New Extortion Gang 'ScarlettGroup' Emerges with Dark Web Leak Site and Countdown Timers
A new cyber extortion gang, ScarlettGroup, has surfaced, utilizing a dark web leak site and countdown timers to publicly pressure alleged victims into paying ransoms.
A new cyber extortion operation, dubbed ScarlettGroup, has begun publicly naming alleged victim organizations on a dark web leak site, employing countdown timers to create urgency and pressure for ransom payments. This tactic aims to force targeted companies into negotiations before any alleged data breach claims can be independently verified. The group's activity was first noted in threat monitoring systems around September 2026, with a more visible presence emerging in October.
Researchers from Foresiet documented ScarlettGroup's emergence in a report published on October 21, 2026. Their analysis indicates an extortion campaign rather than a distinct malware family. Crucially, Foresiet has not yet established how ScarlettGroup gains initial access to victim networks, nor whether they deploy ransomware for file encryption. The group's current modus operandi appears to focus on public shaming and negotiation, with claims of data deletion upon settlement remaining unverified.
ScarlettGroup's Tor-based leak site displays alleged victims alongside details such as their industry, the status of the disclosure, and the critical countdown timers. This public-facing deadline is designed to compel organizations to engage with the attackers. The approach bears a superficial resemblance to the public pressure tactics used in the alleged Everest breach of BMW, though no direct connection between the groups has been established, nor have the claims of either group been independently verified.
The gang outlines a three-stage process: initial public listing, a negotiation window, and either data disclosure or resolution. During the negotiation phase, organizations can communicate with ScarlettGroup operators. The group asserts that a successful settlement will result in the removal of the listing and the deletion of the exfiltrated data. However, Foresiet cautions that there is no independent guarantee that data will be deleted post-settlement, and a removed listing should not be taken as proof that all copies of the data have been destroyed or that network access has ceased.
Foresight's observations of ScarlettGroup activity include alleged breach announcements and data offerings on forums like PwnForums, with unverified links to other platforms such as BreachForums and DarkForums. While forum posts can amplify allegations and draw attention, they also provide potential leads for security teams to investigate. The absence of confirmed encryption is a significant point of distinction from many other ransomware operations. Unlike attacks that solely rely on encryption, ScarlettGroup's primary leverage appears to be the threat of public data release.
The report from Foresiet highlights a lack of confirmed technical details, including specific exploited vulnerabilities, malware payloads, or verified intrusion vectors. Consequently, security teams are advised to treat public claims with caution and prioritize independent investigation. Foresiet recommends verifying criminal assertions against concrete evidence, preserving forensic data, and closely monitoring for unusual data transfers or system access.
Organizations listed on ScarlettGroup's site are urged to investigate potential unauthorized access without immediately accepting the listing as definitive proof of a breach. Strengthening access controls, implementing robust multifactor authentication, limiting permissions, and regularly reviewing exposed credentials remain fundamental preventative measures. Monitoring underground forums and leak sites can provide early warnings, but actionable intelligence requires careful contextualization and verification.
Ultimately, the most concrete evidence available pertains to ScarlettGroup's public-facing extortion process, not its technical capabilities. While a countdown timer can create a sense of urgency, it does not provide evidence of the origin, age, or authenticity of the data claimed to be stolen. Defenders must rely on their own system logs and forensic data to accurately assess the scope of any potential incident and formulate an appropriate response, recognizing that the deadline itself is not a substitute for investigative evidence.