Know your enemy: shining a light on the dark web

Earlier this year, law enforcement from the US, UK, Germany, Australia, Denmark and Moldova completed a successful operation against DarkMarket, the world's largest illegal marketplace on the dark web.DarkMarket had almost half a million unique users, more than 2,000 vendors and a history of more than 300,000 illegal transactions. Officers estimate that more than 4,650 bitcoin and 12,800 monero transferred through it during its lifetime – that’s around £125 million.Products sold on DarkMarket include drugs and counterfeit money, stolen or counterfeit credit card details, anonymous SIM cards and malware.This is an online marketplace, accessible only with specialist software. It won’t show on a search engine. This is the dark web and, more specifically, the Crime-as-a-Service (CaaS) business model.Cracking CasSCaaS is essentially the replication of the legitimate economy on an illicit platform. The digital underground has expanded along with the explosion of the internet itself. Crucially, these marketplaces are not limited to cyber tools – drugs, weapons and firearms, along with any other criminal commodity are also prevalent. The dark web provides an anonymous setting.A recent report in the journal Nature examined the dynamics of dark web markets and found currently there are at least 38 identified active dark marketplaces. The most well known is Silk Road, removed from operation in October 2013, and its successor Silk Road 2.0, taken down in 2018. Europol has compiled a series of in-depth research reports on the evolution of this phenomena. They assess the digital underground has evolved and matured from a few small groups hacking and phreaking for fun and prestige, to a thriving criminal industry that costs global economies $300 billion annually.The digital underground is highly fragmented, participants range from fledgling cybercriminal to sophisticated criminal groups. These websites and forums are market places and hubs where supply and demand meet for a place to advertise, buy and sell products and services, network and share experience and expertise. Sharing is hurtingThe pooling of knowledge has two main impacts, the first is that the networking furthers innovation and enhances criminal research and development into new attack vectors and methodologies. Secondly, the ease of availability and the anonymity of purchase has created a booming as-a-service industry, where criminals monetise skills and create broader access to crimes that used to require exceptional abilities.“It is relatively easy for cybercrime initiates – those lacking the experience and technical skills – to launch cyber attacks not only of a scale highly disproportionate to their ability but for a price similarly disproportionate to the potential damage,” said Europol’s most recent Internet Organised Crime Threat Assessment (IOCTA).This is a particularly worrying trend, as a simple bitcoin purchase can give a curious teenage hacker the tools to break into an international institution.Back into the coldGiven the allegations that surrounded Moscow’s potential interference into recent western democracies and the subsequent confirmation of the existence of a sophisticated disinformation network, it is no surprise that some of the most prevalent cybercrime forums are of Russian origin.Europol reports one Russian language carding (credit card cloning) forum with over 13,000 members and almost 4,000 daily visitors had more than 20 subforums covering topics such as online security, tutorials, carding, botnets, web design and money laundering. Across the forum there were in excess of 75,000 individual discussion topics.A further worry is the pace of evolution, since their first appearance in the early 2000s these entities have matured in sophistication, both in the expertise and range of products available and the level of professionalism and operational security.Director of the human cybercriminal project at Oxford University, Jonathan Lusthaus, writes that these markets are a mirror of licit business, allowing the creation of an organised set of criminal relationships, with individuals carrying out short-term specialist ‘project’ work for a limited period, acting much like legitimate consultants. So what can we do?!The dark web isn’t going away, and there’s even a legitimate argument that suggests it’s morally wrong to wish it away; it has become an outlet for those suffering state-wide oppression.From a technical perspective, as many authoritarian regimes have found, blocking access to the browsers, such as TOR, which help gain entry to the dark web is ineffective as people simply download another once one is blocked.Awareness is the key point. Knowing the level of the threat ensures you can prepare for its arrival on your doorstep and given what we know about the increasing levels of cybercrime and the increased targeting of businesses, it’s not a hyperbole to say that threat will appear on your company’s horizon sooner rather than later.

Your cyber intelligence source

Know your enemy: shining a light on the dark web

Related content

The Case For Automated Network Security Policy Management

OpenAI Fined Over GDPR Failings

Out of Band Patches Released by Adobe Vulnerability

API Flaw Saw McDonald's Driver and Customer Information Vulnerable

LLM Could Generate Thousands of Malware Variants

The Interrelationship Between Cybersecurity and Business Resilience: A New Policy Imperative

Phishing Messages Used DocuSign as a Lure

Upcoming Events

Know your enemy: shining a light on the dark web

Related content

The Case For Automated Network Security Policy Management

OpenAI Fined Over GDPR Failings

Out of Band Patches Released by Adobe Vulnerability

API Flaw Saw McDonald's Driver and Customer Information Vulnerable

LLM Could Generate Thousands of Malware Variants

The Interrelationship Between Cybersecurity and Business Resilience: A New Policy Imperative

Phishing Messages Used DocuSign as a Lure

Upcoming Events

Confirm cancellation

Sign up benefits