Darkroom by Flare Academy

See the dark web the way Flare does.

A free, hands-on training lab from Flare Academy. Spend four hours inside a fully-simulated underground, earn a Flare Academy certification, then put it all on the line in a live CTF during DEFCON week.
Join the Flare Discord to start
Free course · Free certification · Free CTF
darkroom_lab
Dark web terminal mockup
forum xss.is · new IAB listing — access for sale
stealer lummac2 log ingested · 1,204 creds
alert breach in progress — triage now
Why Darkroom

Most defenders never actually see it.

You read the summary reports. You see the redacted screenshots. You read the post-mortems written long after the dust settled. Darkroom is different — it drops you into the underground while it's still moving, so you learn how threat actors really operate, not how they get described after the fact.
No other vendor opens the room like this. We're confident enough to teach it.
— Flare Academy
intel_brief.pdf REDACTED
actor = blackvortex_raas
access via lummac2 stealer log
forum xss.is · escrow held · 4.2 BTC
target = okta tenant · 2,041 creds
attribution confidence: high
Most reports stop at the redaction. Darkroom doesn't.
The training

Four hours inside a working underground.

Darkroom is a fully-simulated dark web built for the classroom — live forums, real breach pressure, and threat actors who push back. You don't watch a walkthrough. You work it.

Work the forums

Investigate live threads — IAB listings, RaaS recruitment, and underground escrow across XSS and Exploit.
thread://xss.is · access-broker board
NEWcorp access — RDP, 2k endpoints· escrow

Mine the stealer logs

Dig through archives modeled on LummaC2 output — combo lists, anti-detect fingerprints, the credential supply chain end to end.
lummac2 ingest → creds:

Run the breach console

Triage a breach on the alert console as it unfolds, and prioritize by blast radius before it completes.
ALERT credential reuse → admin blast: high

Negotiate with the actors

Go undercover against AI-driven personas that behave like the operators behind BlackVortex RaaS.
you: looking for corp access, EU region
BlackVortex
50% split. CIS targets are off-limits.
What you'll learn

Seven domains of the underground.

Everything in Darkroom maps to what Flare navigates every day. Clear the room and you walk away understanding all seven — then certify.
Flare Logo
Dark web
Credentials
Ransomware
Crypto
Attribution
Pre-breach
Tradecraft
Domain
What you'll understand after completing REC
01 Dark web intelligence
Forum tiers IAB listings RaaS mechanics Underground escrow Telegram channels
02 Credential supply chain
MaaS vendors Stealer-log distribution Combo lists Anti-detect browsers
03 Ransomware economy
Commission structures CIS exclusion rules Affiliate enforcement Builder analysis
04 Cryptocurrency forensics
CoinJoin fingerprinting Cross-chain pivoting Laundering-pipeline reconstruction
05 Actor attribution
Cross-source identifier chaining Confidence-graded attribution Infrastructure fingerprinting
06 Pre-breach intelligence
Intervening before breach completion Stealer-log blast-radius prioritization
07 Criminal tradecraft
Undercover negotiation Telegram ops Russian-language forum engagement

Pass the assessment and earn a Flare Academy certification — free, and yours to keep.

The path

Train now. Compete live in August.

PHASE 01 · JULY
Open courses — train & certify
PHASE 02 · AUG 6
Live CTF at DEFCON week
STEP 01

Join & enroll

Verify in the Flare Discord, free.

STEP 02

Train the 7 domains

Four hours in the simulated underground.

STEP 03

Earn the cert

Pass the assessment, keep the credential.

AUG 6

Compete live

Bring it to the Darkroom CTF.

LIVE · THU AUG 6 · DEFCON WEEK

Then comes the live run.

On Thursday, August 6, Darkroom goes live as a CTF during DEFCON week — the same simulated underground, real-time pressure, the whole community in the room.
The title of Flare's second Hacker Week CTF champion
A "God"-tier badge in the Flare Discord
Exclusive community prizes
Free to enter - you need to be in the Discord.
Darkroom CTF
Who it's for

Built for the people who work the problem.

Practitioners & analysts

Hands-on time inside the underground you defend against every day.

✓ Module 01
✓ Module 04
✓ Certified

Students & career-switchers

A real entry point into CTI, with a credential and no cost barrier.

Flare customers

See the depth behind the platform you already trust.

Partners

Speak to Flare's technical edge from first-hand experience.

Get in

Discord is the only door in.

Everything lives in the Flare community — so getting started and staying part of it are the same move.
STEP 01

Join the Flare Discord

Sign up and become a verified, free member.

STEP 02

Get verified

Unlocks the Darkroom lab, the course, and the CTF.

STEP 03

Enter the Darkroom

Work the underground at your own pace.

AUG 6

Certify & compete

Earn your cert, then bring it to the Aug 6 CTF.

Join the Flare Discord to start
Free, always — the course, the community, and the CTF.
FAQ

Before you go in.

Yes. The course, the community, and the CTF all cost nothing. Darkroom is how Flare invests in the practitioner community.

No. Darkroom is a community initiative that lives in the Flare Discord, separate from the Flare platform.

No. It’s a free, complementary community tool.

Yes. Pass the assessment and earn a Flare Academy certification.

The hands-on lab runs about four hours, at your own pace.

It runs live during DEFCON week. Format and how to take part drop in the Discord closer to the date.

See you in the room

The room's open.

Start the course free, get verified, and compete live on August 6.
Join the Flare Discord to start