In DarkOwl’s Darknet Marketplace Snapshot blog series, our researchers provide short-form insight into a variety of darknet marketplaces: looking for trends, exploring new marketplaces, examining admin and vendor activities, and offering a host of insights into this transient and often criminal corner of the internet. This edition features B1ack’s Stash.
B1ack’s Stash is a dark web carding marketplace that specializes in the distribution of stolen credit and debit card information. Emerging on April 30, 2024, it quickly gained notoriety by releasing 1 million stolen payment card details for free, a strategy aimed at attracting cybercriminals to its platform. The market sells credit card information to users occasionally shares free credit card dumps (as seen below). In this blog, DarkOwl analysts take a deep dive into the market, how it operates and what the reaction to the site has been on the dark web.
B1ack’s Stash Emerges with its Free CC Dump in April 2024
According to DarkOwl Vision, B1ack’s Stash began advertising its websites and free credit card information across well-known dark web forums between the spring and summer of 2024, including XSS, Exploit, Verified, Club2CRD, WWH Club, and ASCarding. The site then released several “dumps” claiming to contain credit card information.
Figure 1: Screenshots of B1ack’s Stash advertisements
The technique of making free data available to promote a site is nothing new, other well-known carding marketplaces, such as BidenCash and Joker’s Stash, operate similarly. However, they are not assessed to be directly related.
Joker’s Stash was one of the largest and most infamous dark web carding marketplaces, operating from around 2014 until it voluntarily shut down in early 2021. It was known for selling high-quality stolen payment card details and used blockchain-based domains to evade law enforcement. The closure of Joker’s Stash left a gap in the cybercriminal ecosystem, which was later filled by other marketplaces.
B1ack’s Stash, on the other hand, emerged in 2024 and quickly gained attention by releasing millions of stolen credit card details for free—a tactic often used to attract cybercriminals. While it shares a similar purpose with Joker’s Stash, there is no confirmed connection between the two.
While B1ack’s Stash may seek to capitalize on Joker’s Stash’s legacy, evidence suggests it operates independently rather than as a direct successor.
B1ack’s Stash Reappears in the Media (February 2025)
In a more recent development, on February 19, 2025, B1ack’s Stash escalated its operations by claiming to leak an additional 4 million stolen credit card details for free. This massive data dump was publicized on underground cybercriminal forums like XSS and Exploit, serving both as a marketing tactic and a means to establish credibility within the cybercrime community.
The leaked data encompasses a wide array of sensitive information, including:
Primary Account Numbers (PANs)
Expiration dates
CVV2 codes
Cardholders’ personal details
Email addresses
IP addresses
User-Agent strings
According to a blog by SOCRadar, the release of such comprehensive data poses significant risks, including financial fraud and identity theft. This data enables cybercriminals to commit fraud, resell stolen credentials, and facilitate identity theft.
The following screenshot from DarkOwl’s Vision UI provides an example of sensitive data exposed in B1ack’s Stash’s recent free credit card dump. It shows PII such as: Name, DOB, email, CCN, CVV, Expiration, Address, and IP.
Figure 3: Screenshot of Feb 2025 Freebie CC Dump
This incident underscores the persistent threat posed by dark web marketplaces like B1ack’s Stash, highlighting the critical need for enhanced cybersecurity measures to protect both individuals and organizations from such illicit activities.
B1ack’s Stash’s Darknet Footprint
While B1ack’s Stash has been most active on XSS since April 2024, it has also heavily advertised itself on Exploit, Verified, Club2CRD, WWH Club, ASCarding, and likely other forums. It also maintains a popular Telegram channel with 2,755 subscribers.
Exploit:
Free 1 million CCs release advertisement and various dead download URLs, which were reportedly active at the time of the post on April 30, 2024.
Figure 4: Screenshot of B1ack’s Stash Free CCN Dump in 2024 on Exploit
Verified:
The following B1ack’s Stash advertisement was originally posted on the popular hacking forum, Verified, on April 17, 2024, but still is a popular thread on the forum.
Figure 5: Screenshot of B1ack’s Stash Verified Advertisement
Club2CRD:
Same content as above verified advertisement, which was originally posted on the popular credit card fraud forum, Club2CRD, on April 16, 2024.
Figure 6: Screenshot of B1ack’s Stash Club2CRD Advertisement
WWH Club:
The following post appeared on the popular Russian language credit card fraud forum, WWH Club, on June 12, 2024. Its content is identical as the content posted on other forums. However, the second below screenshot shows additional information that was not previously shared. Details like the database name, country list, PII type, validity rate, and its refund policy.
Figures 7 & 8: Screenshot of B1ack’s Stash WWH Club Advertisement
ASCarding:
Same content as above. This B1ack’s Stash advertisement also appeared on the popular credit card fraud forum, ASCarding, on April 17, 2024.
Figure 9: B1ack’s Stash ASCarding Advertisement
Telegram
B1ack’s Stash also has a presence on the popular messaging app, Telegram. Its official Telegram channel has 2,755 subscribers and occasionally posts advertisements for selling credit card data.
Figure 10: B1ack’s Stash Telegram Account
Their official TG account posts in English and Russian. The below post is related to their “4 million free cc release” from February 2025.
Figure 11: Screenshot from B1ack’s Stash Telegram Account
Community Reactions: Is B1ack’s Stash Legit?
B1ack’s Stash’s sudden rise in popularity has been met with mixed reactions from dark web users. Most comments range from negative to neutral, while very few users gave clearly positive endorsements based on their site experience.
On December 27, 2024, a Telegram user on the official channel for the popular carding forum ASCarding questioned whether B1ack’s Stash could be a scam, stating:
“I got 2 non vbv from b1ack stash a while ago, they didn’t work at first but somehow on the 4 try I think i managed to withdraw 5$, am i doing something wrong or just b1ack stash is shit, i got the proxy in his area on firefox, vpn on whole pc, gmail account on his name, mac changer.”
Figure 12: Telegram Screenshot from DarkOwl Vision
DarkOwl analysts discovered a well-known dark web research website called Dark Web Informer, which also mentioned B1ack’s Stash twice on its Telegram channel.
Dark Web Informer is a cyber threat intelligence platform that provides insights into activities on both the dark web and the surface web. The site covers topics such as data breaches, darknet markets, ransomware incidents, and threat alerts.
In addition to its main website, Dark Web Informer maintains a presence on several platforms, including GitHub, LinkedIn, and Medium, where it shares cyber threat intelligence information, tools, and articles. Recently, on February 17, 2025, Dark Web Informer claimed that B1ack’s Stash is a “legitimate” fraud site.
“TheDarkWebInformer wrote: Yes, B1ack Stash is a “legitimate” fraud site. In May of 2024 1 million cards were leaked for free.”
