, maintains a scam list to flag unreliable sellers, and runs chat groups for discussions and transactions related to logs. The community has continued to expand, building out its infrastructure to strengthen its position in the underground credential trading ecosystem.
Why it matters for defenders: Observer Cloud is a high-visibility aggregation point for stolen credentials. Monitoring it helps security teams detect early exposure of organizational credentials before they spread into downstream cybercrime channels and active attack campaigns.
Is Your Data on the Dark Web? Get a Free Dark Web Report
As cybercriminals continue to exploit Dark Web markets, Telegram channels, and underground forums, organizations must take a proactive approach to identifying potential risks. Many underground platforms facilitate the sale of stolen credentials, financial data, and corporate information, making it crucial for businesses to monitor whether their sensitive assets have been exposed.
SOCRadar Labs Free Dark Web Report
With SOCRadar’s Free Dark Web Report, you can instantly check if your email addresses, domain names, or company assets have been leaked on Dark Web forums, black markets, leak sites, or Telegram channels. This free tool provides insights into:
Dark Web Threat Severity – Understand how exposed your organization is.
Dark Web Mentions – Find out who is talking about your company on underground platforms.
Employee Credentials – Detect whether your employees’ credentials have been compromised.
Data from Infected Machines – Identify malware infections affecting your network.
Latest Exposure – Discover the last time your sensitive data appeared in leaks.
Data for Sale – Check if cybercriminals are selling your information on black markets.
5. Omega Cloud
Members: 6,200 | Focus: Stealer log distribution
Omega Cloud is a Telegram-based platform that distributes stealer logs obtained from infostealer malware infections. The channel operates a tiered service model. A free tier provides limited access to logs, while paid subscriptions unlock higher-volume feeds and real-time delivery.
Omega Cloud’s Telegram Channel
The platform offers Live Traffic, delivering logs in real time, and Private Cloud, which provides up to 5,000 logs daily, amounting to 120,000 logs per month. Additionally, Omega Cloud maintains a database exceeding 2 billion records, accessible through a subscription-based model.
The regional focus is notable. Omega Cloud’s logs are heavily weighted toward Europe, the United States, Canada, and Brazil, with credentials sourced from platforms like YouTube and Google Ads. This geographic targeting means the channel is particularly relevant for organizations with employees, customers, or infrastructure in those regions.
Why it matters for defenders: Omega Cloud’s scale and real-time delivery model mean compromised credentials can reach buyers within hours of theft. Organizations with employees or customers in Europe, the US, Canada, or Brazil should treat this channel as a priority monitoring target for credential exposure.
6. Data Leak Monitor
Members: 26,500 | Focus: Leak tracking / Ransomware monitoring
Data Leak Monitor is one of the larger Telegram channels dedicated to tracking data leaks, breach announcements, and ransomware victim claims. With over 26,500 subscribers, the channel reposts content from ransomware groups, underground forums, and other cybercrime communities, acting as a secondary distribution layer for breach-related intelligence.
Data Leak Monitor Telegram Channel
The channel’s value comes from its speed and subscriber reach. When a ransomware group publishes a new victim claim or a breach sample surfaces on an underground forum, Data Leak Monitoring often picks it up and reposts it to a much wider Telegram audience within hours. For organizations that are not directly monitoring ransomware leak sites or underground forums, this channel can serve as an early signal that something has surfaced.
The limitation is coverage depth. The channel does not track all major underground platforms. Several key forums listed in SOCRadar’s Top 10 Dark Web Hacker Forums research are absent from its monitoring scope. This means relying on Data Leak Monitoring alone would leave gaps in breach visibility.
Why it matters for defenders: Data Leak Monitoring functions as a secondary early warning layer for ransomware victim announcements and breach disclosures. Its high subscriber count and active reposting make it one of the faster distribution points for leak-related intelligence on Telegram.
7. BidenCash Shop
Members: 14,000 | Focus: Stolen card data monitoring | Connections: BidenCash Dark Web market
BidenCash is a dark web carding marketplace that runs a dedicated Telegram channel as a showcase for its automated card monitoring system. The system scans Telegram, Discord, and hacker forums for stolen credit card data, and the Telegram channel publishes real-time updates when card data is detected across these platforms.
Telegram channel of BidenCash
The channel is unusual in how openly it operates. Some posts visibly display card numbers and financial details. BidenCash claims to impose fines or bans on suppliers whose card listings are repeatedly found circulating on public sources, framing the monitoring system as a quality control mechanism for its marketplace operations.
Why it matters for defenders: The BidenCash Telegram channel provides direct visibility into how stolen financial data circulates across platforms. Monitoring it helps fraud teams and financial sector security analysts identify exposed card data and track the operational patterns of one of the more active carding marketplaces.
