Dark Web Roast – August 2026 Edition

By Trellix Advanced Research Center · September 24, 2026

Executive Summary

August 2026 was another month where the underground did most of our investigative work for us, and this time it barely required a magnifying glass. The headline act was comedy_club on Exploit, a banned crypto-exchange ripper who answered his ban by cloning himself into ten-plus "independent" storefronts that somehow all shared one server, one Yandex.Metrica counter, and eighty-one identical wallets. Running an empire of trustworthy strangers gets tricky when every one of them rings the same doorbell.

Close behind came the CRPxO ransomware crew, who advertised a 217.8 MB data leak as 217.8 GB in the very same post, proving their marketing team and their calculator have never once been introduced. Rounding out the podium is actor Derian, who banned script reading in bold and then pasted the exact script two lines below it, which is the quality control you would expect from people impersonating quality control. Grab a strong coffee, because the rest of the month is just as generous.

This month in the DarkRoast

🏦 The comedy_club cinematic universe: One server, ten storefronts, zero shame

The star of August is comedy_club on Exploit, a crypto-exchange operator who earned the coveted red “КИДАЛА” (ripper) stamp and then decided the correct response to being banned was to franchise himself. Investigators allege he spun up ten-plus “independent” exchanges (RoboEx, Barbados, ComCASH, Secrex, MotoMix, etc.), all running on a single server, a single build manifest listing all seven brands’ code side by side, and eighty-one out of eighty-one identical wallets.

For a guy whose entire business model is pretending to be many different trustworthy people, he sure left every one of them sharing the same Yandex.Metrica counter (109328130) and the same Google verification string. When your “diversified portfolio” of scam sites all mail from the same IP address, you haven’t built an empire, you’ve built one house with ten doorbells. Truly the operational security of a man who reuses the same password for his bank and his fantasy football league.

💸 AccsGoat’s fire sale on the future

The AccsGoat bot (actor 959034 Gvd, Telegram channel EMAIL DATABASE) is selling aged Telegram accounts on a pricing curve that reads like a cursed vintage wine list—a 2014 account fetches $25, while a fresh 2026 account goes for a humiliating $1. Nothing says “your identity is worthless” quite like being marked down to less than a stick of gum the same year you were born. From an intel perspective, the real takeaway is that account-aging is now a speculative commodities market, and 2026 accounts are the penny stocks nobody wants. Buy low, get banned lower.

📞 A “Google Security Team” caller job ad bans script-reading, then hands you the exact script

Actor Derian (@crɑick) in the UK Fraudsters Telegram channel posted a “Hiring - Female/Male Mail Callers” ad demanding “USA/CA (white sounding)” applicants and, in bold, “NO SCRIPT READING.” Two lines later, the exact script is printed: “Good afternoon, this is [name] reaching you on behalf of the Google Account Security Team on a recorded line. Am I speaking with Larry Boyles?” The one hard requirement, “don’t read a script,” is immediately undermined by the script they literally paste for the applicant to read. The “recorded line” flourish is a nice touch, because nothing says legitimacy like a fraudster cosplaying compliance theatre. The pretexting playbook is depressingly effective, but the recruiter’s QA process is roughly as robust as the fake Google team it impersonates.

📉 CRPxO’s great unit conversion catastrophe

The ransomware crew behind CRPxO ran a busy August on their leak blog, publishing a whole conveyor belt of small-business victims with copy-pasted “we infiltrated their entire web infrastructure” boilerplate. The comedy peak was a leak post, where they solemnly claimed to have exfiltrated “217.8 MB of sensitive data,” then in the same post billed the leak volume as “217.8 GB”—a casual thousand-fold exaggeration that suggests their marketing department and their du -sh command aren’t on speaking terms. When your extortion empire can’t keep megabytes and gigabytes straight, buyers should probably audit the ransomware countdown timer too.

📝 Air Dark’s seed-phrase stealer confirms people genuinely keep crypto keys in Notepad

Posted across rootsploit by Air Dark for an asking price of $500, this seed-phrase harvester promises “maximum collection of passive users that store their passwords in regular Notepad files.” The scariest sentence in the whole listing isn’t the malware—it’s the confirmation that enough people are genuinely keeping their crypto wallet keys in a passwords.txt file to build an entire business model around it. Air Dark isn’t so much a hacker as a natural-selection service provider, and the weekly rescan feature is a thoughtful touch for the truly disorganized victim.

💸 A 38-reply money-laundering thesis defense gets settled by one guy and a laughing emoji

On the Exploit forum, actor 0xk2i resurrected a 38-reply thread that reads like a heist-themed group therapy session. Contributor crambler laid out an elaborate multi-hop laundering flowchart (BTC → mixer → new wallet → decentralised exchange → ETH → in-person cash) with the gravity of a man defending a dissertation.

0xk2i then breezily debunked the whole “XMR is hard to get without KYC” concern with the immortal line: “its not hard… you just use a no kycc swap site lol 😃”. A 38-post debate on optimal money-laundering routing, resolved by one guy and a laughing emoji, is a fitting portrait of the master strategists supposedly keeping ransomware crews up at night.

Conclusion

And so August wraps up right on brand, with the underground once again face-planting over its own shoelaces. Air Dark rolled out a $500 seed-phrase stealer built on the genuinely bleak realization that a shocking number of crypto holders still stash their wallet keys in a Notepad file, which makes him less of a hacker and more of a full-service natural selection provider. A 38-reply money-laundering masterclass that strutted around like it was defending a doctoral thesis got folded in half by one guy and a single laughing emoji. If this crowd poured even a fraction of that energy into operational security instead of haggling over decade-old Telegram accounts and combing Notepad files for seed phrases, we would actually have something to worry about.

Stay safe out there, and remember: if a shared tracking code, a stray Notepad file, or one well-placed emoji can bring down your entire empire, you never ran an operation. You ran a liability with a Telegram handle.

Disclaimer

While these incidents are genuinely amusing, they represent real criminal activities causing significant harm. This content is for threat intelligence and educational purposes only.

Discover the latest cybersecurity research from the Trellix Advanced Research Center.