Who
Which operation is behind this, what it used to be called, and who runs it. Aliases, lineage, and operator overlap, traced across rebrands.
Know your adversaries before they know you.
Ransomware threat intelligence that tracks the actors, infrastructure, and attribution behind who's targeting you.
Intelligence drawn from across the global threat landscape
.svg.webp){kind=logo}
NASBleed: Inside a 343k-Host Credential Spill
Read more →
The Australian Behind Doxbin: Identifying Unindicted Co-Conspirator CC-1 AKA KT
Read more →
Your Network Was Already On Sale
Read more →
Cyberleek: Mapping the Actor Behind the Leak
Read more →
Flotilla: Anatomy of an Undocumented Cross-Platform Covert-Browser Botnet Delivered Through the GCleaner Channel
Read more →Every layer of the operation.
VULONE tracks ransomware groups across their full lifecycle, from the forums they recruit on to the infrastructure they burn.
Leak sites, forums, and infrastructure monitored continuously. Signals captured as they appear, not compiled after the fact.
The feed never stops.Aliases, tooling, and infrastructure matched across operations. When a crew rebrands, the profile follows them.
A new name is not a new group.Every claim carries its source, its date, and a confidence rating. Assessed, corroborated, and unverified are labeled as such.
Evidence you can defend.Living records of every tracked operation. TTPs mapped to ATT&CK, infrastructure indicators, victimology, and lineage.
Not frozen at publish date.New victim posts, resurfacing groups, fresh recruitment. You hear about movement when it happens.
Minutes, not weeks.Continuous watch for your organization in group chatter and staging activity, before the leak goes public.
The window before impact.What we track
8.8M+
Threat actors profiled
Forum accounts and personas from the underground communities, merged where the evidence ties them together.
16.6M+
Selectors indexed
Emails, IPs, ICQ, Skype, Telegram and Jabber handles, onion addresses, crypto wallets, Tox and PGP keys, each tied to the actor who used it.
136.6M+
Records indexed
Every row of the indexed underground communities: forum posts, private messages, member profiles and activity logs.
You can watch hundreds of feeds, dashboards, and advisories. Most of them still will not tell you which ransomware groups are active, how they are changing, or who is actually behind the campaigns.
VULONE does.
Articles
Threat Intelligence
Sep 15, 2026
NASBleed: Inside a 343k-Host Credential Spill
343,000 plain-text NAS and RDP logins found sitting in an open directory, most of them factory defaults. How the dump feeds access brokers, and what to check now.
3 minute readRead article →
Cyber Investigations
Sep 11, 2026
The Australian Behind Doxbin: Identifying Unindicted Co-Conspirator CC-1 AKA KT
10 minute readRead more →
Threat Intelligence
Aug 31, 2026
Your Network Was Already On Sale
11 minute readRead more →
Cyber Investigations
Aug 21, 2026
Cyberleek: Mapping the Actor Behind the Leak
5 minute readRead more →
We’ve got the
whole underground
VULONE sits in the forums, markets and channels where access and data change hands. The flagship boards, the splinter rooms that outlast every takedown, the Telegram and Discord fronts beside them. When a crew rebrands, rotates or reopens, we are already inside.
See the coverage
They rebrand
They rotate infrastructure
They go quiet
They come back
We keep the file open.
Three questions every ransomware report should answer.
How
Their tooling, their access routes, their tactics mapped to ATT&CK. Not a list of indicators, a working model of how the crew operates.
What now
Detections you can deploy, infrastructure you can block, and the confidence rating to justify acting on it.
Have questions?
We have answers.
VULONE is a threat actor intelligence platform focused on ransomware groups and high-impact threat actors. We use continuous OSINT, infrastructure tracking, and careful attribution research to deliver clear intelligence security teams can act on.
We pull from a wide range of public, community, and adversarial sources. This includes forums, code repositories, leak sites, malware analysis platforms, social channels, and threat actor chatter.
No. VULONE is built to work alongside SIEMs, EDRs, SOAR platforms, and traditional threat feeds by adding deeper context on the groups behind the activity.
Most feeds send indicators and generic alerts. VULONE focuses on specific ransomware groups and threat actors. We cover their infrastructure, tactics, evolution, and attribution, and we back every insight with evidence and confidence scoring.
We treat attribution carefully. Signals are checked across multiple independent sources and scored for confidence. We only surface operator or identity insights when the evidence is strong enough.
Yes, but not as a black box. AI helps with clustering, language analysis, and prioritization. Every output is supported by transparent evidence and human review.
Ready to see VULONE in action?
Platform access is available to verified security teams. Request a demo to get started.