Figure 13: Telegram Screenshot from DarkOwl Vision
Conclusion
B1ack’s Stash’s emergence and rapid growth highlight the ongoing evolution of dark web marketplaces and the persistent threats they pose to global cybersecurity. By strategically releasing millions of stolen credit card details for free, the marketplace has garnered significant attention—both from cybercriminals looking to exploit the data and security researchers tracking its impact.
While comparisons have been drawn to now-defunct platforms like Joker’s Stash, B1ack’s Stash appears to be a distinct operation aiming to establish itself as a major player in the underground economy. Its presence across multiple dark web forums, coupled with an active Telegram channel, indicates a calculated effort to build trust and legitimacy within illicit communities.
The continuous leaks of sensitive financial data underscore the urgent need for enhanced cybersecurity measures. Organizations must proactively monitor for compromised credentials, implement robust fraud detection systems, and educate users about the risks associated with stolen payment information. As cybercriminal tactics continue to evolve, law enforcement, financial institutions, and cybersecurity professionals must collaborate to anticipate and counter emerging threats in underground marketplaces like B1ack’s Stash.
Attendees of this webinar, hosted with Carahsoft, learned about how in today’s world, Open Source Intelligence (OSINT) plays a critical role in uncovering threats and mitigating risks by leveraging publicly available information. This webinar dove deep into the practical side of OSINT investigations, focusing on how dark web data can be strategically utilized to enhance threat detection and risk assessment for organizations.
During this webinar, the Director of Intelligence of Collections at DarkOwl, demonstrated the power of DarkOwl Vision through real-world examples, including:
Tracking stolen credentials from a recent data breach
Monitoring dark web marketplaces for insider threats
Identifying emerging cybercrime trends
Analyzing chatter on forums to predict potential attacks
Protecting executives and high-profile individuals
Participants gained hands-on insights into gathering, analyzing, and interpreting OSINT data, with a focus on applying dark web intelligence to solve real challenges.
NOTE: Some content has been edited for length and clarity.
Erin: Hi everybody. I am the Director of Intelligence and Collections at DarkOwl and I’m going to talk you through some background on the dark web and some OSINT investigations.
What we’re going to cover today, I’m going to give you a little bit of background on who DarkOwl are, what the dark web is, why it’s important, how we can use it in OSINT. And I’m going to do a couple of use cases and walk you through some examples of what we see on the dark web and how you might be able to use it for OSINT.
A bit of background about DarkOwl. We’ve been around since 2014, but collecting data I would say from the dark web in earnest since around 2017-2018. So, our goal is to collect data from the dark web so people are able to use that data for their investigations and to protect their organizations. We allow people to do that in a number of different ways, so you can access data through our platform Vision, which I’ll be showing you how to use today, but we also have APIs and data feeds which allow you to access dark web data, and the idea really is challenging to access the dark web, and also it can be against policies and violations to access it. It’s not easy to access and there are things on there that you might want to avoid. So we allow you to access that data in a secure way.
What kind of data do we have? We have layers of the deep and dark web as well as some surface web, although we are primarily a dark web company. Everything that you see here in red is something that we do collect from. We’re always looking to increase our coverage though and look at other areas where we see criminals, cyber threat actors, insider threats, people proposing violence, operating. So, we’re always on the lookout for other areas that we can collect from. But as I said, we’re primarily dark web, TOR, onion sites is where we get most of our data from, but we do also collect some surface websites, things like Doxbin, paste sites, certain forums where we see extremist activity being discussed, as well as underground criminal forums and markets and discussion boards. We also collect from Telegram and Discord. We see a lot of criminal activity operating in those areas. And this just gives you a breakdown of the volume of data that we have.
I believe there’s a polling question up on the board for you now. And that’s just to highlight, are there any messaging apps you’re seeing as part of your investigations at the moment that you would like to have more coverage of. As I mentioned, we do cover Telegram and Discord, but we’re always looking for other options. So please fill that in. You can have multiple choices. But going back to the slides, you’ll see that we’ve got a large volume of data that we collect. We have been collecting since 2017, and we do not remove any historical data because that can still be important to your recent investigations. And so, you can see the numbers that we have here. We also extract particular entities, so email addresses, IP addresses, credit cards and crypto addresses that can help you with your recent investigations. And we also have a large volume of data leak records that we’ll talk about in a little bit more detail.
And this is just to give you an overview of how our ecosystem works. We do have the Vision UI where you can access all of our data as well as APIs. We have several API products that allow you to generate scores and risk assessments based on the exposure that an individual has as well as context information about our data leaks.
And we also provide darknet services. So, for those that don’t have the resources and/or do not have the experience working with the dark web, we are able to do investigations and OSINT investigations on your behalf and produce reports regarding whichever you’re investigating. So, this is our Vision UI, it supports Boolean logic, it has darknet data within it, and it can also be used for alerting, but I will go through that in a lot more detail later in the presentation. But so, just so that we’re on the same page, let’s start with talking about what is the dark web.
No OSINT presentation is complete without an iceberg slide so this is our obligatory iceberg slide which breaks down the surface net, the deep net and the darknet.
We really do focus on the darknet you know collecting from onion sites, TOR, ITP, ZeroNet that is specific software that you need to download to access that and also, it’s not indexed so you need to know the URL that you are going to in order to find that information. So, it makes it a lot more difficult to navigate and identify sources that are going to be beneficial to you as part of your recent investigations. And that’s one of the things that we assist with. We, you know, have broad coverage across the dark web. We’re always looking to identify new sites and new areas where individuals are communicating or buying and selling goods. And so that allows you to be able to search that information. We also do do the deep net. So, this is not indexed by search engines, usually behind a firewall of some kind or password protected. It’s not easy to access, but it’s easier to access than the dark web. You can still do it using your usual browser. And there are a lot of forums and marketplaces and vendor shops, et cetera, that sit on the deep net. And then you also have the surface net. So this is, you know, the internet we’re all used to. It’s indexed by search engines. So, you can, you know, go to Google, go to Yahoo and find a site that you’re looking for and it’s all open. I would say more and more we are seeing fights on the surface web that are also engaging in criminal activity. People seem to be less concerned about obfuscating what they’re doing then they had traditionally been and also, I think law enforcement’s been quite successful in taking down some dark net sites and that has kind of moved people onto the surface net so that’s an interesting trend that we’re seeing at the moment and that’s why we cover those areas as well as just the dark net.
