Partnership advances Silobreaker’s data, offering enriched monitoring of deep, dark web and dark web adjacent sites to help identify risk at scale and drive better decision-making.
Silobreaker, a leading security and threat intelligence technology company, and DarkOwl, the leading provider of darknet data, are thrilled to announce their partnership. This collaboration will allow Silobreaker to integrate DarkOwl’s unmatched darknet data for credential monitoring. DarkOwl’s darknet monitoring continuously checks for exposed credentials in the darknet and darknet-adjacent sites, allowing Silobreaker to provide their customers with detailed alerting and analytics within a single platform.
Credential exposure can lead to significant reputational damage and financial losses, meaning that swift detection and response is crucial to minimizing the risks of credential misuse. Silobreaker’s credential monitoring product focuses on customers’ email domains, and checks deep and dark web sources, paste sites, data dumps and shared username/password lists on platforms like Telegram and Discord for exposure. Upon discovery, leaked credentials are made available to customers within the Silobreaker platform automatically, including details on when and where exposure took place and whether attached passwords are also found.
Due to its inherently anonymous and privacy-centric nature, the darknet facilitates a complex ecosystem of cybercrime and illicit goods and services trade. An extensive amount of sensitive information is available for download on the darknet and deep web, ranging in prices.The vast majority of cases result in hackers gaining illicit access to user accounts and either exploiting them for financial gain or using them to pivot into corporate network access to carry out more large-scale attacks.
“Detecting and triaging exposed credentials quickly and with minimum manual effort is crucial – the longer credentials are exposed, the greater the risk of compromise. Our latest integration with DarkOwl expands our eco system of data partners and provides customers with a cost-efficient, structured, and enhanced approach to credential monitoring,” said Kristofer Mansson, CEO, Silobreaker. “And with DarkOwl’s results seamlessly integrated into Silobreaker in alerts and visualized on searchable dashboards, security teams are equipped with the visibility they need to identify exposed credentials faster and more effectively.” DarkOwl CEO, Mark Turnage, added, “This collaboration aligns perfectly with our mission of empowering organizations with the most comprehensive cybersecurity solutions. Silobreaker is forward-thinking in incorporating darknet data into their solutions and we are delighted to be that provider as credential theft is surely to be a top threat in 2024.”
The addition of DarkOwl’s credential monitoring capabilities into Silobreaker provides organizations with an even broader, more comprehensive view of potential threats. This enables businesses to identify risks at scale before they escalate into critical incidents. It also drives better decision-making to prioritize resources most effectively and mitigate risk.
About Silobreaker Silobreaker is a leading security and threat intelligence technology company, that provides powerful insights on emerging risks and opportunities in real-time. It automates the collection, aggregation, accurate analysis, and dissemination of data from open and dark web sources in a single platform, so intelligence teams can produce high-quality, actionable reports in line with priority intelligence requirements (PIRs). This enables global enterprises to make intelligence-led decisions to safeguard their business from cyber, physical, and geopolitical threats, mitigate risks and maximise business value. Learn more at www.silobreaker.com.
About DarkOwl DarkOwl is the industry’s leading provider of darknet data. We offer the world’s largest commercially available database of information collected from the darknet. Using machine learning and human analysts, we automatically, continuously, and anonymously collect and index darknet, deep web, and high-risk surface net data. Our platform collects and stores data in near real-time, allowing darknet sites that frequently change location and availability to be queried in a safe and secure manner without having to access the darknet itself. Customers are able to turn this data into a powerful tool to identify risk at scale and drive better decision making. For more information, contact us.
Like the years before it, 2023 was busy in cyber security and the dark web with many attacks, emerging threats, and law enforcement activity. As technology becomes more and more entwined with our daily lives, the vectors for attack and the threats in the cyber realm increase, whether on a personal or corporate level everyone needs to be aware of emerging threats and how they can best protect themselves. As we enter 2024 it is important to be aware of what we are likely to face.
In this blog, DarkOwl analysts take a look at what we saw emerge in 2023 and review the most persistent threats which are likely to continue, grow in sophistication and make an impact in 2024.
Dark Web Activity
During 2023 on the dark web several marketplaces were taken down by law enforcement action and several threat actors arrested. However, new markets and actors emerged to take their place. When BreachForum was seized, and its administrator arrested, a Telegram channel and shortly after, a new site quickly took its place.
Figure 1 – BreachForums Shout Box
The dark web continues to be a place where threat actors can buy and sell illicit goods, discuss hacking activities, and share data and information to enhance their nefarious activities. This is not going to change in 2024.
Due to Law Enforcement activity, onion sites continue to increase their security and rules for participating on forums and marketplaces. The captchas have become increasingly difficult and outstrip those usually found on the surface web. They have also developed methodologies to make it more difficult to scrape the sites and require memberships. In 2024 DarkOwl expects these trends to continue as we work to ensure we can continue to provide coverage of these sites and the activity on them. It will be increasingly important moving forward to pay attention to the TTPs (tactics, techniques, and procedures) of threat actors on the darknet as their sophistication grows.
Messaging Apps
Over the last year, threat actors increased and affirmed their use of other means of communication such as Telegram and Discord. The messaging app, Telegram, has become a very popular means of communication particularly because of the company’s stance on cooperating with law enforcement, which they rarely do, and refusing to ban or removing content, with the only exception being posts which relate to Islamic extremist material.
While the use of Telegram was promoted by the Russia/Ukraine war, events such as the Hamas/Israel conflict in 2023 cemented their use, not only as a means of communication but also as a way of delivering news, both factual and not – what we call disinformation, with many using Telegram channels as a source of media. As we enter an election year in the US, and other countries, it is likely that Telegram will be extensively used to share political rhetoric from multiple sides and should be closely monitored.
Figure 2 – Telegram Channel for Mysterious Silent force a hacktivist group supporting Hamas
Cyber threat actors, particularly hacktivist groups, have also used Telegram to publicize their activities, often naming victims or proposed victims and sharing victim data for others to download. DarkOwl continues to monitor Telegram for new and emerging groups and assess that the use of Telegram for the above purposes is likely to continue.
Discord had a turbulent 2023 – it was disclosed that sensitive US military information was shared on one of their servers. In reaction, they reviewed a number of their servers and closed those. They also closed any associated accounts that they deemed to be nefarious in nature. However, the gaming platform continues to be a popular place for threat actors and other individuals conducting nefarious activity to interact. DarkOwl will continue to monitor this in 2024.
