Research into underground resources and related cyber risks to organizations in Russia and other CIS countries
About
Our threat intelligence and digital risk protection specialists present their joint research, Threat Zone 2026: The Other Side.
We analyzed more than 35,000
posts from underground forums, marketplaces, and private channels to understand how the adversary ecosystem is evolving.
The findings highlight 10 key trends to help organizations better understand the current threat landscape and stay proactive. The full research is available to download for free
Underground market fragmentation
forums and private chats analyzed by experts
The shutdown of major forums and blocking of Telegram channels did not eradicate the market. Sellers and buyers are shifting to smaller platforms, private chats, bots, and direct deals
Stealers as a primary driver of data breaches
stealer starting price
Logs are increasingly sold as filtered data rather than random files. They are sorted by domain, country, service, and corporate email address
Growing stealer log prices
increase in the cost of fresh data over the past year
Prices depend on data validity, the quality of sorting and verification, and the exclusivity of the logs
average monthly subscription price for a log cloud service
share of ads containing data on Russian users
Sale of corporate credentials on the rise
growth in corporate access credentials listed for sale in 2026
Credentials are now offered not just as a username and password, but as a ready‑made product containing information about the company, its infrastructure, and deployed systems
increase in the average price
RAT domination across the malware market
of malware ads involve RATs
A mature ecosystem has formed around RATs, featuring a standard set of functions and a division of roles between developers and traffic providers. The ability to rent a ready‑made tool instead of developing one independently keeps the entry barrier low
Ransomware ecosystem extending well beyond direct RaaS offerings
of posts directly mention ransomware
A significant portion of the market is hidden in related segments, including the sale of corporate credentials and the publication of data leaks
of leaks posted on one of the platforms resulted from ransomware attacks (according to platforms’ administration)
ClickFix as a ready‑made malware delivery service
price of a ready‑made ClickFix landing page
Buyers are offered templates that mimic user verification pages, online documents, and popular corporate services, tricking victims into running malicious scripts. The seller creates a phishing page and a scam mechanism while the buyer simply selects the malware to be delivered
Increasing exploitation of vulnerabilities
increase in the share of attacks exploiting vulnerabilities
of attacks aimed at gaining initial access through vulnerability exploitation, up from 7% in 2025
Ready‑made kits featuring an exploit, a list of targets, a checker, and instructions make such attacks accessible even to operators with zero development skills
Malware going multifunctional
decrease in malware ads over the past year
This does not necessarily mean the market is shrinking. Instead, individual tools are increasingly being combined into comprehensive solutions. A basic configuration may comprise a RAT, HVNC, and stealer, along with a keylogger, clipper, or loader
AI model jailbreaking as a major interest
of AI‑related discussions focus on bypassing the restrictions of public models
of posts relate to uncensored models
of posts involve hands‑on application of AI in attacks
However, even this small share covers virtually the entire life cycle, from reconnaissance and malware development to agent platforms and integrated automation
From underground posts to real attacks
Underground resources are where new tools, techniques, and business models emerge before spreading into the wild. By analyzing these developments, we can anticipate which threats will be on the rise tomorrow, which attacker tactics are becoming the new standard, and which security measures need to be updated.
The research covers more than 20 trends and includes examples of posts advertising malware, leaks, exploits, and other tools in attacker arsenals. This data is accompanied by expert recommendations to help organizations strengthen their defenses against emerging threats
Get your copy now
Sign up for our news and updates to download Threat Zone 2026: The Other Side
