Cybercriminals are operating in the open, not just trolling the dark web

While the dark web is a valuable tool for cybercriminals to conduct business, many other portions of the internet are leveraged for the same purpose. Cybercriminals use critical modern data networks to share information, collect data, and sell their wares, but there’s a lot more to it.

We monitored and broke down a cybercriminal’s activity, and found that they traversed the internet, deep web, and dark web nearly continuously throughout their day. Upon further investigation, we found the bulk of their time was spent on the internet (39%) and deep web (43%); just the remaining 18% was spent on the dark web.

Consider the three most common pillars of the criminal underground: dark web forums, messaging applications, and black market shops. It’s interesting to find that they operate relatively out in the open. These pillars span the networks but rely heavily on the deep web and dark web.

Forums include message boards in which cybercriminals share information, strategies, and tools. They also use these to market their wares to other users. This advertising may lead to discussions in messaging applications in order to work out business deals or focus on discussing additional, detailed tradecraft. It may also lead potential customers to black market shops to trade applications (malware), goods (data, credit cards, usernames/passwords, etc.), or other illicit content (i.e. drugs, contracts, etc.).

 

continue reading »