The combination of an encrypted dark web links network hidden from the world and a transactional currency nearly impossible to track has created a marketplace of illicit activities. Drug dealing, arms trafficking, and the sharing of exploitative content—including child pornography and hit-men for hire—are commonplace.
But this criminality isn’t limited to dark web marketplaces. Hackers also spread sensitive information on the dark web, such as stolen credit card data and logins for corporate accounts.
Identity Theft
The dark web is a network of websites that aren’t accessible via normal browsers, making it easy for cybercriminals to steal your information and sell it on. The information they steal can include your name, address, online logins and passwords, Social Security number, driver’s license and passport numbers, and more. Identity thieves can also hack your personal devices and use the information they gather to commit other crimes.
Cyberattacks often begin with fraudulent emails or texts that appear to come from a legitimate source. The links in these messages can lead to malware that mines your device for personal information, exposing your passwords and capturing keystrokes. Malware can also send your personal information to the attacker’s computer or even lock your device until you pay a ransom.
Criminals can also buy and sell leaked data on the dark web. The information that is sold can range from stolen credit card information to bank account logins and even employee data dumps. This type of activity is known as “data breaches.”
Many state and local law enforcement agencies are unaware that illicit activities take place on the dark web, and some don’t have resources or expertise to monitor it. The dark web’s anonymity makes it difficult to find and identify suspects and evidence. The RAND workshop participants identified a need for command buy-in and additional training to help authorities understand how to discover and investigate dark web crime.
Illegal drug sales and counterfeit goods are common on the dark web, as are extortion and blackmail scams. The dark web’s obscurity also enables other illegal activities such as murder for hire, blueprint distribution, child pornography and human trafficking.
Ransomware
The dark web isn’t indexed by regular search engines and allows users to buy and sell a variety of contraband goods. This marketplace uses anonymizing technology and bitcoin to hide illegal transactions from authorities. It’s a place for criminals to trade opioids and other drugs, bomb parts, weapons large and small, social security numbers, body parts and even crime acts for hire. It’s also where criminals sell malware.
One of the most dangerous crimes perpetrated on the dark web is ransomware, a malicious software that encrypts a victim’s files and demands a ransom in exchange for the decryption key. It can also delete backup files, so organizations cannot restore their data if they fail to pay the attackers’ demanded sum.
A new form of ransomware called Ryuk emerged in 2018 and targeted news sites and North Carolina’s Onslow Water and Sewer Authority, among others. It targets systems infected with Emotet or TrickBot, information stealing Trojans, and then re-infects them with ransomware. According to a workshop report, the malware is sold on the dark web by cybercriminals as part of a kit that includes instructions for infecting and operating the malware.
Unlike traditional ransomware that only encrypts files, the newer version of the malware encrypts database, website, office, video, image, script and text files as well. It also encrypts virtual desktop files and CAD files, making it difficult for victims to recover their data without paying the criminals.
Law enforcement agencies are struggling to deal with the rise of dark web-based crime. In addition to raising awareness of the issue, they’re implementing more training for officers and investigators to help them spot relevant dark web evidence. They’re also improving information-sharing and building cross-organizational structures for cooperation.
Fraud
The dark web allows criminals to sell stolen personal information at scale, including username-password combinations that can be used for identity theft. These types of fraudulent activities can have devastating consequences for individuals and businesses. Criminals can use stolen data to buy flat-screen TVs and computers, apply for loans, make unauthorized charges on credit cards or even withdraw money from bank accounts. They can also disrupt an organization’s operations by hacking into business email accounts, stealing intellectual property and selling it to competitors or extort the company by holding its systems hostage until a ransom is paid.
In addition to the products, the dark web hosts a variety of services that support the various stages of cybercriminal activity. For example, a workshop report on dark web activities noted that a significant number of sites offer malware kits to enable attackers to conduct large-scale attacks. These kits typically include phishing emails, social engineering techniques and other tools to gather the data needed to steal a person’s information or money.
Other activities taking place on the dark web include child pornography, illegal firearms sales, sex trafficking and other illicit drug sales. Workshop participants at a police executive research forum noted that narcotics cases involving the dark web had spiked and that online crime in general is growing rapidly.
While there are efforts to shut down dark web marketplaces, they can be quickly replaced with new sites that offer the same level of anonymity. In the meantime, people can help reduce their risk of becoming victims of these crimes by safeguarding passwords and other sensitive information. One way to do this is by using multi-factor authentication (MFA) when accessing any account that contains sensitive information such as a banking or social media profile.
Exploit Kits
A cybercriminal can use an exploit kit to exploit vulnerabilities in software and then download malware or perform other malicious activities. These kits are crimeware that their makers sell or rent out on hacker forums. They are often used to distribute ransomware, adware, phishing scams and cryptomining malware.
The popularity of these kits has risen in recent years due to their “crimeware-as-a-service” business model. This model allows inexperienced attackers to access and use these tools without having to develop their own infrastructure. The kits also provide a wide range of features to help attackers launch attacks with little or no technical knowledge.
For example, the kit can include a management console and several different vulnerabilities targeted at many different applications, including Adobe Flash, Java, and Microsoft products. These kits are usually sold on underground hacker marketplaces for a relatively low price. Once an attacker pays the required fee, they are given a username and password that grants them access to the server where the kit is hosted.
After they log in, they are redirected to a landing page that checks whether their target meets certain criteria. For example, the page may filter out victims who do not belong to a specific country by using geolocation. It then determines if the victim is running any vulnerable browser-based applications, and if so, the attack proceeds.
Exploit kits also feature a variety of innovative obfuscation techniques. These techniques allow attackers to hide their tracks and prevent law enforcement from tracking them down. As a result, they are able to keep their activities going despite successful efforts by authorities to shut them down. This is why it's so important to work with a lawyer who has experience handling Dark Web cases.
Human Trafficking
Traffickers exploit victims for sexual exploitation, forced labor or both. Their business is highly lucrative with $150 billion in annual sales, making it the second most profitable crime after drugs. Traffickers use the internet to find and target potential victims. They post ads on popular websites that provide access to people's personal information and locations, including social media sites and online dating platforms. They can then sell photos and videos of victims' exploitation to customers worldwide.
Many of these crimes are facilitated by the Dark Web, which allows criminals to avoid law enforcement and hide their activities. The large number of darknet marketplaces makes it difficult for law enforcement to police them all. As a result, there are new major marketplaces that crop up regularly. These marketplaces offer an ever-increasing array of malicious services and activities. NIJ recently sponsored a workshop to identify law enforcement's primary dark web challenges and to develop tools that can assist them in policing this growing threat.
Participants in the workshop prioritized needs and established high-priority areas for action. These areas include increased awareness of the dark web, improved collaboration with criminal justice partners and new technology tools to support investigations. The workshop also discussed ways to expand the use of social media for victim identification and assistance, as well as a need to improve the collection of data on human trafficking.
Victims of human trafficking come from every race and ethnicity and can be adults or children. Risk factors for trafficking include economic hardship, recent migration or relocation, substance use and mental health issues. People with disabilities and those involved with child welfare are also at greater risk. Traffickers coerce and exploit victims by promising them jobs in the U.S., where the work conditions are much worse than those in their home countries. In addition, traffickers manipulate debts through the practice known as “debt bondage.” For example, they tell victims they have to assume debts for travel and shelter costs and then require them to work to pay those debts off.