Figure 3 – Example of classified document shared on Discord
Ransomware
In 2023 Ransomware continued to be a huge threat, with 4671 attacks reported in 2023. Although some groups were disrupted, to varying degrees of success by both law enforcement and other threat actors, new groups emerged with new methodologies and techniques, and some could argue less “rules” with all organizations being “fair game” including healthcare and schools. It is expected that Ransomware attacks will increase in 2024 to unprecedented levels.
CL0P successfully utilized a zero-day vulnerability to target high profile victims, releasing their data on their dark web leak site. This provided an example of different techniques that ransomware groups can use successfully. The group were able to release data on a large volume of victims in a short amount of time, increasing their profile in the process. We assess ransomware groups (and all hackers) will continue to seek to exploit these types of vulnerabilities. Highlighting the need for a robust and secure supply chain.
Figure 4 – Header from CL0P leak site
Lockbit was by far the most active ransomware group in 2023, although they did not always receive the same coverage as other groups. The group was reported to have 1041 victims in 2023 – an increase of 304 from 2022. There is no indication that this group is slowing down, at the time of writing, the group had posted 9 new victims on their leak site – almost one for every day of the year so far. These groups will continue to be a threat into 2024 unless successful law enforcement action is taken.
Figure 5 – Lockbit 3.0 Leak site
Although BlackCat/ALPHV appeared to suffer a disruption by law enforcement at the end of 2023 they were quick to bounce back with a new leak site and victims. This event highlighted the difficulties that law enforcement has in combatting ransomware groups, although infrastructure can be removed and decryptor keys released the groups are unlikely to be fully disrupted until the individuals are arrested, something that is not always possible given their geographical location. DarkOwl expects this to be a continuing frustration for law enforcement into 2024 which adds to the prediction that Ransomware will grow and continue to be a threat.
Figure 6 – BlackHat group take back their leak site and announce a new one
A trend which emerged in 2023 was double extortion being conducted by ransomware groups. However, more and more groups are emerging which simply manage extortion sites where they threaten to share data, without encrypting the companies’ data in the first place. This is a trend that is expected to increase in 2024. As decryption keys for common ransomware groups are released it becomes more costly for groups to develop new malware, high profile cases have shown that companies are willing to pay ransoms purely to stop it from being released into the public.
Credential Theft
Although it can be seemingly simple, credential theft continues to be one of the most common and lucrative methods of attack for threat actors. Stolen credentials can cause varying degrees of damage depending on who they belong to – from the loss of streaming service accounts to identity theft to network access and ransomware attacks. If individuals continue to reuse passwords, and or companies do not implement robust password policies, this will continue to be a threat. Because of this, DarkOwl analysts assess that this will continue to be a major threat in 2024.
In order to combat this crime, DarkOwl’s team continues to collect data leaks to allow organizations to identify potential risks that they are exposed to. The fallout from the 23&Me data leak in late 2023 highlighted that the risks are not just that threat actors may be able to access data, but companies are increasingly suffering large fines from regulators and lawsuits from those whose data has been stolen – increasing the risk that organizations face from data breaches.
Figure 7 – Redline Stealer Log Header
DarkOwl also expects that the selling and trading of Stealer Log information will continue throughout 2024. These logs allow threat actors to capture credentials, cookies and user agents for victims which can be used to mount attacks and steal accounts. The close to real-time nature of these logs ensures that the credentials are usually still active, increasing the success rate the threat actor is expected to have means that they are very profitable for those selling them on the dark web. DarkOwl will continue to monitor and collect this information where available.
Islamic Extremism
Figure 8 – Inspire Magazine Header
Likely linked to the ongoing conflict in Gaza, we have begun to see an increase in material linked to Islamic Extremism. In early 2024 AQAP revived the English-Language ‘Inspire’ magazine in video format. The video stated that “it is time to avenge Gaza” and provided instructions for building a ‘Hidden Bomb’ for targeting American planes, Bill Gates, and Elon Musk. Although not strictly a cyber threat, ISIS and AQAP have previously utilized online methodologies to incite violence and attract and radicalize followers. DarkOwl assess that this will continue with tensions rising in the Middle East. Our analysts continue to monitor these groups and their activities.
A.I.
Another theme of 2023 was the rise of AI with Chat GPT and Bard, among others, being released and adopted by many. Threat actors also began to adopt this technology to assist them in their attacks. As the technology matures, we expect this to be used more extensively by threat actors in 2024.
DarkOwl have seen actors selling access to AI accounts and also providing training on how it can be used to conduct attacks such as producing more believable and sophisticated phishing emails, as well as generating images which can be used for fake IDs used to circumvent financial institutions know your customer (KYC) policies. There are likely to be many other ways in which AI can be used to conduct malicious activities. DarkOwl will continue to monitor this throughout 2024.
APT groups will always pose a threat. They tend to be well funded and sophisticated in nature and can be very hard to detect and disrupt, meaning that while they may have periods of apparent inactivity, they are unlikely to disappear, usually emerging in a slightly different configuration.
As geo-political tensions continue, with wars in the Middle East and in Ukraine, Iran and Russia are likely to be very active in 2024. Elections will also likely illicit disinformation campaigns and other attacks seeking to influence the outcome.
However, the country likely to pose the largest and most persistent threat is China. China has been attributed to a high volume of attacks with a range of sophistication and it is likely that this will continue. The Director of National Intelligence stated, “China probably currently represents the broadest, most active, and persistent cyber espionage threat to U.S. Government and private-sector networks.”This highlights the threat the US government believes China poses in the cyber realm. It is likely we will see attacks from them throughout 2024.
Conclusion
2024 is likely to be a busy year for Cyber Security professionals and Threat Intelligence Analysts.
In 2023 the world witnessed over 50 ongoing real-world conflicts, as estimated by the UN. Conflicts now inevitably include a cyber element whether that be through attacks, disinformation campaigns or recruitment campaigns and so we are likely to see activity related to these conflicts. Furthermore, many countries will be holding elections this year which are likely to be marred by disinformation and claims of election fraud which are likely to also have a cyber element.
The threats of ransomware and credential theft will also feature heavily in the 2024 landscape and companies and organizations should be prepared for the threats that they pose. Monitoring the dark web to identify these activities can help organizations to better position themselves for the threats that will emerge in 2024.
Read on for highlights from DarkOwl’s Product Team for Q4, including new exciting product features.
