Trends in Security

visible on larger screens only

Please expand your browser window.
Or enjoy this interactive application on your desktop or laptop.

Victim

Few Major Changes in the Dark Web threat landscape

With regard to the Dark Web, EU law enforcement agencies have reported few major changes in the threat landscape. While the infrastructure of Dark Web marketplaces has not changed drastically, several smaller developments that had already been taking place for some years have now become more commonplace

More source info

5.1 Similar goods and services, but more extortion and novel weapons

The types of goods and services for sale on the Dark Web have remained largely the same in the past 12 months. However, the presence of ransomware groups on dedicated hidden services on the Dark Web offering their malware ‘as-a-service’ has increased.

In last year’s IOCTA, Europol included the development of perpetrators threatening to sell or wipe data encrypted in a ransomware attack. Several countries reported that the exposure of data of individuals and companies had gained further traction as a business model for ransomware groups on the Dark Web. Governments have expressed similar warnings about such advanced extortion concerning ransomware groups that not only encrypted data, but also threatened to use DDoS attacks and leak stolen data if ransoms were not paid.

Weapons appear to be traded increasingly on encrypted chat applications, such as Telegram and Wickr, but sold slightly less on Dark Web marketplaces.

Furthermore, weapons were being sold on a Dark Web marketplace taken down in May 2021 by French authorities. InSeptember 2020, an illegal workshop for printing three-dimensional weapons was dismantled in Spain, revealing a novel modus operandi. The suspect downloaded templates for weapons printing from

the Dark Web.

Furthermore, vendors have not stopped seizing the opportunity to abuse the uncertainty surrounding the pandemic by offering fake vaccines and masks for sale, consequently scamming buyers.

5.2 More use of Monero and non-cooperative swapping services

Bitcoin has by far remained the go-to cryptocurrency of choice for users of the Dark Web. However, the criminal usage of privacy coin Monero on Dark Web marketplaces has further increased. As reported last year, Monero is becoming the most established privacy coin on the Dark Web. For example, a marketplace that only accepts Monero as a payment option was around from early 2019 to October 2021. Zcash was also seen as a payment option, but its usage has not come close to Monero. While criminals still make most payments in Bitcoin, recipients are increasingly converting them to Monero and other currencies by using swapping services. These services often operate on the Clearnet and in a grey area, utilising jurisdictions with lenient legislation and vague or non-existent know-your-customer (KYC) procedures. Some other services, such as Kilos3, are

operating on the Dark Web and even admit to ‘skirting legal procedures’. Kilos was already mentioned in last year’s IOCTA, but now it also deploys its own swapper and mixer, called ‘KSwap’ and ‘Krumble’ respectively.

The use of swappers falls within a bigger trend of adopting more complex money laundering methods. In the early days of Dark Web marketplaces, vendors often simply transferred cryptocurrency directly from a marketplace to an exchange. However, in the last few years, many different obfuscation methods have gained popularity, such as mixers, CoinJoin, swapping, crypto debit cards, Bitcoin ATMs, local trade and more.

Date Trend snippet:

21 December 2021

Relevance date:

2020, 2021

Type of Treath or Oppertunity

Money laundering, Malware & antivirus, Dark Web, (Cyber)crime as a service

Domain of application

General public, households

Source of threat

Organised crime groups (OCG's), Adult criminals

Victim

Private citizens, Public organisations (including employees), SME's (including employees), Large corporations (including employees)