---
title: Underground Threat Activity Report - 2022
description: Explore Cyble's 2022 Underground Threat Activity Report to understand emerging cyber threats and vulnerabilities in the dark web.
image: https://labs.cyble.com/hubfs/Q4%20Ransomware%202022-2.1%20LP%20image.jpg
---

![https://labs.cyble.com/hubfs/cyble-black-logo.png](https://labs.cyble.com/hubfs/cyble-black-logo.png) ![](https://labs.cyble.com/hubfs/menu-bar.png)

- [Home](https://cyble.com?hsLang=en)
- Products 
    - [Cyble Vision](https://cyble.com/products/cyble-vision?hsLang=en)
    - [Cyble Odin(beta)](https://getodin.com/)
    - [AmIBreached](https://cyble.com/products/amibreached?hsLang=en)
    - [Cyble Hawk (LEA, Govt.)](https://cyble.com/products/cyble-hawk?hsLang=en)
    - [The Cyber Express](https://thecyberexpress.com/?hsLang=en)
- Solutions 
    - [Darkweb & Deepweb](https://cyble.com/solutions/dark-web-monitoring?hsLang=en)
    - [Attack Surface Management](https://cyble.com/solutions/attack-surface-management?hsLang=en)
    - [Brand Intelligence](https://cyble.com/solutions/brand-protection?hsLang=en)
    - [Cyber Threat Intelligence](https://cyble.com/solutions/cyber-threat-intelligence?hsLang=en)
    - [Vulnerability Management](https://cyble.com/solutions/cve-vulnerability-management?hsLang=en)
    - [Takedown & Disruption](https://cyble.com/solutions/takedown-services?hsLang=en)
- Resources 
    - [Blog](https://blog.cyble.com/)
    - [Case Studies](https://cyble.com/resources/case-studies?hsLang=en)
    - [Research Reports](https://cyble.com/resources/research-reports?hsLang=en)
    - [Whitepapers](https://cyble.com/resources/whitepapers?hsLang=en)
    - [SAMA Compliance](https://cyble.com/resources/sama-compliance?hsLang=en)
    - [Guides and Tips](https://resources.cyble.com/)
- Partners 
    - [Partner Program Overview](https://partnernetwork.cyble.com/)
    - [Existing Partner Login](https://partnercentral.cyble.com/login)
    - [Become a Partner](https://cyble.com/partner-apply?hsLang=en)
- [REQUEST A DEMO](https://cyble.com/request-demo?hsLang=en)

Report

# Underground Threat Activity Report  2022

### Underground Threat Activity Report - 2022

 

Underground forums have always been a hub for Threat Actor activities. Whether it is info-sharing, collaboration on attacks, or even advertising their services and affiliate programs, Cybercrime forums are the primary medium used by Threat Actors.

In our Underground Threat Activity report, you will find detailed analyses of cyberforum activities that we have observed over the past year, from emerging trends and cybercrime statistics to TTPs employed by TAs across several industries. You can also find our recommendations to mitigate the impact of these attacks, as well as our predictions for the evolution of the threat landscape and emerging threats that we may see in the future.

Key takeaways from our report include:

- Phishing-as-a-Service(PaaS), Ransomware-as-a-Service (RaaS), Bulletproof Hosting, Fast Flux Services, and EV Code Signing services gaining traction in underground forums
- The role of Initial Access brokers in Ransomware attacks and their close ties to known ransomware groups
- We foresee cybercriminals modifying their techniques to mass-market their exploits and data breaches through this new medium
-  We anticipate that FinTech, E-commerce, Energy, Telecom, and Semi-Conductor organizations may witness higher threats, in line with the trends observed in 2022
- Threat activities targeting Critical Infrastructure due to mass-exploiting techniques and tools emanating from cybercrime forums are likely to increase 
- Threat activities impacting entities in Asia, North America, and Latin America were observed to be widely distributed in underground forums
- Threat Actors like **Bjorka, IntelBroker, shadowhacker, kelvinsecurity,** and **GhostSec** were observed to be predominantly active in the underground

 And more. 

Download the report now!

[Follow us on Facebook](https://www.facebook.com) [Follow us on LinkedIn](https://www.linkedin.com) [Follow us on Twitter](https://www.twitter.com) [Follow us on Instagram](https://www.instagram.com)

### Get the Underground Threat Activity Report

Copyright © 2025 Cyble, Inc. All Rights Reserved.