CloudSEK Report Finds Rising Dark-Web, Ransomware and Hacktivist Activity Targeting France
Summary
CloudSEK reports rising France-related dark-web activity, driven largely by exposed credentials and infostealer logs, alongside ransomware claims targeting local governments and geopolitically motivated hacktivism.
Key points
- CloudSEK counted roughly 17,800 France-tagged dark-web, ransomware, and hacktivism items over 24 months; it cautions that feed counts do not represent unique confirmed victims.
- Dark-web activity accounts for most of the volume. Monthly counts rose from under 300 in mid-2024 to more than 1,000 in spring 2026, after peaking above 1,400 in January.
- Credentials and credential collections were the most common data types, which the report attributes largely to infostealer logs and credential-resale activity.
- The report recorded 213 France-tagged ransomware advisories in the past six months, with local governments and small organizations prominent among the victims; reposts inflate advisory counts.
- Hacktivism activity totaled 742 items in six months, dominated by NoName057(16) claims of DDoS activity and access targeting French organizations over geopolitical issues.
- Recommendations include monitoring exposed credentials, enforcing MFA and login protections, auditing legacy systems, improving ransomware readiness, and reviewing third-party security.
Article Details
- Publisher
- CloudSEK
- Report Period
- 24-month activity view and six-month ransomware and hacktivism view, queried through 2026-06-30
- Scope
- France-tagged dark-web data leaks and fraud, ransomware victim advisories, and hacktivism activity; includes CNIL public sanction records.
- Sample Size
- Approximately 17,800 combined France-tagged items across dark-web, ransomware, and hacktivism feeds over 24 months; feed/advisory counts are not confirmed unique victims.
- Key Statistics
- Combined France-tagged dark-web, ransomware, and hacktivism activity totaled roughly 17,800 items over 24 months.
- Monthly dark-web volume rose from under 300 in mid-2024 to above 1,400 in January 2026, then remained above 1,000 per month through spring 2026.
- The report counted 213 France-tagged ransomware victim advisories in the six months before the June 30, 2026 query; reposts may inflate the count.
- The report counted 742 France-tagged hacktivism items in the six months before the June 30, 2026 query.
- More than 5,600 breach notifications were filed with CNIL in 2024, and more than 145 million records belonging to French residents were exposed between 2024 and 2025, according to the report.
- Recommendations
- Monitor infostealer logs and combolists against employee and customer credential sets.
- Enforce MFA and deploy credential-stuffing and rate-limiting controls on customer-facing logins.
- Audit legacy and regional web systems for exposed directories and unpatched injection flaws.
- Test breach-notification readiness against the 72-hour CNIL Article 33 reporting deadline.
- Extend ransomware readiness, including offline backups, segmentation, and EDR coverage, to regional offices and subsidiaries.
Threat Actors
587306Listed roughly two million records described as belonging to French women for sale, according to the report.AiComboListed as a dark-web handle associated with combolist distribution.bavacaiNamed as a separate threat-actor attribution under which the Thiverval-Grignon advisory was republished.ChimeraZListed as a dark-web handle associated with French real estate, hospitality, and government data.DevelMakssListed as a dark-web handle associated with combolist and credential sales.EpsilonIdentified in the report as a group linked to the NormalLeVrai / NearLeVrai scammer network.HiddenHqAdvertised a dataset of more than one billion records, allegedly sourced via Salesforce, according to the report.Immanuel_KantPosted a leak of nearly half a million PII records, according to the report.LockBitDescribed as a globally top-ranked ransomware actor with recurring presence in France.MedusaLockerNamed in a ransomware advisory claiming an attack on the municipal administration of Thiverval-Grignon.NearLeVraiNamed as an alias used by a French-speaking scammer collective selling fabricated databases and conducting other fraud.NoName057(16)Dominant hacktivist actor in the report; claimed DDoS attacks and unauthorized access activity tied to France's support for Ukraine and EU sanctions.NormalLeVraiNamed as an alias used by a French-speaking scammer collective selling fabricated databases and conducting other fraud.O1s Channel chat V2Listed in the hacktivism section in connection with stolen-card-data sales via Telegram.PwnerSecIdentified in the report as a group linked to the NormalLeVrai / NearLeVrai scammer network.QilinClaimed a sustained campaign against the Commune d’Eyguières; the victim was listed in at least eight advisory postings.SaturneNamed as the actor who dumped a database after an exposed directory listing was discovered.SKYNETListed as a dark-web handle associated with bulk PII and credential sales.TerraStress.STListed as a hacktivism-channel actor advertising a DDoS-for-hire service.WhiteMellyListed as a dark-web handle associated with data-leak distribution.
