Cybercrime and Dark Web Markets

The dark web is an underground part of the internet that operates using specialized anonymity tools and provides a platform for illicit products and services. These include drugs, counterfeit money, weapons and hacking tools and services. The first dark web market was the Silk Road, created in 2011 by Ross Ulbricht. It was the model for many of the current dark marketplaces. While the original Silk Road had some listings that weren’t illegal, most were, and Ulbricht was eventually arrested and all of the marketplace sites closed down. Since then, dozens of dark marketplaces have emerged.

While it is difficult to quantify dark marketplace sales because cryptocurrency transactions are anonymous, a recent study shows that dark marketplaces continue to grow in size and revenue. This is fueled by the popularity of cryptocurrencies such as Bitcoin, which enables marketplace participants to buy and sell goods and services without knowing their identity. The most popular products sold on these markets are recreational and pharmaceutical drugs, stolen and counterfeit documents such as identities, credit cards, bank accounts and passwords, and hacking and cybercrime services like malware and distributed denial of service attacks.

As cybercrime and nefarious activities continue to grow on the dark web, law enforcement agencies have made it their mission to disrupt these marketplaces. They use a variety of investigative techniques to identify dark web marketplaces and take them down. Operation Onymous, a 2014 operation involving 17 countries, resulted in the shut down of many dark marketplaces, including Silk Road 2.0 and Hydra.

These operations often Dark web markets include identifying nefarious vendors and the financial infrastructure of these markets. Blockchain intelligence tools can help identify the counterparties and cashout points used by DNM proprietors, allowing authorities to potentially trace their virtual currency holdings, infrastructure and locations. This allows them to disrupt the sites, seize residual virtual currency, and prosecute nefarious operators.

Other efforts to address these illicit marketplaces include regulating the cryptocurrencies that are used by them. For example, the FATF has issued guidance that urges financial institutions to identify the sender and recipient of cryptocurrency transfers in order to comply with anti-money laundering regulations. These regulations are intended to prevent the use of cryptocurrencies to facilitate the financing of terrorism and other nefarious activities.

Another way to address these illicit marketplaces is through targeted disruption operations, which bring together multiple government agencies and private sector partners. This type of joint operation involves identifying high-value targets, collecting and sharing relevant information about them, and then executing an attack against the target site to disable it. In the case of DNMs, this can include taking down a website and seizing its virtual currency and associated infrastructure. The goal is to disrupt the marketplace and prevent it from reopening under a different name. As a result, these operations are effective at stopping nefarious activity on the dark web.