Incident Response & DFIR
Resolve the handle, wallet, or contact behind an intrusion to the operator running it, across forums, with evidence, mid-investigation.
Know your adversaries before they know you.
Ransomware threat intelligence that tracks the actors, infrastructure, and attribution behind who's targeting you.
Intelligence drawn from across the global threat landscape
.svg.webp){kind=logo}
Inside China’s Exposed “Key Figures” Database for Ethnic External Propaganda
Read more →
Inside a Commercial Account-Takeover Operation: Device-Trust Abuse Against Brazilian Retail Accounts
Read more →
China-Linked Hackers Targeted Governments Across Asia. We Hacked Their Infrastructure.
Read more →
NASBleed: Inside a 343k-Host Credential Spill
Read more →
The Australian Behind Doxbin: Identifying Unindicted Co-Conspirator CC-1 AKA KT
Read more →Every layer of the operation.
VULONE tracks ransomware groups across their full lifecycle, from the forums they recruit on to the infrastructure they burn.
Leak sites, forums, and infrastructure monitored continuously. Signals captured as they appear, not compiled after the fact.
The feed never stops.Aliases, tooling, and infrastructure matched across operations. When a crew rebrands, the profile follows them.
A new name is not a new group.Every claim carries its source, its date, and a confidence rating. Assessed, corroborated, and unverified are labeled as such.
Evidence you can defend.Living records of every tracked operation. TTPs mapped to ATT&CK, infrastructure indicators, victimology, and lineage.
Not frozen at publish date.New victim posts, resurfacing groups, fresh recruitment. You hear about movement when it happens.
Minutes, not weeks.Continuous watch for your organization in group chatter and staging activity, before the leak goes public.
The window before impact.Who VULONE is for
Crypto Recovery & Compliance
Trace a wallet back to the actor who advertised it, and surface every alias and identifier tied to them across underground communities.
Legal & Investigations
Turn cross-forum attribution into a sourced, timestamped, defensible dossier, every link backed by evidence, exportable for a case.
Threat Intelligence & Research
Pivot on any identifier and map an actor's presence across boards and time, without six open tabs and manual guesswork.
What we track
16.2M+
Threat actors profiled
Forum accounts and personas from the underground communities, merged where the evidence ties them together.
29M+
Selectors indexed
Emails, IPs, ICQ, Skype, Telegram and Jabber handles, onion addresses, crypto wallets, Tox and PGP keys, each tied to the actor who used it.
144.5M+
Records indexed
Every row of the indexed underground communities: forum posts, private messages, member profiles and activity logs.
Articles
Cyber Investigations
Oct 31, 2026
Inside China’s Exposed “Key Figures” Database for Ethnic External Propaganda
On October 24, 2026, the VULONE Team discovered an operational Chinese database titled 民族外宣重点人物信息库 (Key Figures Information Database for Ethnic External Propaganda). Linked to the China Internet Information Center (CIIC) and DeepChina, it held 2,580 records across 103 countries, structured as a 22-column CRM for tracking and countering voices on ethnic issues. The platform was left unencrypted on the public internet.
5 minute readRead article →
Threat Intelligence
Oct 26, 2026
Inside a Commercial Account-Takeover Operation: Device-Trust Abuse Against Brazilian Retail Accounts
18 minute readRead more →
APT Activity
Oct 19, 2026
China-Linked Hackers Targeted Governments Across Asia. We Hacked Their Infrastructure.
19 minute readRead more →
Threat Intelligence
Sep 15, 2026
NASBleed: Inside a 343k-Host Credential Spill
3 minute readRead more →
We’ve got the
whole underground
VULONE sits in the forums, markets and channels where access and data change hands. The flagship boards, the splinter rooms that outlast every takedown, the Telegram and Discord fronts beside them. When a crew rebrands, rotates or reopens, we are already inside.
See the coverage
Start here
Your next lead is one search away
Paste a handle, an email, a Tox ID or an address. We return the accounts behind it, the boards they work, and the people they answer to.
