ScarlettGroup

ScarlettGroup is a cybercriminal data-extortion operation that became publicly visible in fall 2026. Foresiet’s October research places its emergence around September and October, when it began promoting alleged compromises through a Tor leak site and underground forums. Its documented public activity centers on threatened disclosure of information; deployment of a ransomware encryptor has not been established.

The group’s listings are claims of compromise. They do not independently verify data theft, responsibility for a victim’s outage or the authenticity of advertised information.

Activity and targeting

ScarlettGroup’s claim footprint spans multiple industries and countries. Brandefense’s tracking includes the United States, India, Canada and Malaysia. Technology, government, education, entertainment, financial services and health care organizations appear in the monitoring record, but the limited claim sample does not establish a consistent sector preference.

Dark Eye’s tracker recorded additional listings through Nov. 9, 2026, including a California hospital’s domain. Listing dates describe the group’s public activity and should not be treated as intrusion dates. Different monitoring services report different first-observed dates and totals.

Methods and operational characteristics

The operation uses public victim pages, countdowns and disclosure-status labels to pressure organizations into negotiations. Foresiet directly documented ScarlettGroup-related PwnForums posts; it described appearances on BreachForums and DarkForums as requiring further correlation. Forum promotion broadens visibility beyond the Tor site.

CyberXTron’s analysis describes Session as the negotiation channel and reproduces the operation’s presentation of itself as a private group. Its advertised outcomes include settlement, publication or sale of allegedly obtained data. Promises to remove a listing or delete information after payment are the actor’s assertions, not verifiable guarantees.

Public research has not established an initial access method, exploited vulnerability, malware payload or encryption mechanism. Leak-site features and forum postings describe an extortion workflow; they do not establish a technical attack chain or prove that every claimed compromise occurred.

What type of group is it?

The observed payment pressure and threatened sale or disclosure of information support assessing ScarlettGroup as financially motivated, with moderate confidence. It is tracked within the ransomware and extortion ecosystem, while the evidence specifically supports a data-extortion operation rather than a confirmed encrypting ransomware family.

The operators’ identities and geographic base, any affiliate structure and relationships to other criminal groups remain unestablished. A claimed private operating model does not independently resolve those questions.