New ScarlettGroup Extortion Gang Threatens to Leak Company Data Using Dark Web Countdown Timers

An emerging cyber-extortion operation named ScarlettGroup is using a Tor-based leak site and public countdown timers to pressure organizations over allegedly compromised data.

Threat-monitoring records described in Foresiet’s research place its emergence around September 2026, with visibility increasing during October as alleged victim listings and underground forum activity attracted attention.

Unlike conventional ransomware campaigns, ScarlettGroup’s publicly observed activity centres on threatened disclosure rather than confirmed file encryption.

Available evidence does not establish its initial access methods, demonstrate ransomware deployment, or independently verify every breach allegation.

Those distinctions matter when assessing an emerging actor whose public claims form part of its coercion strategy.

ScarlettGroup’s dedicated dark web platform displays alleged victims alongside publication dates, industry categories, disclosure statuses, and countdown timers.

The interface turns individual breach allegations into visible deadlines, creating pressure on organisations to engage before information is supposedly released.

Observed listings span technology, education, government, and entertainment. That spread does not establish a consistent sector-specific targeting strategy.

More importantly, appearing on a criminal leak site is not equivalent to independent confirmation that an organisation suffered unauthorised access or data theft.

The approach resembles a broader pattern documented by DarkOwl, which describes leak sites as “name-and-shame” infrastructure and identifies countdown clocks as a mechanism for setting public disclosure deadlines.

Such features support extortion messaging; they do not establish the authenticity, completeness, or sensitivity of the underlying material.

ScarlettGroup Extortion Campaign

According to the Foresiet research, ScarlettGroup describes a process involving public listing, a negotiation window, and either closure or disclosure.

Alleged compromises first appear with organisational details and publication information. A deadline then provides a limited period for communication with the operators.

The group claims that settlements lead to listing removal and deletion of compromised information. If negotiations fail, it threatens publication.

These assurances remain attacker-controlled claims: removing a webpage provides no independent proof that stolen files, copies, or access to affected environments have been eliminated.

Foresiet also documented ScarlettGroup-related activity on PwnForums. Reported associations involving BreachForums and DarkForums require additional verification.

Forum announcements can amplify allegations beyond the leak site, increasing reputational pressure while giving defenders additional material to correlate against internal incident evidence.

ScarlettGroup illustrates why defenders must distinguish ransomware from data-only extortion.

CISA’s StopRansomware Guide explicitly recognises incidents in which criminals steal information and threaten publication without deploying encryption. Consequently, the absence of locked systems does not rule out an extortion incident.

For potentially affected organizations, the immediate priority is to validate the allegation rather than treat the countdown as evidence.

Investigators should preserve relevant logs, examine suspicious account activity, assess access to sensitive repositories, and correlate alleged samples with internal records.

CISA’s guide provides prevention guidance and an incident-response checklist covering ransomware and data extortion.

Preventive measures include stronger authentication, restricted access to sensitive information, exposed-service remediation, and monitoring for abnormal data transfers.

Backups support recovery but cannot reverse confidentiality loss after exfiltration. CISA also warns that ransom payment does not ensure an environment is no longer compromised.

ScarlettGroup’s unconfirmed intrusion methods make evidence-led investigation essential: organisations should assess what happened, what information was accessed, and whether attacker access persists before drawing conclusions from public claims or negotiation deadlines alone during an unfolding security incident.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.