New Underground Forum

The past weeks have been turbulent for the underground scene. XSS — one of the long-standing forums — shut down unexpectedly (with a resurfaced onion link). BreachForums, already operating under pressure, suffered a compromise that shook its user base. And now a new forum has quietly emerged in early August, attempting to pull in members from the fallout.

EPCYBER actively monitored this forum since its early development stage, and moves like this aren't random.

When established hubs collapse or get breached, the community splinters.

Some actors vanish, others regroup, and new spaces appear almost overnight. These shifts open windows of opportunity — for both threat actors looking to reestablish networks and analysts tracking them. If your role in cyber threat intelligence relies on knowing where discussions, leaks, and criminal markets are moving, you can't afford to find out late. The ability to spot and assess these emerging sources before they become widely known is what separates reactive monitoring from proactive intelligence.

What we teach

If you want to learn how to identify new dark web sources and strengthen your CTI capabilities, our Dark Web Advanced course gives you the skills to find new forums, marketplaces, closed communities, and threat-actor networks — resources most analysts never even know exist. You'll learn how to pivot between platforms like Telegram, .onion sites, and hidden marketplaces, building a cross-platform strategy that keeps you ahead of threats.

Our training is 100% manual — no reliance on automated tools. Why? Because automation misses the most important data. Tools are often outdated, incomplete, or simply miss what matters. Real intelligence comes from real research: smart searching, pivoting across sources, and understanding how these hidden ecosystems work.

Every new source is a potential intelligence multiplier. The ability to find them before everyone else is the whole game.