To give you a little bit of history on the darknet, It started in around 2000. The Darknet Tor project itself was actually created by the US Navy as a means of secure communications for their operations. And then they decided to make it an open source tool. The Tor project is a not-for-profit that runs Tor and the onion sites and the bridges, et cetera. It’s always worth noting that there are fully legitimate reasons for using the dark web for those that live in countries where communications may be limited and, you know, they may not be able to access mainstream media, things like that. Tor can be used for that. And also, people who do really want privacy. They can use the dark web to enable that privacy. I’m not going to go through everything here on this slide obviously it goes up to 2020, but you can see that there’s been a lot of things that have happened in the darknet, things like cryptocurrency becoming more prevalent and being a semi-private way of people transacting and law enforcement operating on the dark web to take down sites has been a game changer as well. But there’s a lot of things that have happened on the dark web ecosystem and continue to happen to this day.
Okay, so why is dark web data important? I’ve kind of touched on this, but a lot of criminals operate on the dark web. So, we see people communicating on the dark web in forums, in messaging apps, having conversations, but we also see people selling and buying goods. We see people offering services. There is a lot of activity that happens on the dark web that can be useful to your investigations. And there’s also sites where people’s data is released. So, data leaks, stealer logs will go into in a little bit of detail, as well as things like DoxBin where people’s information is released. So, it can really help you in your investigations identifying information about individuals, but also can help you to kind of protect individuals from an executive protection perspective and we’ll talk about that in a bit more detail as well.
While we’re level setting on dark web, hopefully everyone on this webinar is aware of what OSINT is, but it’s basically the collection analysis and dissemination of information that is gathered from publicly accessible sources and these are a couple the sources that are out there that I think are familiar to most people doing OSINT investigations. But people don’t always think of the dark net. I think some people think it’s scary. There are questions about whether or not it’s truly open. But it is in fact open. It’s harder to access, but all of the data is out there for people to go and view if they choose to. So, I like to think of it as a tool in the toolbox that an OSIN investigator has. you know, you should be looking at social media, you should be looking at public records, you should be looking at, you know, other mainstream websites that are out there, things like the Wayback Machine, but the dark web is an important element of that investigation and gives you kind of a broader overview of information that you might not get from other sources. I feel like, again, I have the obligatory iceberg slide, this is my obligatory AI generated image. You can see that it’s AI generated because it’s the Dark Wab and not Dark Web. It seems that when you give it a few too many prompts, it gets confused, but this is my obligatory AI image.
Okay, so but what things do we see on the dark web? So hopefully people are familiar with some of these. I think some are more well known but marketplaces are definitely, you know, a mainstream and one of the things that first started in the kind of criminal ecosystem of the dark web with things like Silk Road, which was not the first market, I believe, Farm was, but, you know, marketplaces for buying and selling drugs, illicit goods, hacking tools, tutorials. You can purchase hitmen, you can purchase all manner of strange things, whether or not that’s legitimate or not is something that we can also discuss.
There’s also a wide range of forums, so people kind of talking about things that interest them. Breach forums is probably one of the most famous forums out there that works in buying and selling data and sharing data. But there’s also extremist forums out there, things like the in-sell community, right-wing extremists operating on forums too or people just discussing general things not all of the forums are bad. There are some social media sites that are on the dark web too. There are mirrors of things like Facebook and Twitter that appear on the dark web so people can access them in countries where there might be censorship so that that’s one of the more legitimate areas and also we talk about social media and I’ll go onto this in the next slide as a dark web adjacent area where we do see criminals operating on mainstream social media as well.
Cryptocurrency obviously is the currency of the dark web. We still see bitcoin as the largest currency being used but things like Monero and Zcash and more of the privacy coins are also popular. You you know, wallet explorers, there are dark web wallets, there are tumblers, mixers, et cetera. So a lot of cryptocurrency activity can occur on the dark web as well as being, you know, again, perfectly legitimate information, there are a lot of new sites that are on the dark web. The BBC has a new site. I believe CNN has a new site. And there’s also just kind of other sites that share information. These can be kind of data repositories, you know, when information is leaked by whistleblowers that can sometimes appear on the dark web as well. And then we have data leaks. So rather than kind of whistleblowers, that’s more stolen data and data that’s been taken illegally. And in that vein, we also have ransomware. So, a lot of ransomware groups have leak sites on the dark web where they will kind of shame their victims into paying the ransom by saying that they are a victim and they’re gonna release the data. If the victim does not pay the ransom where they do usually then release that data which is downloadable on the dark web.
But as I mentioned, there’s also some things that we refer to as dark web adjacent. Oh, there’s a poll question. So, what areas of the dark web are of most use to you. So I’ve gone through some of them, but it’d be really interesting to know from your perspective what is most beneficial for you and your investigations and your day-to-day job. But in that thing we also have some dark web adjacent. That’s what we refer to as sites that aren’t or messaging apps or platforms that aren’t exactly on the dark web, but they’re still being used by the same community of people, i.e. usually criminals or extremists or some form of bad guy for one of the better phrase. Things like Telegram, ICQ, Jabber, Discord is a gaming site as is Twitch, where we see people are sharing classified information, they’re making threats. A lot of the so-called gore community are very active on places like Discord tends to be younger generations and people that are into gaming, as you would expect. But these are all areas that we think it’s important to also have coverage of in order to, you know, have a full coverage of these communities and these groups and how they’re interacting. Obviously, I would say there’s been some changes in Telegram. In recent months, but that we are still seeing a huge amount of people operating on Telegram in a malicious way. And then the surface web, marketplaces, vendor shops, forums, as I mentioned before, excuse me, we are seeing some people that are operating in the same way they operate on the dark web on the surface web. You can find those vendor stores and those marketplaces, which I think is an interesting evolution and how these communities are operating.
Okay, so there is a lot of data on the dark web as well. So, we’ve kind of talked about the general themes and the types of sites that there are, but there’s also a lot of different types of data and a lot of different types of information. So, a huge amount of PII appears in data leaks and is discussed on some of the sites as well. Financial information, There’s a huge ecosystem of financial fraud, people selling credit card data, selling banking information, selling details of how to operate in a financial fraud way. So, we see a lot of people doing tutorials and giving guidance about how to conduct some of these scams. There’s also a huge, as you would expect, cyber and hacking community. So, people trading malware, and exploits, and different tools that you can use, you know, the phrase script kiddies, individuals who aren’t necessarily that sophisticated enough to build code or build these vulnerabilities, but they can purchase them and execute them and still kind of use them for criminal activity. So, we see a lot of trading of those kind of things, drugs, obviously, and cryptocurrency I’ve also mentioned. There’s a lot of activity that can come from this kind of data. We see cyber-attacks. We see data exfiltration and hacking. There’s also cyber espionage. I mean, APT groups are hard to identify, but they’re definitely operating in some of these places. And insider threats as well, people, you know, talking about sharing information that they should not be sharing or making threats to their organization. These are all the types of things that we see on the dark web.
