Dark web marketplaces aren't the hacker hotbeds they used to be

Drugs, not malware, are the most popular items sold on dark web markets.

Wannabe cybercriminals no longer are relying on dark web marketplaces to buy and sell their hacking tools, it seems.

The selection and prices of malicious software offerings on well known dark web markets has remained mostly unchanged since 2017, according to findings published Tuesday by the risk intelligence firm Flashpoint.

The mostly stagnant prices on these forums, which are most frequently used to buy and sell narcotics, is the latest proof that, even as cybercriminals continue to harass victims, skilled hackers are moving to more private channels to trade the most valuable techniques, suggested Ian Gray, Flashpoint’s director of analysis and research. The quality of the tools, like commodity malware and distributed denial-of-service rental services, also has remained steady, even as defenses have improved.

“There’s a lack of innovation we’re seeing in the kinds of goods and on the marketplaces,” Gray said. “It might be an indication they’re looking at more trusted cybercrime marketplaces.”

Flashpoint over the past two years examined sites including Dream Market, Wall Street Market, Nightmare, and others, most of which are now offline. DDoS attack services ranged in price from $1 to $100, up from the $27 it would have cost wannabe attackers in 2017 (one ad promising to DDoS any site charged $250). Meanwhile prices for exploit kits, the automated attack technique that first compromises a target site, has kept “relatively stagnant” at up to $100, $700 or $2,000 for daily, weekly, or monthly rentals, respectively.

Compare the use of these low-level hacking tools, typically used to cheat at online games or harass specific individuals, with emerging techniques, like the Ryuk ransomware or Magecart payment skimmers.

“A lot of the services here are baseline commodity services,” Gray said. “A large number of threat actors might sell them as services, and then the value goes down.”

Flashpoint’s research period coincided with a hectic time for dark web markets. Earlier this year, international law enforcement agencies shut down Wall Street Market and Valhalla. Administrators of Dream Market, which specialized in selling drugs and stolen personal information, announced in March they would shut down that site, among other activities.

Those incidents, and prior shutdowns like them, mostly affected the online drug market, as CyberScoop reported at the time. Other hacker-specific sites, like Exploit.in, continued to persist, requiring new users to demonstrate their ability to participate in criminal activity or earn an invitation to join.

Now that trend away from open dark web forums is poised to continue, Gray predicted, even if it means forum reviews will help buyers determine if they can trust sellers.

“One way to moving to encrypted chat applications,” he said. “You have a similar messaging experience but you don’t have the trust, or a way to check the credibility…I’ve seen some examples of that, but people haven’t gone there wholesale.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure