NetWalker: hxxp://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion/blog
Ranzy: hxxp://37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxkoqd.onion/
Revil: hxxp://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/
AVADDON: http://avaddongun7rngel.onion/
CLOPS: http://ekbgzchl6x2ias37.onion/
CONTI: http://htcltkjqoitnez5slo7fvhiou5lbno5bwczu7il2hmfpkowwdpj3q2yd.onion/
CONTI-NEWS (RYUK): http://fylszpcqfel7joif.onion/
DARKSIDE: http://darksidedxcftmqa.onion/
DOPPLE PAYMER: http://hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion/MAZE: http://xfr3txoorcyy7tikjgj5dk3rvo3vsrpyaxnclyohkbfp3h277ap4tiad.onion/
MAZE-NEWS: https://mazenews.online
NEFILIM: http://hxt254aygrsziejn.onion/
PYSA: http://wqmfzni2nvbbpk25.onion/partners.html
RAGNAR: http://p6o7m73ujalhgkiv.onion/
SEKHMET: http://sekhmetleaks.top/
SUNCRYPT: http://nbzzb6sa6xuura2z.onion/
PROLOCK: http://msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onionMOUNT LOCKER: http://mountnewsokhwilx.onion/
EGREGOR: http://egregoranrmzapcv.onion
LOCKBIT: http://lockbit-blog.com/
Spanish hacking group: hackingwpzhxqe3a.onion
another scam/fraud/malware forums from CIS region
darknet mirrors to fraud/malware/scam forums and such