Let’s dive in a little bit more into what data we actually see and kind of try to look at it from an OSINT perspective where possible. Ransomware I have already mentioned. This is two examples of ransomware leak sites, one is LockBit, the other one, I actually don’t remember which ransomware site it is, but you can see like they will share the information about the company that has been victim of a ransomware attack.
But you can see they’re also operating the yellow image. You see that they have a Telegram channel. They are on Twitter and they are on Facebook. So they have a dark website where they share this information, but they’re also operating on kind of more of the mainstream areas. And that can be really useful for you as part of an OSINT investigation. If you’re trying to identify more information about these, you’re building that kind of what we call darknet footprint and digital footprint for these groups and how they’re operating. So, you know, their sites can give you information about them that can help with understanding how they operate. But also, you know, the information that they share while stolen and really should not be shared can be used as part of investigations as well. Especially if you’re concerned about supply chain or third party risk, understanding what data has been released about an organization can help you protect your organization if, you if one of your supply chain vendors is in there, or if you are the person that has been leaked, sorry, had been ransomed, knowing what of your data has been released and is out there for other criminals to kind of delve into, is an important thing to know. And I think some people get concerned about this data and it’s stolen data, but the thing I think people need to understand is criminals have access to this data, threat actors have access to this data and they will use it to conduct more criminal attacks, so it’s important to know what is out there from a risk perspective so you can better protect yourself.
Financial crime I’ve mentioned, we see a lot of marketplaces but also places like Telegram being used as a market for people to sell financial information. So, you can see here there’s stimulus checks being sold, there’s people selling plain credit cards, there’s other things that they’re making available on here, cash apps, etc. So there is a huge ecosystem of this financial crime.
And in the theme of markets, we also see people selling drugs and weapons on the dark web as well.
You’ll see that a lot of these markets look similar to what you would expect to see from, you know, a commerce website on the surface web as well. They provide pricing, they provide images, they also provide reviews. And that can be really useful for us from an OSINT perspective. So, you know, things that you might want to look into on these markets that can give you some clues that you can go and look through in more traditional sources. So, you know, you’ve got OSINT, sorry, you’ve got reviews, as I just mentioned. So, these are some examples of reviews. I don’t know that they are legitimate to be honest, but you’ve got the username, you’ve got the date that they purchase, And sometimes they give some information in there, like, you know, it arrived really promptly that could give you ideas about, you know, where are they based? Where are they purchasing from? And, you know, how it operates. We’ve also got here, like, more descriptions about the drugs that they’re selling. So, they’re telling you the type of drug. It’s a pressed pill. They’re made in-house. So that’s something that they’re, you know, Again, you can never really trust a threat actor, but they might be operating this themselves. That’s something to go on. And they’re also saying that we ship worldwide.
We’ve got other examples where they tell you where they’re shipping from. So, this is actually counterfeit money that they’re shipping. And they’re telling you kind of how they operate it, what techniques they have in terms of producing this counterfeit money, but also they say they’re shipping from Romania. It’s a pretty good starting point that they could be operating in Romania and that they’rei ndividuals based in that country. Again, with OSINT, you also always have to verify everything. You can’t take anything at face value, but these are data points that I think it’s important that you pull out.
And this one is a little bit maybe harder to read, but I thought it was important because they’re giving them details and almost like TTPs of how they’re operating. So they’re telling you they ship it in an envelope that it uses anti-extra bags and if it’s inspected, it will get through it. And they’re actually saying that the National Post Service is the safest way to order it and that they also use express shipping. So, if you’re doing an investigation into kind of the methodology of someone selling these drugs or counterfeit goods, I think I believe this one was still a counterfeit money. You can get from these marketplaces and from these sites information about how they are actually operating, which can really help you in your investigation and maybe where you wanna focus to identify things from other sources that are out there.
Stolen data is also a big one. I’m not really going to show real examples here because I don’t want to expose people’s PII, there’s some of that. But these are, this is Breach Forums and I believe LeapBase. These are sites that appear on the dark web where people are sharing data. And again, we get a lot of questions about is this open? I would say predominantly on these sites; the data is shared freely. Sometimes you need credits, so you need to have a reputation on the sites and that have built kind of some of that persona. But by and large, this is freely available data that again, criminals are going to have access to and it’s something to be aware of.
This gives you an idea. This is a breakdown from data that’s in our platform and Vision.
I looked at the last 90 days and it gives you a breakdown of some of the PII that is available in these leaks. So, you know, names and email addresses you’d expect, but you’re also seeing identification numbers, information about people’s genders, information about companies, phone numbers, dates of birth. You know, there’s kind of two use cases for this kind of data, I think, in the OSINT realm. One is, you know, attribution of looking at threat actors. There’s so much leaked data out there now, but threat actor information is going to appear in there as well as, you know, legitimate people’s data. So, it can really help you with that kind of attribution use case but also from a risk analysis perspective understanding what information is out there about yourself or your employees or you know individuals that you might seek to protect. This lets you know kind of what level of risk they have, what level of exposure they have and how criminals might be able to target them.
Stealer Logs is something that we’ve seen a huge rise in. They’re not new, but they just seem to be a lot more prevalent in the last year or two than they were previously. This is an example. ALIEN TXTBASE is a group that have been sharing not full stealer logs, actually, but what we would call combo stealer logs, where it has the URL, the password, and the username of an individual. And they’re making that available on Telegram. So, you know, this is great for criminals in terms of they are able to log into accounts, do account takeover attacks, depending on what URLs appear here, it could be access into someone’s network. But CELA logs are basically malware that exists on your computer or a victim’s computer and steal things like cookies like your auto fills on your browser, your passwords, and your usernames. It can also steal things like cryptocurrency wallet addresses, basically anything you’re doing on the internet, it can hoover up and we have some good blogs that I would recommend about stealer logs and how they work and how they operate and the different types of them. But they have a huge wealth of data in them.
And again, threat actors have been victims of these as well as legitimate citizens. And we’ve seen a lot of research where you are able to search for places like XXS or exploit, you know, dark web forums and see people’s user information and that can really help with attribution, but also knowing that risk of your password and your username is out there and that can be used for a variety of different attacks is really important and also because the cookies are in there it can help threat actors get past two-factor authentication and OTP codes as well, so that’s something to bear in mind. Again, I said I wasn’t going to share actual data, so I wanted to give a really basic description of how some of this data can be useful. But if you have an email address for a threat actor or someone you’re interested in understanding more about, you can search for that in leak data, and it might appear and show that it’s linked to a password. Depending on how unique that password is, you might be able to identify other accounts that they’re using because we all reuse passwords. We shouldn’t and we get told not to all the time, but most people do. So, you might be able to identify other email addresses and then you can use other OSINT techniques to find more information linked to that. There are tools out there that will allow you to search for an email address and using open-source techniques can find things like telephone numbers that link to social media accounts, that link to things like Cash App and Venmo that can give you access to the real identity of an individual. So, this is a very basic, simplistic way of talking about the workflow, but you can definitely use information and data leaks to be able to investigate individuals. I see it as another tool in the toolkit of data that’s open that you can use as part of your investigation.