Actor Explore Launched
The team released a major new Explore section in our Vision UI focusing on threat actors, providing invaluable insights into cyber threat actors. This feature is designed to empower security professionals, researchers, and organizations with analyst curated information about threat actors. Our analyst team selected 298 actors in these categories:
State-sponsored
Cybercrime groups
Ransomware
Access brokers
Exploit brokers or exploit buyers
Critical infrastructure attackers
Bulletproof hosting providers
Each actor dossier includes descriptors, contact, and cryptocurrency. The Darknet Fingerprint page includes darknet operations (Telegram Channels or Websites Administered), associated data leaks within the DarkOwl Vision dataset, as well as Forums and Marketplaces on which the actor has been observed. Additional tabs include lists of known Tools and CVEsused as well. Within the Actor Explore section, you can see a Target Mapof countries, Links to Research actor aliases and attributes in the DarkOwl Vision dataset, and can compare across different actor groups to see collisions.
This wealth of data enables users to gain a profound understanding of the threat actors, their tactics, and the potential risks they pose. Actor Explore will be regularly updated with new information and actors,prioritizing client needs, ensuring that users have access to the latest intelligence to bolster their cybersecurity efforts and research.
Figure 1: DarkOwl Actor Explore result for APT37
Leak Context Additions
The team has significantly increased the information in Leak Context this quarter, after the initial release in September. All of this content is available in both the UI and Leak Context API.
We’ve added a Search for Filetree button in the UI that lets you pivot to open a new tab & see the list of all files within the leak.
We’ve added more than 7 content fields relating to the Original Post location, the Attack Type of the leak, and the Size of the leak.
Leaks of Interest Collected
23andMe
Four datasets relating to 23andMe emerged on a deep web hacking forum as well as Telegram in early October. On October 6, 23andMe confirmed that it was investigating a cyberattack that resulted in unauthorized individuals gaining access to certain customer accounts. The company said it believed that the hackers were able to access certain accounts through a credential stuffing attack, where users had recycled login credentials. Our analyst team wrote a blog covering this leak here.
INDIA – ICMR Leaks Aadhar and Passports 200K Sample
According to the post by RavishKumarOfficial on BreachForums, this is a 200K sample from the 815 million Aadhaar and passport data leak previously posted for sale by pwn0001. The data leak is purported to be a COVID testing data breach. Data exposed includes full names, phone numbers, passport numbers, Aadhaar numbers (Government of India’s 12 digit individual identification number), age, gender, and physical addresses.
Johnny Logs 11DEC23
A batch of infostealer logs were posted to the Johnny Logs Telegram channel on December 12, 2023. Data exposed includes log data from a reported 3,000 log files and varies based on data that was exfiltrated from each machine.
Vision UI & API Updates
We launched our UI Assistant to announce new features and content, including a weekly What’s Leaking update.
For Email Domains, you are now able to generate an Email Domain Report PDF, a PDF version of the information displayed on the screen.
The Authenticated Site label now appears on search results, allowing user to easily tell which search results are from these sites
Search Block translations: We added new search block keywords in Arabic, French, Russian, and Spanish, and updated the design of this page to feature our growing translation options.
Search Result Pivoting: Within search results with extracted chat users or extracted emails, cards, cryptocurrency, or IP addresses, you can select research actions under the corresponding View Switch to help you to navigate to additional results with the Research or Entity Explore sections:
Username Research (Chat Users): Identify the darknet footprint associated to a username or user ID of interest, that can lead to alternate usernames and conversations in our chat application data.
Entity Explore Results: See aggregate data on Email Addresses, Credit Cards, Cryptocurrency or IP Addresses, with the ability to filter and batch export relevant results.
Curious how these features can make your job easier? Get in touch!
Thanks to our analyst and content teams, DarkOwl published over 110 pieces of content last year, a new record for the team. DarkOwl strives to provide value in every piece written, highlighting new darknet marketplaces and actors, trends observed across the darknet and adjacent platforms, exploring the role the darknet has in current events, and highlighting how DarkOwl’s product suite can benefit any security posture. Below you can find 10 of the top pieces published in 2023.
1. Dark Web Groups Turn Their Attention to Israel and Hamas
The world was shocked by the invasion of Hamas insurgents into Israel along multiple entry points from the Gaza Strip on October 7, 2023. This has led to a huge number of posts, images and videos being shared of the incursion and atrocities on social media but also on the dark web and dark web adjacent sites.
DarkOwl analysts are closely monitoring this situation and have identified a wealth of information being shared, some of it legitimate and some likely to be disinformation. In this blog, we provide information relating to known cyber groups active on Telegram and how they have reacted to the invasion. Some groups quickly pledged their support for one side or the other. Read blog here.
2. Romance Scams on the Darknet
For Valentine’s day, our analysts put together a piece to shed light on romance scams – one of the fastest growing schemes across the globe. In the last decade, dating apps and websites have skyrocketed in popularity. As a result, nefarious actors have similarly sought to capitalize off of this booming industry by exploiting and scamming its users. In fact, according to the Federal Trade Commission (FTC), the number of reported romance scams tripled in size from 2017 to 2021. Romance scams are part of a complex criminal enterprise that exploits unassuming individuals on both an emotional and sometimes devastatingly catastrophic monetary basis. Full blog here.
When Hamas militants entered Israel along several fronts on 7 October 2023, Israel and the world were shocked. As events have unfolded this has turned to disbelief that Hamas were able to mount such a complex and successful attack without prior intelligence to indicating an attack. In the months and years to come people will surely reflect on the entirety of intelligence failures that lead to these events, but initial reports seem to suggest that Hamas succeeded by “going dark.”
DarkOwl analysts reviewed our coverage of Hamas linked Telegram channels to identify if there was any change in their activity preceding the assault. We identified that there was a period of inactivity in the run up to the attacks for some but not all the channels. This could have been a coincidence, and we have seen no hard evidence suggesting that the period of inactivity was a precursor to the invasion. However, it is important to monitor the activity of pro Hamas Telegram channels to establish if there were any patterns to the posts.
In this blog, we review some of the channels we are currently monitoring. Read blog here.
In DarkOwl’s Darknet Marketplace Snapshot blog series, our researchers provide short-form insight into a variety of darknet marketplaces: looking for trends, exploring new marketplaces, examining admin and vendor activities, and offering a host of insights into this transient and often criminal corner of the internet. This edition features Styx market. Styx is a darknet marketplace selling illegal techniques for committing fraud, money laundering, and access to stolen data. Chatter on the darknet around Styx market first appeared in 2020 before the marketplace officially opened in mid-January 2023. Styx market offers stolen data as well as a variety of products for conducting illegal cyber activities. Learn more about Styx here.
5. Glossary of Darknet Terms
The darknet is home to a diverse group of users with complex lexicons that often overlap with the hacking, gaming, software development, law enforcement communities, and more. DarkOwl’s Glossary of Darknet Terms is a continually evolving resource that defines the common vernacular, slang terms, and acronyms that our analysts find in places like underground forums, instant messaging platforms (such as Telegram), as well as in information security research pertaining to the darknet. Check it out.
