Loading threat actor…
Darkhub is a cybercrime service platform operating as a hacking-for-hire offering on the Tor network. It advertises illicit services including unauthorized access to social media and email accounts, interception of private communications, mobile device monitoring, real-time location tracking, cryptocurrency-related fraud, unauthorized bank account access, and credit score manipulation. The platform presents these offerings through a professionalized commercial interface and appears to target both individuals and organizations. Darkhub also advertises so-called fund recovery services, a pattern commonly associated with advance-fee fraud schemes that exploit prior scam victims by promising recovery assistance in exchange for payment. Based on the reported service catalog, Darkhub aligns more closely with a criminal service marketplace or scam-enabled cybercrime operation than with a state-directed intrusion set. Observed behavior indicates capabilities associated with initial access, credential theft, surveillance-oriented account compromise, financial fraud, and data interception. High-confidence reporting also indicates that infrastructure associated with the operation extends beyond Tor-only exposure. No reliable attribution to a specific country, formal sub-group structure, or nation-state sponsor is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.