We also see a lot of extremist activity on the dark web and on particularly Telegram. So, these are some images that we identified related to ISIS but we also have things on there that are you know right-wing, extremist, racist information that’s being shared and it’s important to monitor these because they can lead to real world threats and so we need to identify what is being done. You can see with the ISIS threats these were around some sporting events where they were encouraging people to target the sporting events and they were giving specific areas that they should do that and this is something we’ve definitely seen an increase of is using the dark web using things like telegram to incite violence in others and create loan actor attacks. So, it’s definitely something that needs to be monitored.
Executive protection is also a use case that we’re seeing more and more active on the dark web or the data on the dark web helping with that use case I should say. So here I’ve got and I apologize for some of the language in this, but just to highlight, on the left-hand side, we’ve got a post from DoxBin where they’re talking about X FBI agent, whether this information is accurate, I don’t know, but you can see they’re providing things like date of birth, address,] telephone number, his wife’s information, what their role was. He’s also got their daughter’s information. So, huge amounts of data are being shared about individuals on Doxbin. If you’re not monitoring that, then that’s going to be an issue because, you know, a lot of when people’s information is shared here, it can lead to real -world attacks, like things like swatting attacks. A lot of that information would come from Doxbin. You can also see we’ve got a data leak here that specifically mentioned CrowdStrike employees. Again, I haven’t provided any of the actual data, but you’ve got first name, last name, email, where they’re located, their phone number, their job title. So, this is information that’s being released about employees. And again, why you need to kind of be monitoring data leaks for your employee’s information being shared. And I think it’s really important as well that you do that from a corporate perspective of looking at corporate email addresses, but to do this completely you also need to have access to personal information too. And then the the one with the not great language so apologies again for that is it’s from 4Chan and it is an example of a particular individual that I have blanked out being threatened and being said he will be shot, shot like the healthcare CEO and it’s a long time coming. So, we can see kind of chatter and rhetoric of people making threats against individual on dark websites as well. And it’s really important to analyze those and make a judgment about, you know, the risk that these individuals pose and then using OSINT techniques to see if you can identify who these individuals are so you can have a bigger picture. 4chan unfortunately, is a difficult one to do that with because it’s anonymous, but it’s so important to know what people are discussing.
And then you can also do threat actor investigations and attribution. So, this is a bit of a historic one, but Pompompouren was the admin of Breach Forums previously. He was also on raid forums, and you know, from analyzing the data, we were able to look at the username and see that he was active on all of these different dark web forums. We were really able to build that footprint of how he’s operating, but you’ll see he was also, on Discord. And so, it really allows you to kind of understand how this person’s operating, and obviously you can analyze their language and what they’re talking about. And if there’s any clues within those forums to location and information. But I highlighted the DoxBin for executives through Actors Get Docks all the time as well. So, this is an example of information relating to him that was shared online. Several people doxed this individual. So, it’s clear now that Pompompouren was Conor Bryant Fitzpatrick. He was subsequently arrested. So, using the data, and again, this is a very simplified version, but you’re able to identify a real person based on a username and kind of how people are interacting in the community. And from that, we were able to identify telephone numbers that they use that you can do further research on IP addresses that we use. And I believe one of the IP addresses that was associated with of Fitzpatrick was actually where he was hosting breach forums, and the FBI were able to use that. He is now or he was incarcerated, he was charged. So using the data and the information online can really help you doing investigations into threat actors as well.
Okay, and we have a third question. So what use cases are most important to you? I think it’s important to understand what use cases people are working on so we can best identify kind of the data that’s going to support that from the dark web.
But with that said, I’m going to move on to a couple of quick demos to show you real world examples of how we can find data using the Vision platform (see recording for demo portion).
DarkOwl analysts regularly follow threat actors on the darknet who openly discuss cyberattacks and disseminate stolen information such as critical corporate or personal data. Such analysis helps DarkOwl’s collection team direct crawlers and technical resources to potentially actionable and high-value content for the Vision platform and its clients.
In April 2024 the UK took the unprecedented step to sanction a group known as Terrorgram as a terrorist organization. The UK was the first country to take this step, proscribing the group which consists of various Telegram channels which have been used to share and encourage extremist ideologies and methodologies. This marked the first time a group that is primarily organized on a messaging app has been declared a terrorist organization.
In this blog we will explore the origins of the group, how they operated and the current status of the organization.
Who are Terrorgram?
Terrorgram (logo to the left) was an online network of neo-Nazi and white supremacist extremists that was formed on the messaging app Telegram. The group are devoted to militant accelerationism – the idea of hastening societal collapse through violent acts and used a number of different telegram channels to spread this message.
The group’s overarching objective was to inspire terrorism, leveraging propaganda to promote “white supremacist” ideology and encourage both organized and lone-wolf attacks. The concept of encouraging terrorist attacks, rather than conducting them yourself is known as stochastic terrorism. Over the past few years, Terrorgram’s activities have triggered international law enforcement crackdowns as officials sought to contain its spread of hate and violence.
Origins, Ideology, and Objectives
Terrorgram emerged in the late 2010s as an extension of earlier extremist forums and subcultures. A major influence was the now-defunct Iron March forum, which, despite only ~1,200 users, had an outsized impact on modern neo-Nazi ideology.
Iron March popularized James Mason’s book Siege, which advocated leaderless terrorist cells to destabilize society and spark a fascist revolution. From this foundation, Terrorgram adopted a militant accelerationist doctrine: it seeks to collapse the current order through stochastic terrorism, inciting followers to commit acts of violence in hopes of triggering broader chaos.
Terrorgram promoted the ideologies of neo-fascist and white supremacists. Many of the channels they operated glorified Hitler and other fascist figures, and promoted slogans like “TRAITORS WILL HANG.” Saints culture was also heavily promoted by Terrorgram users, the culture treats right-wing terrorists and mass killers as martyrs or “saints,” praising their deeds and encouraging others to emulate them.
Figure 2: Rules to be made a “Saint” by Terrorgram
The ultimate objective of this ideology is to radicalize young extremists and drive them to commit hate-fueled attacks – against minorities, government, infrastructure – to accelerate a hoped-for collapse of multicultural society.
Communication Channels and Platforms
Terrorgram’s primary base of operations was Telegram (Figure 3 to the right) – an encrypted messaging and social media app that up until recently gave extremists a relatively unpoliced platform.