6. Monitoring the War in the Middle East
DarkOwl analysts have assembled a list of Telegram channels commenting on the current conflict in the Middle East. It is important to note that the channels labeled hacktivists are hacker groups, people actively DDoSing websites (distributed denial-of-service attacks), defacing websites, etc. Conflict media includes channels that are not related to hacking but are sharing various forms of near real time content from the conflict in the form of text, audio, images, and video. Analysts have found that there is more propaganda and misinformation on the conflict media accounts versus the hacktivist accounts (not say that it does not exist). Full list here.
7. Understanding the Difference Between Scams and Fraud
Many times we use the words “scam” and “fraud” interchangeably. Fraud is an umbrella term, legally referring to various types of chargeable criminal offenses. Scams, on the other hand, are a particular segment of fraud. One way to think about the difference between these two is from a legal perspective. Fraud is serious criminal business, while scams are considered more minor offenses in comparison. Many types of fraud are classified as felonies, versus scams which are typically charged as misdemeanors. Another way to look at it is from a banks’ perspective. Financial institutions differentiate the two as such: scams are theft of funds with your permission or knowledge, while fraud is financial theft without your permission or knowledge. This blog explores the differences. Read blog here.
8. Understanding Darknet Intelligence (DarkInt)
The darknet (or “dark web”) is a thriving ecosystem within the global internet infrastructure that many organizations struggle to incorporate into security posture, but is becoming an increasingly vital component. In certain cases, that is because taking raw data and turning it into actionable security intelligence requires leveraging DARKINT – or data points sourced from the darknet and other OSINT sources that together form a risk and/or investigative portfolio. Learn more.
9. Despite FBI Takedown, Genesis Market Persists on the Darknet
Genesis Market is a well known darknet exchange that specializes in the sale of identity and account-takeover tools – which, in the case of this forum, primarily means the sale of compromised personal devices via the use of malware. When a buyer obtains a “bot” from Genesis Market, they are actually purchasing persistent remote access to an unsuspecting victims computer. In April, the United States Federal bureau of Investigations has announced the seizure of the criminal forum Genesis Market in an internationally coordinated effort dubbed “Operation Cookie Monster.” Our analysts detected the disruption in Genesis Market at early afternoon Tuesday April 4th, which is consistent with other accounts who also saw the popular marketplace replaced with the law enforcement landing page at that time. Full blog here.
10. Examining Recent Telegram Posts from Russia’s “Z Bloggers”
The letter “Z” has been heavily used as a pro Russian invasion propaganda motif since the early days of the invasion in 2022. The “Z” symbol is often associated with images of Russian leaders in the government or military. The symbol is also commonly associated with Russian war journalists, soldiers, and other Kremlin supporters typically used as vehicles for misinformation campaigns on chat platforms like Telegram. The media commonly refers to this group of individuals as the “Z bloggers”, the “Z Army”, and more generally as war influencers. This blog will take a look at recent posts from 3 different “Z blogger” channels in an effort to better understand how this content has recently been utilized as a propaganda motif. Read blog here.
2023, That’s a Wrap!
Thank you to everyone who reads, shares and interacts with our content! Anything you would like to see more of, let us know by writing us at [email protected]. Can’t wait to see what 2024 brings! Don’t forget to subscribe to our newsletter below to get the latest research delivered straight to your inbox every Thursday.
Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.
1. Russia’s AI-Powered Disinformation Operation Targeting Ukraine, U.S., and Germany – The Hacker News
Ukraine, Germany, and the United States are heavily targeted in Russia’s “Operation Doppelganger” – a new wave of fake news stories distributing falsehoods via news sites and social media accounts controlled by the actors involved. The companies involved are Structura National Technologies and Social Design Agency. The world is well aware of continued dis- and misinformation efforts by Russia. As the war in Ukraine continues, and the US 2024 election approaches, these efforts are expected to grow and continue. Read full article.
After weeks of speculation that downtime on the leak site for Ransomware group Blackcat/ALPHV was due to law enforcement action, the site has officially been seized. The DOJ announced that the FBI had successfully breached the ALPHV ransomware operation’s servers to monitor their activities and decryption keys. The site had been suffering issues since Dec 7, which the group had attributed to technical issues despite reports of Law Enforcement action. However, a new message soon appeared on the site, claiming that the site had been unseized and providing a new onion address for the leak site.
The message is translated as follows:
BEGINS
As you all know the FBI got the keys to our blog, now we’ll tell you how it was.
First of all, as everything happened, having studied their documents, we understand that they received access to one of the DC, because all the other CCs were not touched, it turns out that they somehow hacked one of our hosters, maybe even he helped them.
The maximum they have these keys in the last month and a half, it’s about 400 companies, but now they’re more than 3,000 companies will never get their keys.
Because of their actions, we introduce new rules, or rather remove ALL rules, except one, you cannot touch the CIS, you can now block hospitals, nuclear power plants, anything and anywhere.
Reight is now 90% for all the adverts.
We do not issue any discounts to companies, payment strictly the amount that we indicated.
VIP adverts receive their private affiliate program, which we raise only for them, at a separate center, full, isolated from each other.
Thank you for your experience, we will take into account our mistakes and will work even tighter, waiting for your dive in chats and requests to make discounts that are no longer available.
ENDS
The site is currently showing as seized again. Read article.
3. Major Cyber Attack Paralyzes Kyivstar – Ukraine’s Largest Telecom Operator – The Hacker News
Kyivstar suffered a cyberattack that took most internet and phone services completely offline on December 12, 2023. The incident also impacted the air-raid alert system as well as some financial sector operations. Initial reports detail that 25 million mobile users and over 1 million home internet users were affected. Kyivstar issued a public statement that it would compensate these users who didn’t have service for the outage. Kyivstar indicated that this incident occurred as a result of the Ukraine-Russia war but didn’t provide evidence for this claim. Read full article.
4. Russian Hacker Vladimir Dunaev Pleads Guilty for Creating TrickBot Malware – The Hacker News
Russian national Vladimir Dunaev was arrested in 2021 and extradited to the United States in the same year. He recently (November 30, 2023) pled guilty to developing the Trickbot malware, which was a banking trojan turned initial access tool for ransomware attacks. Dunaev is the second actor to be arrested for his role in Trickbot, and will be sentenced in 2024; the first was a Latvian national who was sentenced in June of 2023. Article here.
