The Darknet Trends 2024 – AVANTEC Tec-Bite IT-Security Blog

About the job

The Dark Web continues to gain momentum among cybercriminals. Serdar Günal Rütsche, head of the Cybercrime department at the Zurich Cantonal Police, also knows how complex investigative work in the Darknet is. I wanted to find out for myself where the criminal ecosystem around the trade in malware services is heading, what trends are emerging on the marketplaces, and what risks this dynamic poses for companies. In recent weeks, I ventured into the forums of the Onion network. On the one hand, I was interested in what is currently being discussed in hacker forums; on the other hand, I wanted to find out how easy it has become to obtain and offer curious or dangerous services from the Darknet.

The acid test

I start the modified Firefox browser. My first stop is still "The Hidden Wiki": a very long directory of links to access various Darknet sites. Not all links, as is well known, lead to the target. Worryingly, the Dark Web site "Rent-A-Hacker," which has existed for what feels like ten years, still exists today. The service offering has just shifted a little: while a few years ago hacking email and Facebook accounts for a few hundred euros was the focus, more and more cybercriminals in the forums now like to advertise their good social engineering skills, which a script kiddie could basically book as an "all-in-one package" for a few hundred dollars for a very specific target.

Newer marketplaces for drugs and malware also want to gain users' trust with increasing security and faster servers. Source: Darknet

The business model "as a Service"

Compromised PayPal accounts seem to be particularly trending again lately. Whether session cookies or a combination with an additional trojan: offers to compromise ten PayPal accounts worth between 250 and 500 dollars each are already circulating from 150 dollars in a Darknet marketplace. Payment is then made in cryptocurrencies, for example Bitcoin. The criminal "as-a-service" model is even enriched in some cases with services such as additional dashboards including information on payment amounts and successful attacks. The appropriate ransomware-as-a-service package can thus also be individually configured by beginners without much prior knowledge.

Side note: I notice that on more and more marketplaces in the Darknet, sellers and buyers can leave extensive reviews of the offers. This assumption is also confirmed by a Darkweb security report from HP, according to which 92 percent of all marketplaces now even have some kind of dispute resolution service support.

Besides the small static Tor websites, there are many discussion forums in the dark chamber of the internet. One example is a "Reddit"-like forum called "Dread," which probably counts around 12,000 users. Professional hacking guides as well as announcements or closures of marketplaces are discussed. In addition to very detailed instructions on zero-day exploits under Windows, the transport of illegal drugs is negotiated in the registration-based forum.

There are also country-specific forums such as "XSS," where, as the name suggests, it is about cross-site scripting and web vulnerabilities. The forum aims to offer exploits, zero-day vulnerabilities, and credential databases for sale. Various ransomware groups also specifically look out for certain skills of individual developers.

In general, it can be said that at least three main cyber threats roam the Dark Web:

Asset and identity theft: Hackers still mainly sell stolen access data on Dark Web marketplaces to profit from their efforts. Security vulnerabilities can be exploited for financial purposes, political or corporate espionage, or theft of intellectual property.

Remote Access Trojans (RAT) are regularly discussed in underground forums. Anonymity gives hacker groups the freedom to plan several potential targets or to look for new malware writers for a "task".

Zero-day vulnerabilities and unpatched web applications: Vulnerabilities in web applications and other online services are among the most common threats exploited by attackers for various purposes.

Complex police investigations

"The law enforcement authorities in Switzerland have limited resources that can be deployed specifically according to priorities and focus areas," says Serdar Günal Rütsche, head of the Cybercrime department at the Zurich Cantonal Police, when asked to what extent undercover work in pursuing ransomware gangs is even possible compared to other offences in the Darknet. Several criminal proceedings are conducted annually against ransomware groups, paedophiles, and drug dealers.

Investigations involving various anonymisation options are often very elaborate and complex, according to the Cantonal Police. While they are able to respond to all incidents at any time with appropriate measures, this requires constant development of investigative methods and a high willingness to cooperate from law enforcement agencies operating worldwide.

Nevertheless, law enforcement agencies repeatedly succeed in dismantling gang networks. For example, the Darknet platform Kingdom Market, which hosted over 42,000 criminal offers, was recently successfully shut down.

What Darknet trends are expected in 2024?

Cybercrime as a product or service is clearly trending. The "as-a-service" model with entire service packages for specific targets is gaining momentum, much like in the legitimate business world. For script kiddies, it is always "safer" to first acquire access through already existing hacking services rather than leaving traces themselves.

The range of criminal services in the Dark Web is generally growing. A sample showed that about nine out of ten of the advertised well-known exploits on the dark marketplaces are already sold for less than ten US dollars, while prices for exploits (not yet public) can amount to several thousand US dollars.

Security analysts from Check Point found more AI chatbots based on large language models (LLM), such as those used in ChatGPT, in the Dark Web last year. For example, WormGPT specialises in AI-driven phishing, especially business email compromise. Another example is FraudGPT, an AI-driven chatbot that aims to entice users to disclose confidential information for a few hundred dollars per month.

There may possibly be an increase in various Darknet empires from other countries like "XSS." The Russian cybercrime syndicate "Hydra" alone, before it was taken down in April 2022, accounted for 80 percent of all cryptocurrencies with a net worth of over 5.2 billion US dollars, according to estimates by the US Department of Justice.

Increasingly trending: social engineering offers, even in well-known older hacker forums (Source: Darknet)

Conclusion

Given the increasing specialisation of services in the Darknet, responsible handling of personal data and accounts and multi-factor authentication is recommended. This is especially true for securing remote access such as VPN (RDP), Citrix, but also contractors and suppliers. Systems or software that are EOL should be shut down, renewed, or placed in separate network segments. To counter increasingly professional cybercrime, a combination of various security measures is required, such as mail security, network segmentation, EDR (or XDR), vulnerability management, and pentesting.

Continuous scanning of the Dark Web for company-relevant data such as email domains, public IP addresses, or credit card details can be ensured for companies with particularly risky data through Dark Web monitoring services. Such a service detects leaks early via ransomware incidents and searches Dark Web forums, onion sites, as well as database and cloud links for suspicious information. For example, a stolen credit card can be blocked early enough. In addition, such services sometimes also identify letters of imitated company domains.

Further links
www.avantec.ch/services/cyber-defense-center
www.avantec.ch/loesungen/avantec-newcomers
www.tec-bite.ch/windows-forensik-goldschuerfen-im-digitalen-raum
www.tec-bite.ch/erhoehung-der-cyber-resilience-cybersecurity-vorfaelle-richtig-trainieren
www.tec-bite.ch/die-herausforderungen-bei-einem-siem

The article The Darknet Trends 2024 first appeared on Tec-Bite.