The name “Terrorgram” itself is a mashup of “Telegram” and “terrorism,” reflecting how deeply the group is tied to the chat platform. The network of Terrorgram was made up of hundreds of decentralized channels which were used to communicate and share propaganda with followers. In 2021, the network encompassed 200+ neo-Nazi channels on Telegram, many openly sharing bomb-making manuals and calls to violence. Some popular channels amassed thousands of followers (one had over 16,500) despite Telegram’s nominal efforts to ban violent content.
There is little evidence of a significant dark web presence dedicated to Terrorgram; its preferred “underground” forum is effectively Telegram itself. However, when faced with crackdowns, some members discussed migrating to more obscure encrypted apps like Signal, Briar, or Sessionto evade surveillance.
Propaganda Methods and Recruitment Tactics
Figure 4: Propaganda booklet created and shared by Terrorgram
Terrorgram’s propaganda machine was sophisticated and deliberately geared toward inciting violence from its followers. An inner circle of propagandists, the self-described “Terrorgram Collective,” produced digital manifestoscomprising of hateful ideology and practical guides. These e-magazines – circulated as PDFs in the channels – carry titles like Hard Reset and explicitly instruct readers how to commit terror attacks. In mid-2021 Terrorgram published a guide urging attacks on power grids and violence against minorities, police, journalists, and other “enemies.”
Figure 5: Propaganda shared by Terrorgram encouraging followers to attack Government, law enforcement and critical infrastructure
A second manifesto released in late 2021 combined accelerationist and eco-fascist ideology with step-by-step manuals for making weapons. By 2022, the Collective put out a third installment (the Hard Reset series) that glorified recent white supremacist attacks and detailed critical infrastructure targeting strategies, in December 2023 a Terrorgram manual described how to manufacture explosives from urea nitrate fertilizer.
Figure 6: Propaganda created by Terrorgram
Text publications are not the only types of publications that Terrorgram have produced, they have also leveraged multimedia. In October 2022, it released a 24-minute film titled “White Terror,” which celebrated dozens of terrorists from 1968 to present, hailing them as saints and martyrs. The video used actual shooter livestream footage, including clips from the 2019 Christchurch massacre and 2022 Buffalo supermarket attack, and news reels, as well as extremist messaging. The video explicitly urged viewers to carry out new terror acts, promising that “future attacks will be honored.”
In order to spread this information, the group maintained multiple channels. The channel admins would cross-promote one another’s groups, sharing posts and links to encourage followers to subscribe across the network. This created an environment in which any newcomers who found one Terrorgram channel would soon be exposed to many more.
The group also heavily relied on the use of memes and images to share their propaganda; controversial memes, catchy slogans, and insider symbols,like skull masks and sonnenrads, were used to build a subcultural identity that could appeal to alienated individuals.
Figure 7: Telegram message depicting the skull mask widely used by terrorgram and mass shooters
Notable Messages and Incidents Attributed to Terrorgram
The Terrorgram group were successful in using their propaganda to incite real world acts of violence:
In October 2022, a 19-year-old gunman attacked an LGBTQ bar in Bratislava, Slovakia, killing two people. In his manifesto, the shooter explicitly credited the Terrorgram Collective as an inspiration. Terrorgram channels hailed him as a martyr after the fact, adding him to their list of “saints.”
In early 2023, FBI agents foiled a plan to attack the electrical grid around Baltimore, Maryland, arresting Brandon Russell (an Atomwaffen Division founder) and an accomplice. Both were active in Terrorgram circles and had been sharing the network’s materials.
In January 2024, agents raiding the Florida home of a man found he had a Terrorgram-produced manual and a copy of Mein Kampf alongside plans for a mass shooting. Lightner had posted on Telegram about wanting to murder people of color and Jews.
Brazilian investigators suspect that a 2022 school shooter in Aracruz, Brazil (who killed 4 people) had engaged with neo-Nazi online content aligned with Terrorgram’s ideology.
In August 2024, a young man carried out a knife attack at a mosque in Eskisehir, Turkey, injuring several worshippers – an incident the U.S. State Department later cited as having been “motivated and facilitated” by Terrorgram propaganda.
In January 2025, an extremist in Nashville committed a school shooting that channels in the network celebrated as part of their “accelerationist” campaign.
It is believed that the Terrorgram were successful inciting violence in others and encouraging lone wolf attacks as they were very specific about what they were asking their followers to do. The group would often provide targeting lists as well as tactical guides and information about the successes and failures of previous mass shooters as a blueprint for future attacks. The network has circulated spreadsheets of critical infrastructure sites and personal information of officials/journalists deemed enemies. It had also urged followers to attack power stations, synagogues, LGBTQ venues, refugee centers – any targets that fit its apocalyptic white supremacist worldview.
Law Enforcement Actions and Countermeasures
In April 2024, the United Kingdom formally proscribed the Terrorgram Collective as a terrorist organization, making it a criminal offense to belong to or support it. British officials warned that the network “spreads vile propaganda” and “aims to radicalize young people to conduct heinous terrorist acts.” This UK ban put Terrorgram in the same category as ISIS or National Action (another neo-Nazi group), signaling how seriously authorities viewed the threat. The group were then also designated by the United States Government in January 2025.
Police in Canada arrested two Ontario men in December 2023 on terrorism charges for their role in creating Terrorgram propaganda. These individuals, identified in court documents as Matthew Althorpe and Kristoffer Nippak, allegedly helped author the Terrorgram manifestos and produced recruiting videos for Atomwaffen Division. One was charged with multiple counts of participating in and facilitating a terrorist group and even instructing others to carry out terrorism. The other faced a lesser charge of contributing to a terrorist group’s activities.
In September 2024, federal prosecutors in California unsealed a 15-count indictment against Dallas Erin Humberand Matthew Robert Allison, accused ringleaders of the Terrorgram Collective. According to the Department of Justice, Humber and Allison used Telegram to solicit hate crimes and terrorist attacksagainst Black, Jewish, LGBTQ, and immigrant communities, and even solicited the murder of specific government officials. These arrests were a significant blow to Terrorgram’s leadership, as Humber and Allison were believed to be key organizers behind the scenes, their Telegram aliases “Ryder_Returns” and “BTC” were well-known in the extremist chats.
Since the arrest of Telegram’s CEO in 2024, Telegram has changed its terms and conditions and how it operates with law enforcement to respond to claims they allow extremist and other criminal activity to be openly shared on their platform. While Telegram has insisted that “calls to violence have no place” on its service and claims it removed several channels using the “Terrorgram” name in the past, it is clear that these groups were allowed to operate for multiple years with no consequences from the platform, allowing them to incite violence and lead to the murder and plots to murder multiple individuals.