5. German police takes down Kingdom Market cybercrime marketplace – BleepingComputer
German law enforcement announced the seizure of Kingdom market a darkweb marketplace known to sell drugs, hacking tools and counterfeit documents. One of the administrators of the site was reported to have been arrested in the US. A seizure notification was posted on their onion site. The site has operated since March 2021 and was one of the most well-known dark marketplaces. It was announced that investigations were ongoing to identify the people who operated the site aided by the seizure of their infrastructure. Other marketplaces have taken this opportunity to invite sellers to their sites to continue their operations via Dread. Read article.
6. Kelvin Security hacking group leader arrested in Spain – BleepingComputer
Kelvin Security group is a prolific hacking group who are quite active on BreachForums and RaidForums, selling stolen data for profit. Spanish law enforcement revealed they arrested a Venezuelan national who is a possible leader of the group on December 07, 2023. This actor was heavily involved in the group’s financial activities, such as moving money through various cryptocurrency exchanges to make tracing funds more difficult for authorities. Read full article here.
7. Navy contractor Austal USA confirms cyberattack after data leak – BleepingComputer
Australia-based Austal USA, a shipbuilding company, revealed it was the victim of a cyberattack as of December 6, 2023. Austal USA itself is a subsidiary of Austal and has contracts and multiple programs working with the US Navy. Ransomware gang Hunters International group claimed responsibility for the incident. Read article.
8. BidenCash dark web market gives 1.9 million credit cards for free – BleepingComputer
The Darkweb marketplace BidenCash has reportedly released 1.9million credit cards for free. This is the third time that they have made such a release although the validity of the cards is not confirmed. BidenCash launched in early 2022 as a new marketplace on both the dark web and the clearnet, selling credit and debit cards that were stolen through phishing or skimmers on e-commerce sites. Article here.
Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.
With 2023 at a close, our content and marketing teams reflect on a number of exciting events, trends and changes the DarkOwl team experienced this year. We look forward to an even more successful and prosperous 2024 and wish the same for all our customers, partners and readers! Thank you for your support over the past year and continuing to read, engage and share our content. We hope you continue to find the topics we cover valuable, enlightening and interesting. Last marketing plug of the year… don’t forget to sign up for our weekly newsletter to make sure you receive updates about latest from our research and content teams!
DarkOwl Around the World
Trade Shows and Events
DarkOwl made the rounds this year traveling all over the world for trade shows and speaking sessions and we are so glad to be able to see our customers, partners, and prospects face to face. In 2023, the team attended several events all around the world from San Francisco, Las Vegas, New Orleans, National Harbor, Panama City, London, Prague, Paris, Vienna, Munich, Singapore, Dubai, Hyberbad, Haryana, and more. Thank you to everyone who sat down with DarkOwl along the way. We hope to see even more you on the road in 2024. Check out where we will be in 2024 and request time to meet here.
DarkOwl CFO and DarkOwl FZE CEO at CyberTech Global in Tel Aviv.
DarkOwl CEO at the G-20 Conference in Gurugram, Haryana, India.
DarkOwl CBO, Director of Client Engagement and Project Engineer & Data Analyst at OsmosisCon in New Orleans, LA.
DarkOwl Director of Strategic Partnerships in Lille, France at FIC.
Darknet Hands-On Labs
DarkOwl hosted two darknet hands-on labs for the first time this year. In July, we hosted “Explore the Darknet with DarkOwl” at the Carahsoft headquarters in Reston, VA. Attendees got access to DarkOwl Vision and got to conduct hands-on searches during a Scavenger Hunt. DarkOwl’s industry leading Vision UI provides access to the largest commercially available database of darknet content in the world, without having to access the darknet directly, so you can take action to prevent potentially devastating cybersecurity incidents. After an afternoon of learning about the darknet and diving into it, attendees enjoyed networking during happy hour.
Our next hands-on lab, we hosted with Blackbird.AI at the Carahsoft headquarters in Reston, VA as well, “Explore Darknet Data and Beyond With DarkOwl and Blackbird.” In this session, attendees once again got direct access to DarkOwl Vision to explore the platform and conduct darknet searches in a Scavenger Hunt and see in real-time, how Blackbird’s Constellation Platform aggregates and adds color to this data. Blackbird provides the only purpose-built platform for organizations to detect, measure, and mitigate disinformation and information-driven risk. Together, get the complete picture you need for critical decision making.
The team is excited to do more of these in-person trainings, make sure you don’t miss the invite to our next one!
Employee Fun and Events
Not only did the team travel around the world for client meetings and conferences, but back in Denver, CO at Headquarters, DarkOwl had some fun too! With a workforce that is becoming more and more remote friendly and DarkOwl focusing on finding the best talent, making sure that everyone at DarkOwl stays connected is of upmost importance.
Team Offsite
Meeting our adopted owl
Meeting our adopted owl
Last year, we adopted an owl! This year we renewed that adoption and the team was lucky enough to meet our adopted great horned owl. He jumped early from his Michigan nest in 2015 and fractured his right wing in two places and was on the ground for about a week next to a barn before he was picked up by the landowners and brought to a rehabilitation center. He was sent to the Raptor Education Foundation in Denver in August, 2016 where he now lives. You can learn more about him on his dedicated adoption page.
We love our #Pets!
Arguably, one of the most exciting things this year was the start of the DarkOwl Pets Channel! Our furry employees brought so many smiles throughout the year and of course a couple crashed meetings and plenty of naps along the way. 😻
Porter, Apollo and P.
Biscuit, Garfield, Bentley, Zooka and Lil’ Dip.
Bevy May, Bart, Sumi, Feni, Nova and Cudi.
Reminder: DarkOwl analysts and their pets recommend you never use your pet’s name in any password combination as it is a popular term for threat actors using brute force attacks.
Content, Content, Content
DarkOwl published over 110 pieces of content this year – everything from research blogs, darknet 101 topics, press releases, webinars and more. The team will be ranking the top 10 pieces in the new year. Stay tuned to make sure to see the highlights!
This year, we also launched our LinkedIn Newsletter, “Weekly Intelligence Summary: Deep and Dark Web Round Up,” which is published on LinkedIn every Monday morning and rounds up cyber news from the week prior. Keep up to date with the latest from DarkOwl Analysts every Monday – you can subscribe here.
New Products and Enhancements
DarkOwl places great emphasis on learning from customers and making sure our products are always providing value. We make a continuous effort to enhance our dark web data products with features geared towards analyst and threat intelligence teams. Below are a couple highlights of big launches we had this year, both of new products and offerings as well as feature enhancements.
DarkSonar API Launch
In April, DarkOwl added, DarkSonar API to the product suite. DarkSonar, a relative risk rating based on darknet intelligence, measures an organization’s credential exposure on the darknet. DarkSonar enables companies to model risk, understand their weaknesses and anticipate potential cyber incidents. In turn, organizations are able to take mitigating actions to protect themselves from loss of data, profits, and brand reputation.
