Microsoft’s Digital Defense Report 2025 puts it plainly: “Increasingly, adversaries aren’t breaking in, they’re logging in.” Those logins often come from dark web data leaks: passwords stolen by one criminal and sold to another. Dark web monitoring watches those leaks for your company’s accounts so you can change the locks before someone uses the key. Here is how the trade works, what dark web monitoring can and can’t catch, and what to do when a hit comes in.
Sources: Verizon 2026 Data Breach Investigations Report (39%, 95 days); Mandiant M-Trends 2026 (22 seconds).
What leaks, and where it comes from
These are the leaks dark web monitoring looks for:
- Breach dumps: passwords stolen from another website. If an employee reused a work password there, the dump holds a working key to your business.
- Phishing: logins typed into fake sign-in pages.
- Infostealer logs: malware that copies saved passwords and session cookies from an infected computer. Europol’s IOCTA 2025 says stolen cookies and tokens can let criminals into apps “as an authenticated user.” CISA and the FBI say the LummaC2 infostealer can take MFA details “without immediate detection.”
When the Justice Department seized domains used to run LummaC2 in May 2025, it said the FBI had identified at least 1.7 million instances of the malware being used to steal this kind of information. When police took down Genesis Market in 2023, Eurojust said it was advertising credentials stolen from about 460,000 devices. Takedowns help, but Verizon’s 2026 DBIR says infostealers “have continued to persist and evolve even in the face of various actions taken by law enforcement.”
How attackers operate: the handoff chain
Much ransomware isn’t one gang doing everything. Microsoft describes a division of labor: “initial operators deploy the malware, access brokers monetize the stolen data, and users such as ransomware groups use it to gain footholds in enterprise environments.”
Based on the Microsoft Digital Defense Report 2025, CISA #StopRansomware advisories, and Europol’s IOCTA 2025 and 2026.
Initial access brokers
The Justice Department describes an initial access broker as “a person who specializes in gaining unauthorized access to computer networks and systems of corporations and organizations and selling that access to other cyber threat actors such as ransomware groups.” That definition comes from the March 2026 sentencing of Aleksei Volkov, who sold access used by the Yanluowang ransomware group and others. He received 81 months in prison.
CISA’s #StopRansomware advisories show the same pattern. Medusa actors “typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces,” and most brokers “appear to be willing to work for multiple variants at the same time.” For Akira, the variant reported most often to the FBI’s IC3 in 2025, CISA says actors got in through VPNs “without multifactor authentication (MFA) configured,” and sometimes through compromised VPN credentials, “potentially by using initial access brokers.”
In broker listings reviewed for Verizon’s 2026 DBIR, 44% of connection types were VPN, followed closely by remote desktop tools such as RDP.
Why the handoff matters to you
Speed. Mandiant’s M-Trends 2026 found the median handoff time fell from more than 8 hours in 2022 to 22 seconds in 2025. CrowdStrike’s 2026 Global Threat Report puts average eCrime “breakout time” at 29 minutes. Treat every dark web monitoring alert as same-day work.
Small firms are targets too: in Verizon’s data, about 96% of ransomware victims with a known size had fewer than 1,000 employees.
Why splitting the work makes attackers harder to catch
Splitting the crime among specialists also muddies the trail:
- The ransomware name doesn’t tell you who broke in. Microsoft Threat Intelligence wrote that “as ransomware deployment becomes a gig economy, it has become more difficult to link the tradecraft used in a specific attack to the ransomware payload developers.”
- Every affiliate works differently. A joint CISA and FBI advisory on LockBit said that because of “the large number of unconnected affiliates,” LockBit attacks “vary significantly” in their tactics.
- Stolen data changes hands. Europol says data may be resold several times, which “can result in multiple actors launching attacks against the same victim.”
- Traffic is disguised. Europol’s IOCTA 2026 says layered anonymization is “complicating source attribution and delaying the investigation due to numerous additional cross-border judicial requests.”
Cases still get made, but the Volkov case took indictments in two federal districts, an arrest in Italy, and an extradition. Your better defense is making stolen logins useless early, and dark web monitoring helps with the “early” part.
Why dark web monitoring matters
Dark web monitoring checks breach dumps, criminal forums, and paste sites for your company’s logins and alerts you when they appear. Why act on those alerts:
- Leaks often come first. Verizon’s 2026 DBIR found that all but 27% of ransomware victims had an infostealer infection or credential leak in the year before they were publicly named; for half of those, within 95 days.
- Small businesses leak too. Small organizations had a median of seven credential leak events a year; larger ones around 20.
- Attackers try leaked usernames. Microsoft found that 85% of usernames targeted in password spray attacks appeared in known credential leaks.
