Originally built to guarantee anonymity and get around censorship, the dark web allows almost total freedom of expression and action. It is in this anonymous environment that hackers operate. Solid technical knowledge is no longer needed to carry out a cyberattack: you can now hire a hacker or follow a guide on a forum. Highly skilled hackers now work in groups, to reinforce their knowledge and their anonymity and to pool their resources.
Two kinds of hacker on the dark web
Browsing the dark web, we can observe the activity of black hats and of white hats alike.
A white hat is a hacker with an ethical code, as opposed to a black hat, who acts with malicious intent.
But not everything is black or white — some hackers are grey. They act differently from one case to the next, sometimes ethically and sometimes not, depending on the subjects that interest them or that they champion.
Whatever the colour of the hat, their presence shows up mainly as blogs about anonymity technology, or official sites for hacker conferences.
Examples of white hats
A genuine data economy
Over the past three years a genuine data economy has developed. The explosion in the number of data leaks is one of its main consequences, with phishing used as the compromise vector.
There are so many email addresses in circulation that phishing is now the most profitable technique for compromising an information system. Lone hackers obtain or buy entire databases of email addresses, then launch phishing campaigns or set up CEO fraud scenarios using targeted phishing.
Example of a sale of data from several countries
Hacker groups appear to be growing stronger over time on the dark web, and we are seeing real consolidation among them.
These groups hit targets, run sites dedicated to their activity, and present what they do as a communication weapon. The aim is to push the affected organisations into paying a ransom, or into making contact in order to stem the leak.
Site of the Suncrypt hacker group
Even among the malicious, though, not every hacker is in it for money. There are many mutual-aid forums listing hacking techniques and tutorials, offering various compromise methods through ready-made guides or off-the-shelf viruses.
Guides and tutorials offering various hacking techniques
As companies have gone digital in step with remote working, hackers have become steadily more commercial. Data is a valuable resource for every company and easily exploited by hackers, which is why reselling it, or reselling high-value services, has become one of their main activities on the dark web.
Some hackers carry out the attack themselves in order to resell the data; others aim only to harm a given organisation. The end is always the same: turning knowledge or information to account, for profit and for harm.
Individual resellers comb the forums offering data leaks for sale. Those leaks come from their own cyberattacks, or are simply data stolen from others as an easy way to make money. Alongside, they publish a sample or screenshots to prove the material is genuine.
This data is mostly email addresses, which can then be used to launch phishing campaigns.
Trade in stolen data is the product of black hat activity.
Extract from a forum reselling data leaks
There are also hackers for hire, offering cyberattacks on demand. The aim is to compromise a designated target using a chosen method.
We are seeing real growth in the services on offer, as we saw in our earlier article on ransomware as a service. Anyone can now call on a hacker’s services. It is difficult, however, to tell whether these platforms are scams or genuinely deliver.
Examples of cyberattack-on-demand services
We have dealt here mainly with the lucrative activities of black hats, but white hats are just as present, if less visible at first glance.