Built on DarkOwl’s proprietary Entity dataset, DarkSonar generates a risk rating that is unique to each company. The algorithm used to generate these signals takes into account key quantitative and qualitative factors over time of organizational exposure of email addresses with associated passwords, and weights each signal accordingly. The result is a quantifiable risk indicator that can help companies and organizations monitor and potentially predict cyberattacks.
In testing internally and with beta partners in the insurtech and third-party risk industries, DarkOwl found an elevated DarkSonar score in the months before a cyberattack in approximately 75% of the cases where a company publicly acknowledged a breach. Depending on the companies and the nature of the attacks this percentage was as high as 85% in some instances. This indicates that DarkSonar can help organizations assess their risk level as an additive data point – and potentially predict a pending threat.
Read more about DarkSonar API on our product page or in our interview with Director of Product, Sarah Prime and Product Manager, Josh Berman.
Darknet Services Offering
In July, DarkOwl announced the launch of Darknet Services, our customizable tailored, expert analyst support to enrich darknet data and provide customers with darknet risk analysis, threat actor profiling, darknet monitoring, data acquisition, and brand protection. For individuals who are not familiar traversing the darknet it can be a daunting task to search for threats and risks to an organization. DarkOwl is the darknet expert, with access to the largest database of darknet content. DarkOwl’s team of expert analysts are able to conduct these investigations on behalf of customers identifying mentions of organizations as well as data relating to them that may be exposed. Our customizable service options allow customers to leverage our in-house expertise to save time, keep their employees safe, and fulfill the need for actionable threat intelligence. Let us be an extension of your team.
Read more about Darknet Services on our product page or in our interview with DarkOwl Director of Intelligence, Senior Threat Analyst, and Darknet Intelligence Analyst to understand a little more about their backgrounds, why they love cyber, projects they’re working on, and some tips and tricks for new analysts. You can even see some example reports here.
Actor Explore: Your Ultimate Resource for Cyber Threat Actor Intelligence
In November, DarkOwl released “Actor Explore,” an exciting new addition to our Vision UI platform that provides invaluable insights into cyber threat actors. This feature is designed to empower security professionals, researchers, and organizations with analyst curated information about threat actors, enhancing their ability to understand and combat cybersecurity threats effectively.
In today’s digitally driven world, the landscape of cyber threats is ever-evolving and increasingly sophisticated. As businesses and individuals become more dependent on technology, the need to protect sensitive data and critical infrastructure from cyber attacks has never been more critical. One effective approach to enhancing cybersecurity is to track and monitor cyber threat actors. The actors that are responsible for conducting attacks; individuals or groups with malicious intent, often targeting organizations, governments, or individuals. Understanding why they are operating, what they hope to achieve and what methodologies they are using can assist analysts in protecting infrastructure and predicting future activities.
With Actor Explore, users can access comprehensive threat actor information and each actor profile includes a detailed dossier, offering an in-depth overview of the threat actor. Additionally, DarkOwl analysts provide extensive information such as darknet fingerprints, targets, tools, CVEs, contact information, and morewhen available. Actor Explore connects this information to our other data sets, including leak sites, ransomware sites, alias, cryptocurrency, etcetera that actors are associated with. This wealth of data enables users to gain a profound understanding of the threat actors, their tactics, and the potential risks they pose.
Cyber threats are continually evolving, and so are the threat actors behind them. The collection consists of threat actors in several categories, including: state-sponsored, cybercrime-focused, ransomware groups, access brokers, exploit brokers and buyers, critical infrastructure attackers, and more. Actor Explore will be regularly updated with new information and actors,prioritizing client needs, ensuring that users have access to the latest intelligence to bolster their cybersecurity efforts and research.
2023 was exciting for the DarkOwl team, as we grow our product suite and continue to improve our current products.
One of DarkOwl’s key differentiators is our product team’s ability to respond to the needs of our clients and collect the data that matters the most to them. Last year, DarkOwl was proud to assist our national security and government partnerships by providing crucial insights into data leaks and cyber activity surrounding the war in Ukraine. This year, we are pleased to have reported on and shared insights into the Hamas and Israel conflict.
DarkOwl Announces Availability of Vision UI on AWS Marketplace
AWS Marketplace serves as a comprehensive e-commerce platform featuring thousands of software listings from independent vendors, streamlining the process from discovery to deployment of software compatible with Amazon Web Services (AWS), around the globe. This collaboration offers security teams and leaders a swift and cost-efficient avenue to harness DarkOwl’s invaluable darknet data resources utilizing their AWS account.
Bringing DarkOwl Vision UI to the AWS Marketplace allows access to advanced threat intelligence and empowers organizations to fortify their defenses against evolving cyber threats. DarkOwl Vision UI on AWS Marketplace offers scalability, making it suitable for organizations of all sizes. Users can choose a subscription plan that aligns with their specific cybersecurity needs.
Clients Seeing Increased Demand for Dark Web OSINT
We understand how incredibly challenging it is to maintain insight into everything the threat actors have insight into. This year, we put an emphasis on leveraging our company’s expertise in darknet technology to gather the data that allows our clients and their customers to stay ahead of potential threats.
Newly announced partnerships include:
Don’t miss any updates from DarkOwl in 2024 and get weekly content delivered to your inbox every Thursday.
Fraud is one of the most prevalent activities on the darknet, threat actors will buy and sell fraudulent goods as well as providing tips on tricks on how to how to conduct fraudulent activities. There are many different types of fraud that are conducted against many industries, and events, although financial gain is the overriding incentive, with actors often being opportunistic in who they target and when.
Here we will explore some of the types of fraud DarkOwl analysts have observed on the darknet.
E-Commerce Fraud
The targeting of e-commerce businesses such as Amazon, PayPal and Shopify is widespread on the darknet. Criminals will use a range of techniques such as refund fraud, hacked accounts and gift card fraud in order to obtain funds.
The dark web adjacent platform, Telegram is used extensively to advertise fraud and scam markets. Users are able to search for channels which provide them with ways to conduct fraud, groups that will provide fraud services for you sell you fraudulent goods.
Refunding Services
Refunding fraud is when a user will obtain a cash refund for goods that they have not purchased or for goods the buyer had already received a legitimate refund for. Refund fraud can have significant financial implications for businesses, leading to monetary losses and potential damage to their reputation.
A user knows as Bam or Amazon God offers refunding services for Amazon goods in a range of jurisdictions. They provide the refund service as well as offering methodologies and mentorship as a consultant.