8. EMP/mailpass/sqli Chat
Members: 9,300 | Focus: Credential trading / Cybercrime discussion
EMP/mailpass/sqli Chat started in April 2019 as a Russian-language group and has since expanded into a multilingual cybercrime discussion platform. With roughly 9,300 members, the group covers a broad range of underground activity: stolen account sales, financial fraud, SQL injection techniques, malware deployment, stealer data distribution, and trading compromised credentials for platforms ranging from streaming services and social media to financial accounts and VPN access.
EMP/mailpass/sqli Chat Telegram group
The channel’s longevity is worth noting. Many Telegram-based cybercrime groups appear and disappear within months. EMP/mailpass/sqli Chat has maintained continuous activity for over five years, which suggests a stable core community and moderation structure that has survived multiple rounds of Telegram policy enforcement.
The group functions as both a discussion forum and a marketplace. Members share logs, stealer data, and access credentials alongside technique discussions. Some members offer daily-updated data sources and private datasets for a fee. Buyers and sellers connect directly, with the group acting as the initial matchmaking layer.
The breadth of topics is the defining characteristic. Unlike channels that specialize in one type of cybercrime (carding, DDoS, ransomware), EMP/mailpass/sqli Chat covers the full spectrum of credential-related crime. This makes it useful for understanding how stolen data moves from initial theft through various monetization stages.
Why it matters for defenders: EMP/mailpass/sqli Chat’s longevity and broad scope make it a useful indicator of current credential trading patterns and active exploitation techniques. Its mix of discussion and commerce provides context about how stolen data moves from initial theft to monetization.
9. Z-Pentest Alliance
Members: 300 | Focus: OT/ICS intrusion | Connections: Cyber Army of Russia (defunct), NoName057(16)
Z-Pentest Alliance is a Russia-linked threat group that targets critical infrastructure, with a specific focus on operational technology (OT) environments. Since October 2024, the group has claimed intrusions into oil and gas facilities, water treatment plants, and industrial control systems. Unlike most hacktivist groups that rely on DDoS campaigns, Z-Pentest demonstrates actual intrusion capability, publishing screenshots and videos of interactions with critical process automation tools.
Telegram channel of Z-Pentest Alliance
This operational approach represents a significant escalation in hacktivist activity. Most hacktivist groups cause temporary service disruption through volumetric attacks. Z-Pentest’s claimed access to industrial control systems suggests the potential for physical-world impact, even if the group’s actual ability to cause damage remains debated.
Z-Pentest built visibility through collaborations with the now-defunct Cyber Army of Russia (formerly one of the most prominent pro-Russian threat groups) and NoName057(16). These alliances provided targeting intelligence, operational coordination, and audience amplification that a 300-member group would not achieve independently.
Following Telegram’s policy changes, Z-Pentest’s original channel was taken down. The group established a new channel under the same name to maintain continuity. This rapid reconstruction followed the same pattern seen across other hacktivist groups operating on the platform.
Why it matters for defenders: Z-Pentest Alliance is one of the few hacktivist-aligned groups that demonstrates actual OT intrusion capability rather than relying on DDoS alone. Organizations operating industrial control systems, particularly in energy, water, and manufacturing, should treat this channel as a direct threat indicator.
10. CTI Now
Subscribers: ~35,000 | Focus: CTI news aggregation
CTI Now is a Telegram channel focused on aggregating and distributing cybersecurity news from major industry sources. With nearly 35,000 subscribers, The Telegram channel functions as a high-volume news feed, sharing headlines and article links covering vulnerability disclosures, data breaches, threat actor campaigns, and security tool developments.
Telegram Channel of CTI Now
According to its bio, “Cyber Threat Intelligence (CTI) is an organised, analysed and refined information about potential or current attacks that threaten an organisation(s) or individual(s).”
The channel posts upwards of 30 articles per day, pulling from sources such as BleepingComputer, SecurityWeek, Security Affairs, CyberScoop, Schneier on Security, and SANS Internet Storm Center. Posts are automated, meaning the channel operates as a passive RSS relay rather than producing original analysis.
CTI Now has a clear limitation: everything it posts is sourced from public reporting. It does not surface underground intelligence, threat actor chatter, or pre-disclosure breach signals. Treating it as a standalone intelligence source would miss the deeper layers of threat activity that only appear in underground ecosystems.
Why it matters for defenders: CTI Now serves as a low-effort early warning layer for SOC teams. Active exploitation reports, major breach disclosures, and law enforcement actions often surface here within hours. It supplements direct threat intelligence feeds by consolidating public reporting into a single monitored source.
Note on Content Scope: SOCRadar’s research and monitoring activities focus strictly on cybercrime and threat actor behaviors relevant to organizational security.
——————————————————–
Click Here For The Original Source.