Current Status of the Group
With its leaders behind bars or on the run and global sanctions in place, the Terrorgram network has been severely disrupted as of 2025. Counterterrorism experts observe that a string of arrests in the U.S., Canada, Europe, and elsewhere over 2023–2024 dismantled the collective’s structure. Many of the most active channels went quiet or into lockdown mode following the crackdowns.
Terrorgram as an identifiable entity has not openly rebranded under a new name – at least not yet. It is possible that remnants of the community have splintered into smaller cells or migrated to other fringe platforms without the Terrorgram label. Indeed, the ideology of militant accelerationism predated Terrorgram and will persist beyond it, so authorities remain vigilant for copycats.
Conclusion
Terrorgram’s story—from its genesis in shadowy neo-Nazi forums to its rapid expansion on Telegram, and finally to its undoing by global law enforcement—underscores the evolving landscape of extremist threats. It operated at the volatile intersection of online subculture and real-world violence, proving that internet memes and manifestos can indeed have deadly consequences. While the collective as originally known has been largely torn down, the ideological fuel it spread is still out there. Counterterrorism efforts will need to remain adaptable and collaborative across borders to prevent the next “Terrorgram” from taking root.
DarkOwl, a leading provider of darknet intelligence and insights, and SET University, a premier institution dedicated to science, entrepreneurship, and technology, Kyiv, Ukraine, are proud to announce a partnership aimed at advancing cybersecurity training and research.
This collaboration will provide SET University students with unique opportunities to engage in cutting-edge research, hands-on training, and career development initiatives in the field of cybersecurity and darknet intelligence. The partnership will involve joint projects, knowledge exchange, and participation in industry events, including hackathons and training programs.
“As we know, cybersecurity threats are evolving rapidly. It is crucial to equip the next generation of professionals with the necessary skills to combat them,” Mark Turnage, CEO and Co-founder at DarkOwl. “By partnering with SET University, we will be doing just this – creating and supporting an environment where students can gain practical experience and contribute to real-world security solutions. We are excited to support SET University’s mission in providing student top-tier education and access to global experts.”
Iryna Volnytska, President of SET University, adds, “Cybersecurity is about always staying ahead. At SET University, we’re building a new generation of cybersecurity leaders who don’t just react to risks but anticipate and outsmart them. That’s why we’re partnering with DarkOwl, the leader in darknet intelligence, through an MoU. By joining forces, we will combine world-class darknet intelligence with academic excellence to drive innovation, strengthen cyber resilience, and prepare Ukraine’s brightest minds to meet global cyber challenges.”
The partnership will also facilitate joint seminars, workshops, and training sessions, enhancing the cybersecurity expertise of students and faculty alike. By leveraging DarkOwl’s extensive knowledge in darknet intelligence, SET University aims to prepare students for careers in cybersecurity, intelligence analysis, and digital forensics to create the cybersecurity leaders of tomorrow.
About SET University SET University is a non-profit tech institution reimagining higher education through science, entrepreneurship, and technology. Based in Ukraine, SET University empowers innovators to shape the changing world and grows the future tech leaders to rebuild the Ukrainian economy. It offers transformative educational approaches, fosters startup development, and brings together the brightest minds in tech and science.
About DarkOwl DarkOwl is the industry’s leading provider of darknet data. We offer the world’s largest commercially available database of information collected from the darknet. Using machine learning and human analysts, we automatically, continuously, and anonymously collect and index darknet, deep web, and high-risk surface net data. Our platform collects and stores data in near real-time, allowing darknet sites that frequently change location and availability to be queried in a safe and secure manner without having to access the darknet itself. Customers are able to turn this data into a powerful tool to identify risk at scale and drive better decision making. For more information, contact DarkOwl.
How many Wi-Fi networks has your smartphone, laptop, or IoT device connected to over its lifetime? If your device is more than a few months old, the number could be surprisingly high. By default, devices typically store Wi-Fi access points and automatically attempt to rejoin them – even when they are not in range of the access point. As a result, they continuously broadcast a list of the networks they’re trying to connect to. This constant “auto-join” behavior may inadvertently reveal your whereabouts, commonly visited locations, and likely your home. In the wake of the recent assassination of a major healthcare executive, executive protection and security teams need to stay technologically savvy to potential privacy leaks—any technology that can be used to discover an individual’s location becomes a serious concern.
As a result of the Edward Snowden leaks, a Canadian intelligence technique, used by the Communications Security Establishment Canada (CSEC), was exposed to the public with details reported in 2014. Leaked documents from the CSEC confirm that tracking individuals via their Wi-Fi and IP metadata is far from theoretical. By starting with a known “seed” access point (often at airports or hotels), government officials identified devices connected to hotspots and traced these devices forward and backward in time through other networks. This so-called “travel node” approach leverages big-data analytics to build detailed movement profiles, revealing not only routine routes (like daily commutes) but also one-off visits to coffee shops, internet cafés, or conference centers—demonstrating just how valuable Wi-Fi metadata can be for pinpointing a person’s location and habits.
Shielding your privacy from sophisticated nation-state intelligence operations may or may not be your primary concern regarding cyber privacy. However, the technique of tracking, fingerprinting, and identifying individuals based on Wi-Fi metadata isn’t limited to nation-state actors. Open-source tools like AiroDump-ng, AirGraph-ng, and websites such as Wigle.net can also be used by less-sophisticated adversaries to potentially locate persons of interest and their routine habits.
Before we dig in, lets better understand how MAC addresses work and why they are important.
MAC Addressing
Every device that connects to a network is assigned a unique MAC address if it doesn’t already have a permanent, manufacturer-assigned one. Depending on the device, the MAC address might be completely random, partially random, permanently set once assigned, regularly reset, or permanently assigned from the factory. The important thing to consider is that some manufacturers don’t randomize your MAC address, which makes it much easier to identify you electronically.
A MAC address is typically represented as six segments of hexadecimal values, for example: 44:38:39:FF:EF:57. The first three segments (44:38:39) often represent the Organizationally Unique Identifier (OUI) associated with the device vendor—in this example, Cumulus Networks, Inc. Several MAC address lookup websites can provide further details about the vendor based on the OUI.
This is noteworthy because the MAC address is not hidden and can be captured by anyone within range of your access point, even without connecting to your network.
Below is a screenshot showing an example MAC address and its vendor details obtained by searching the OUI on an online lookup tool.
You can already see how devices that constantly broadcast their presence might leak sensitive information, but let’s take this a step further.
Tools like AiroDump-ng allow even unsophisticated actors to sniff Wi-Fi-enabled devices whether connected or unconnected to a network. Once an actor collects data from an area of interest, it can be visualized using another tool called AirGraph-ng. Both tools are free and come pre-installed in the Kali Linux operating system—a popular OS among cybersecurity professionals, hobbyists and bad actors alike.