Figure 1: Threat acor provides refund services on Telegram
Hacked Accounts
Hacked accounts often come from stolen credentials, or through credential stuffing attacks allowing criminals to access legitimate accounts to purchase goods. This is also known as Account Takeover (ATO). These accounts are often sold on the dark web and dark web adjacent sites.
Figure 2: DarkOwl Vision result for the sale of Amazon Prime accounts
Many organizations are targets of these types of account takeovers, with threat actors becoming more successful at obtaining credentials which can be used on multiple accounts. However, we do see many accounts being made available for streaming service accounts such as Netflix or Hulu, usually for very low prices.
This is why it is very important for individuals to practice good password hygiene – not only in their professional life, but also in their personal life. Password reuse can lead to multiple of your accounts being stolen. DarkOwl recommends the use of a password manager and routine changing of passwords.
Tutorials
Although not a fraudulent activity in its own right, DarkOwl analysts note that threat actors are increasingly selling tutorials and guidance on how to conduct different types of fraudulent activity on the darknet. This means that actors do not necessarily have to have skills or sophistication in order to be successful – they are able to purchase this knowledge and carry out the fraudulent actions themselves. Because of this sharing of knowledge, the number of individuals committing fraud can grow at a pace it might not have done or have been able to beforehand. Cracking tutorials in the darknet cover all matters of illegal “cracking” including passwords, wi-fi routers, commercial accounts, and software. For obvious reasons, we’ll not detail any of the cracking tutorial methods that we’ve spotted across popular hacking forums and Telegram channels.
Financial Fraud
Although the majority of fraud is committed for the purposes of financial gain, it does not always target the financial sector directly. However, there are multiple types of fraud that do. This continues to be a trend DarkOwl has observed on the dark web and we do not expect it to decrease.
Gift Card Fraud
Gift card fraud refers to the unauthorized acquisition, use, or manipulation of gift cards for financial gain. Gift cards are prepaid cards issued by retailers, restaurants, or other businesses, and they are commonly used as presents or convenient forms of payment. However, criminals have developed various schemes to exploit vulnerabilities in the gift card system.
Gift cards are often used as a way to launder money, allowing users to purchase goods with funds which have been illicitly obtained. Gift cards can be purchased with cash and can therefore also be used to obfuscate the purchase of illicit goods.
Figure 3: Threat actor sells ebay gift cards
Fullz
Fullz is a dark web term which refers to a complete set of personal information that cyber criminals often seek to steal and sell on the dark web for fraudulent purposes. This information typically includes a person’s full name, social security number, birthdate, address, phone number, email address, financial account details (such as credit card numbers, bank account information, and associated security codes), and other sensitive data.
This information can be used to steal a person’s identity, conduct social engineering attacks, and conduct account takeovers. Most commonly we see fullz being sold on the dark web for the purposes of conducting financial fraud, with actors using the details to open fraudulent bank accounts to be used for other scams.
Figure 4: Telegram account selling Bin and Fullz
Credit Card Fraud
Credit card fraud is common on the dark web, with many marketplaces and vendor stores exclusively selling stolen and or cloned credit cards. WWH Club us an example of a marketplace which is set up exclusively to cater to the carding community.
Credit cards will be sold with varying balances or credit limits on them, the more cash available the more expensive that they will be. Threat actors have been able to create cards, which they have cloned, and they create on mass and sell on the dark web.
Users will purchase these cards to cash out the funds or purchase illicit goods and obfuscate their identity.
Figures 5 and 6: Cloned cards and card advert
Counterfeit Goods
Another item that is very popular on the dark web is the sale of counterfeit goods. While these can vary in type, from designer goods to sporting ware, the majority of items we have seen advertised on the dark web are counterfeit documents. Passports from a variety of countries, driving licenses, birth certificates and immigration documents are available for purchase on the dark web.
Again, there are marketplaces and vendor stores that are dedicated to the sale of these goods as well as being made available on the majority of high-profile marketplaces within their own area.
DarkOwl has not verified the quality of any of these goods, and it is unclear whether the sale of these is a scam in and of itself. However, it is possible that some threat actors do have access to the materials to create these. The price of the document is usually a good indication of the quality. Some of the documents sold also appear to be legitimate, likely stolen from the original owner for the purpose of selling on the dark web.
Healthcare fraud became increasingly mainstream as a result of the 2020 pandemic, with actors selling vaccination cards and PPE (personal protective equipment). However, this has continued as the pandemic has subsided. Although vaccination cards are still available, we have seen a move towards Medicare fraud in the US as well as the sale of medical information in leaks and breaches. Mentions on the dark web related to 1095A Forms, healthcare agent credentials, and Medicare / Medicaid. We assess that this information is being made available on the dark web so that criminals can use it to conduct healthcare fraud and claim benefits which they are not entitled to. DarkOwl will continue to monitor this trend into 2024.
Figure 8: Sale of healthcare information
Conclusion
Threat actors use the dark web to conduct, learn and sell activities relating to many different types of fraud. The primary reason for this activity is financial gain and we do not expect this to change, however new trends and types of fraud continue to emerge. DarkOwl will continue to monitor these trends into 2024.
Curious how DarkOwl can help your fraud use case? Contact us.
It has been 2 months since Hamas’s October 7th surprise attack on Israel. In that time there have been many developments both on the ground and in the cyber realm. A number of groups emerged in the aftermath of the attack pledging their support to either Hamas, Palestine or Israel and cyberattacks increased in the region targeting both sides to varying degrees of sophistication. DarkOwl analysts have been tracking these events and activities, and in this blog we review some of the notable cyberattacks that have occurred and the groups that have taken responsibility.
In the first few days of the conflict, attention was largely focused on images and media reportedly coming out of Israel and Gaza highlighting the atrocities which were occurring. Telegram, which is monitored by DarkOwl, appeared to be being used as a de-facto news source, providing details of what was happening in certain areas and also posting images of the aftermath. Channels appeared or grew in size supporting one side or the other and while sharing information, there were also reports of false or fabricated information and media being shared stoking the flames on both sides.
Figure 1: Telegram channel posts image of Hamas breaching into Israel
The cyber world also reacted to the conflict with existing hacktivist groups quickly pledging allegiance to their chosen side or already fighting for the cause. Groups quickly began to post online about the targets they had successfully compromised with attacks ranging from DDoS (distributed denial-of-service), defacements to data leaks. As the conflict has progressed, the level of activity has ebbed and flowed, with some groups turning their attention back to previous targets.
Figure 2: Selection of Cyber groups profile images
After the initial invasion and activity, several cyber incidents accompanied the air and ground conflicts in the Middle East. Key activities we identified as part of the conflict are detailed below although this is not an exhaustive list and does not describe all reported activities.