- One infected laptop is a warning. Microsoft says defenders “must treat infostealer infections as precursors to wider compromise, not isolated malware events.”
Dark web monitoring you may already own
NIST requires a password change when there is evidence of compromise. On Microsoft 365, Microsoft Entra ID Protection includes a leaked credentials detection: Microsoft scans dark web forums, breach dumps, paste sites, and seized data, and flags a user only when the leaked password matches the current one. Check your license and setup (on-premises accounts need password hash sync), and make sure someone reads the alerts.
What dark web monitoring can’t see. It spots exposure, not every breach.
- Exploited vulnerabilities were the top way in for breaches in Verizon’s 2026 DBIR (31%), ahead of credential abuse (13%). No leak alert flags an unpatched VPN.
- Some victims get no warning. That same 27% of ransomware victims in Verizon’s analysis showed no infostealer or credential leak beforehand.
- Europol says criminals are moving to “smaller, invitation-only spaces” and private encrypted channels. No dark web monitoring service sees everything.
- Some listings are fake or recycled from old leaks, so every hit needs checking.
- Stolen session cookies can work without the password, so a reset alone may not end access.
When you get a dark web monitoring hit: 6 steps
First, confirm what the dark web monitoring hit shows: which account, whether the password is current, and whether it looks like an infostealer log (an infected device) or an old breach elsewhere.
- Reset the password and kill sessions. Reset from a known-clean device, then revoke active sessions. Microsoft says revoking sessions “immediately invalidates any active access using the stolen credentials.” Reissue app passwords too; a reset doesn’t revoke them.
- Enforce or verify MFA, phishing-resistant where possible. Confirm MFA is required, including for VPN and webmail. Remove MFA methods you don’t recognize. Microsoft says MFA blocks over 99% of unauthorized access attempts. CISA calls phishing-resistant MFA, such as FIDO2 security keys, “the gold standard.”
- Check for password reuse. Is that password, or a variation, used anywhere else? Change every copy. See our strong password guide.
- Investigate sign-in logs and mailbox rules. Look for sign-ins from unfamiliar places or devices. In Microsoft 365, check for inbox rules that forward or hide mail, new external forwarding, unfamiliar app consents, and changed admin roles. Microsoft lists these as warning signs; they often set up business email compromise.
- Check the device for infostealer malware. If the dark web monitoring hit looks like an infostealer log, the leaking computer is the real problem. Scan it; isolate or rebuild it if anything turns up. Eurojust’s advice to Genesis Market victims: remove the malware first, then change passwords. Include personal devices; Verizon notes work credentials are common on them.
- Escalate to incident response when needed. Escalate for unexplained sign-ins, new mailbox rules, a confirmed infostealer, or any admin or VPN account. Mandiant advises treating routine malware alerts as “high-priority indicators of an impending secondary intrusion.” Preserve logs and report to the FBI’s IC3.
Make leaked logins less useful
Dark web monitoring tells you a key was copied. These controls make a copied key harder to use:
- MFA on every account, phishing-resistant for admins and finance
- Unique passwords kept in a password manager
- Dark web monitoring alerts assigned to a person
- MFA on every VPN and remote access path
- No remote desktop exposed directly to the internet
- Internet-facing devices patched first
- Endpoint detection and response (EDR) on every computer
- Sign-in and mailbox logs kept long enough to investigate
- Limits on work logins from unmanaged personal devices
The FBI’s 2025 IC3 report recommends MFA “particularly for webmail, virtual private networks, and accounts that access critical systems.” Patching lags: Verizon found organizations fully fixed only 26% of vulnerabilities on CISA’s Known Exploited Vulnerabilities list in 2025.
How LTS can help
We help businesses in Bakersfield and across Kern County catch exposed logins early and respond fast, working alongside any internal IT staff.
- Dark web monitoring setup: We can help set up leaked-login alerts, including tools already in Microsoft 365, and make sure someone acts on every hit.
- Responding to dark web monitoring hits: Resets, session revocation, sign-in and mailbox-rule reviews, and device checks.
- MFA and access hardening: MFA rollout, conditional access, and VPN and remote access reviews through our cybersecurity services.
- Endpoint detection: Managed EDR on platforms such as CrowdStrike or SentinelOne, plus patching and help desk through our managed IT support.
- Incident response coordination: Containment, forensics coordination, and restore work when it’s more than one password.
Not sure whether your logins have leaked, or who would act if they did? Talk to an LTS engineer about dark web monitoring and a response plan.
Related: Business email compromise · Strong passwords · AI-enabled attacks · Cybersecurity services · Contact