Vendors
Products
MonLogicielMedical.comHealthcare third-party exposure: A breach at Cegedim Santé's medical practice software (MonLogicielMedical.com) exposed administrative data on roughly 15 million French patients spanning up to 15 years of history,SalesforceSalesforce-linked mega-breach (1B+ records): Threat actor ‘HiddenHq’ advertised a 1 billion+ record dataset allegedly sourced via Salesforce, affecting 36 major global companies including French-relevant multinational
Countries
FranceCloudsek telemetry confirms a sustained, high-volume wave of France-targeted data leaks, credential dumps, ransomware victim advisories, and hacktivist disruption activity across several underground forums and channels.Luxembourgcampaign, claimed DDoS attacks against French drone manufacturers Xsun France and iDrone, alongside Luxembourg's Ministry of Finance, citing France's policy positions as motivation.Ukrainegeopolitically motivated DDoS and access-claim campaign tied explicitly to France's support for Ukraine, alongside unrelated cybercriminal services (DDoS-for-hire, OTP/SMS fraud bots, carding) that piggyback
Industries
AerospaceJustice, Finance, Interior) plus the Civil Aviation Authority and National Reception Office, alongside aerospace companies.AutomotiveE-commerce(1,480), and Email (1,427) lead exposure over the full 2-year window, followed by Retail (1,197), E-Commerce (1,089), Education (607), and Social Media (591). The government sector leading the 2-year viewEducation(1,427) lead exposure over the full 2-year window, followed by Retail (1,197), E-Commerce (1,089), Education (607), and Social Media (591). The government sector leading the 2-year view reflects sustainedEmailGovernment (1,652), Financial Services (1,594), Technology (1,491), Telecommunications (1,480), and Email (1,427) lead exposure over the full 2-year window, followed by Retail (1,197), E-Commerce (1,089), EducationFinancial ServicesGovernment (1,652), Financial Services (1,594), Technology (1,491), Telecommunications (1,480), and Email (1,427) lead exposure over the full 2-year window, followed by Retail (1,197), E-Commerce (1,089), EducationGovernmentresale), ransomware victim advisories (smaller in count but high-impact, concentrated on local government and SMEs), and hacktivism (politically motivated DDoS, defacement, and access claims, dominated by theHealthcareand more than 145 million records belonging to French residents were exposed across public services, healthcare, telecom, and retail between 2024 and 2025, statistically more than two breach events per FrenchHospitalityFrench real estate, hospitality and government datareal estateFrench real estate, hospitality and government dataRetailrecords belonging to French residents were exposed across public services, healthcare, telecom, and retail between 2024 and 2025, statistically more than two breach events per French resident.Social mediaover the full 2-year window, followed by Retail (1,197), E-Commerce (1,089), Education (607), and Social Media (591). The government sector leading the 2-year view reflects sustained ransomware pressure on FrenchTechnologyGovernment (1,652), Financial Services (1,594), Technology (1,491), Telecommunications (1,480), and Email (1,427) lead exposure over the full 2-year window, followed by Retail (1,197), E-Commerce (1,089), EducationTelecommunicationsGovernment (1,652), Financial Services (1,594), Technology (1,491), Telecommunications (1,480), and Email (1,427) lead exposure over the full 2-year window, followed by Retail (1,197), E-Commerce (1,089), Education