A leak purportedly from the Palestinian Foreign Ministry was published on cracking[.]org which contained details of Chinese and Palestinian projects as well as correspondence documents and PII for approximately 500 people. DarkOwl was able to obtain this leak for review.
Ghosts of Palestine openly announced they will target NATO countries who support Israel although Turkey was excluded from targeting.
JFK airport was targeted by hacktivist group R_70 which is a Pro-Hamas group. The groups reported via their Telegram channel that they had taken down the JFK website due to their links to “Zionism.”
BlackSec joined the digital operations arena, claiming it would target Israel and not remain neutral in the conflict.
The RedAlert app which was used to alert Israelis to rocket attacks was subject to a spoof attack which was reported to collect personal information. It was unclear who was behind this attack but demonstrated cyber actors taking advantage of the military conflict for their own gain.
Stucx Team claimed an attack on an Israeli SCADA system via their Telegram channel, Supervisory Control, and data acquisition (SCADA) controls industrial processes. Targeting these types of systems can bring down water plants and electrical facilities and are usually one of the most concerning attacks for cyber security experts. A high level of sophistication is usually required to successfully attack these processes. However, they became a common Israeli target as the conflict continued.
Figures 3 and 4: STUCX Team Telegram post from DarkOwl Vision and on the channel
The group GlorySec posted on Telegram that they considered a firewall on Palestinian websites, indicated Palestine had prepared well in advance for a conflict in the cyber realm as well as the physical realm. They also said they’d release the data right to Israel to support their operations and encouraged them to investigate this. It is unclear what information they had or if this was shared.
Figure 5: Telegram post by GlorySec via DarkOwl Vision
Anonymous Algeria publicly warned the UAE and alerted its airline, Emirates, to a possible system compromise for what they view as “not supporting Palestine”:
Figure 6: Anonymous Algeria Telegram Post
Reports indicated that Pro-Hamas hacktivists groups were targeting Israeli Entities with Wiper Malware, the destructive malware appeared to have signatures within it linking it to the Middle East. This development highlighted the use of sophisticated tools as part of the ongoing conflict and suggests a “cyber war” may also be taking place.
As the month of October concluded, hacktivist activity relating to the Gaza conflict appeared to decrease. While the start of the conflict saw a large amount of emerging activity, with actors and groups choosing sides and issuing threats online, digital activity surrounding the Israel-Hamas conflict tapered down. However, increases were expected as the conflict continued.
November Events
AnonGhost Indonesia & Anonymous Indonesiawarned the Japanese government that for supporting Israel that they would carry out cyberattacks, the groups had already been active in targeting countries they deemed to be anti-Palestine or Pro-Israel.
GhostSecclaimed to have successfully targeted several Israeli PLCs via their Telegram channel.
Anonymous claimed to have information relating to Mossad spies which they threatened to disclose on Telegram it is unclear where this information came from or if it relates to valid data.
Figure 7: Anonymous post on Telegram
Although the hacktivist groups on Telegram appeared to quiet in this period security research reported on several activities which indicated that Iranian hackers were using new tools to target Israel and that a Hamas linked APT was also targeting Israel with a new backdoor tool. Indicating that nation states and Nation State sponsored groups continued to be active in the cyber sphere. These groups tend to avoid the publicity that hacktivist groups seek.
December Events So Far…
Cyber incidents began to increase after the temporary ceasefire between Hamas and Israel completed.
Cyber Toufan hacking group claimed to have breached Israeli company SodaStream, and exfiltrated 100,000 records:
Figure 8: Post for SodaStream data on dark web forum via DarkOwl Vision
Conclusion
Hacktivist groups and cyberattacks have been a component of the Israel Hamas conflict since it began, with many groups getting involved and attacks across of a scale of sophistication being conducted on both sides. Although the activities have ebbed and flowed in the first two months of the conflict, it is clear that they are likely to continue for the length of the military conflict – if not longer. DarkOwl will continue to monitor the activities of these groups as the conflict continues.
DarkOwl, the leading provider of darknet data, is pleased to announce the availability of DarkOwl Vision UI on AWS Marketplace. AWS Marketplace serves as a comprehensive e-commerce platform featuring thousands of software listings from independent vendors, streamlining the process from discovery to deployment of software compatible with Amazon Web Services (AWS), around the globe. This collaboration offers security teams and leaders a swift and cost-efficient avenue to harness DarkOwl’s invaluable darknet data resources utilizing their AWS account.
This strategic move makes DarkOwl’s darknet data more easily accessible than ever to a broader audience, allowing organizations of all sizes to enhance their cybersecurity posture.
DarkOwl Vision UI is the industry leading platform for analysts to simply, safely, and comprehensively search darknet data. Vision provides a user-friendly interface with powerful querying capabilities to search, monitor, and create alerts for critical information. By leveraging DarkOwl’s extensive database of darknet content, organizations can gain unparalleled visibility into potential risks and vulnerabilities. The user-friendly interface of DarkOwl Vision UI simplifies the process of monitoring, analyzing, and responding to emerging threats.
Bringing DarkOwl Vision UI to the AWS Marketplace allows access to advanced threat intelligence and empowers organizations to fortify their defenses against evolving cyber threats. DarkOwl Vision UI on AWS Marketplace offers scalability, making it suitable for organizations of all sizes. Users can choose a subscription plan that aligns with their specific cybersecurity needs.
“We are excited to make DarkOwl Vision UI available on the AWS Marketplace, making it easier for organizations around the world to enhance their cybersecurity posture,” said Alison Halland, Chief Business Officer at DarkOwl. “With the increasing sophistication of cyber threats, it is crucial for businesses to have access to advanced threat intelligence tools and with our product on AWS Marketplace, we are happy to make this a reality.”
DarkOwl Vision UI is now available on the AWS Marketplace, and interested users can find more information on the AWS Marketplace Listing.
About DarkOwl DarkOwl uses machine learning and human analysts to collect automatically, continuously, and anonymously, index and rank darknet, deep web, and high-risk surface net data that allows for simplicity in searching. DarkOwl is unique not only in the depth and breadth of its darknet data, but also in the relevance and searchability of its data, its investigation tools, and its passionate customer service. DarkOwl data is ethically and safely collected from the darknet, allowing users secure and anonymous access to information and threats relevant to their mission. For more information, visit www.darkowl.com.
DarkOwl is a Denver-based company that provides the world’s largest index of darknet content and the tools to efficiently find leaked or otherwise compromised sensitive data. We shorten the timeframe to detection of compromised data on the darknet, empowering organizations to swiftly detect security gaps and mitigate damage prior to misuse of their data.