AiroDump-ng & AirGraph-ng
Since this blog isn’t a tutorial on how to use AiroDump-ng, let’s focus on the user-friendly output graphs from AirGraph-ng and how they fit into the broader conversation on device fingerprinting and potentially identifying a person’s routine habits. For context, the data we’ll discuss was all collected using AiroDump-ng and visualized with the AirGraph-ng tool.
In the image below, you can see several key details regarding the access points and the clients connected to them. The two green circles represents a Wi-Fi access point, along with its encryption type, the number of connected devices, the MAC address, the OUI, and the ESSID (Wi-Fi name). For each access point, you can view which clients are connected, as well as other related information about the device.
It’s also possible to monitor the access points that clients are attempting to join. As mentioned earlier, Wi-Fi devices are constantly broadcasting a list of networks they’d like to connect to. The image below illustrates this: a cluster of devices probing for connections and networks stored in their settings as “auto-join.” For privacy reasons, non-public access points have been redacted from the image.
It’s also possible to monitor the access points that clients are attempting to join. As mentioned earlier, Wi-Fi devices are constantly broadcasting a list of networks they’d like to connect to. The image below illustrates this: a cluster of devices probing for connections and networks stored in their settings as “auto-join.” For privacy reasons, non-public access points have been redacted from the image.
[wiglet.net]
In the center panel, you can see multiple matches for our query, all indicating that this access point is located on The University of Texas at Austin’s downtown campus. Although we chose a public network for our research, you can imagine the privacy implications if this method were used on private networks to build a fingerprint or track someone’s daily routine across multiple access points.
Summary
In this blog, we explored how Wi-Fi metadata can reveal a person’s commonly visited locations by first examining the significance of MAC addresses. MAC addresses—whether permanent or randomly generated—provide identifiable details, including the device vendor’s Organizationally Unique Identifier (OUI). Because they’re broadcast openly, anyone in range of a Wi-Fi access point can easily capture them.
Next, we introduced practical tools like AiroDump-ng, which can sniff Wi-Fi data, and AirGraph-ng, which visualizes the relationships between access points and connected clients. Although these tools are commonly used by cybersecurity professionals, they can also be leveraged by less-sophisticated actors to gather detailed information about nearby networks and devices. Notably, devices often broadcast networks they want to join, including non-public or previously connected networks, further underscoring the privacy risks of Wi-Fi metadata.
We then demonstrated how Wigle.net can take these broadcasted ESSIDs (Wi-Fi names) and provide a geographic location of the associated access points. Our example focused on a public network at the University of Texas at Austin’s downtown campus, illustrating how even publicly visible data can reveal specific locations. The implications grow more serious if similar methods are used against private networks to build a profile of someone’s daily movements or routine.
By being aware of how simple it is to collect and analyze Wi-Fi metadata, individuals and organizations can take proactive steps to safeguard their privacy and minimize the risk of being tracked. Ultimately, these insights emphasize the importance of cyber hygiene—a blend of technological practices (like MAC address randomization and cautious network selection) and informed awareness (knowing what data is visible and how it can be used)—to protect both personal and professional security.
Check our blog on Executive Protection and the Dark Web.
Cybersecurity might as well have its own language. There are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security field or have a keen interest, one may not know. Understanding what these acronyms and terms mean is the first step to developing a thorough understanding of cybersecurity and in turn better protecting yourself, clients, and employees.
In this blog series, we aim to explain and simplify some of the most commonly used terms. Previously, we have covered bullet proof hosting, CVEs, APIs, and brute force attacks. In this edition, we dive into Zero-Day exploits.
Zero-Day Vulnerabilities
Zero-day vulnerabilities are software flaws that remain unknown to the vendor and the general IT community. Because the flaws are unknown to the public, there’s no fix available, and they become highly valuable to bad actors and nation states. With these flaws’ cybercriminals, spies, and nation-states have the unfettered opportunity to cause real damage, infiltrate networks, steal data, or cause disruption. Victims of zero-days will remain completely defenseless until the flaw is discovered and remediated.
Just last November, Microsoft released its November Patch Tuesday updates, detailing 89 security flaws. Among these were four newly revealed zero-day vulnerabilities—two of which attackers were already exploiting in the wild. For instance, one zero-day allowed malicious actors to capture password hashes. CVE-2024-43451 is described by Microsoft as a zero-day which requires very little user interaction to expose a user’s password. Single clicking or right clicking to inspect a file is enough to extract a user’s password hash.
This month’s Patch Tuesday is an example of how frequent, common, and severe zero-days are today. But many go unnoticed for months or years before they are patched and remediated. This leaves bad actors ample time to take advantage of holes within networks, gather sensitive data, and carry out cybercrime. Far from a theoretical concern, zero-days have become a fundamental part of modern cybersecurity warfare, underscoring the need for robust defense strategies, responsible disclosure policies, and a deeper understanding of how to limit our exposure to them.
Prominent Zero-Day Attacks
The WannaCry ransomware attack in May 2017 highlights the destructive potential of a zero-day exploit falling into the wrong hands. It leveraged “EternalBlue,” a powerful vulnerability initially developed by the NSA. After this zero-day exploit leaked to the public, malicious actors bundled it into WannaCry, creating a worm-like ransomware that spread to defenseless victims. Within a single day, it infected over 200,000 computers across more than 150 countries, disrupting critical operations at major organizations like FedEx and Honda, and paralyzing parts of the UK’s National Health Service. Luckily, a security researcher discovered a “kill switch” in the code that stopped the virus from infecting more victims. Many victims, running outdated and unpatched Windows systems had to decide whether to pay the ransom or suffer a major loss in data and revenue. WannaCry’s success demonstrated how a stolen zero-day exploit can trigger a global cyber crisis.
The WannaCry case raised concerns among cyber security professionals and Microsoft, who pointed out the US government was hoarding and secretly cataloging dangerous zero-day exploits that the company could have patched, had they been informed of the security flaws.
In late September 2023, Apple issued emergency patches addressing three zero-day vulnerabilities (CVE-2023-41992, CVE-2023-41991, and CVE-2023-41993) in iPhones and iPads. Researchers at Citizen Lab and Google’s Threat Analysis Group say these flaws could allow attackers to bypass signature validation, elevate privileges, and achieve remote code execution. Citizen Lab’s research linked these zero-days to an exploit chain used by Cytrox’s Predator spyware. The spyware was used against at least one high-profile target, a former Egyptian parliament member who had plans to run for president.
Stuxnet represents one of the most sophisticated uses of zero-day vulnerabilities in a real-world (not just theoretical). Discovered in 2010, this worm targeted Iran’s nuclear enrichment facilities by secretly infiltrating their systems. Once inside, Stuxnet exploited multiple zero-day Windows flaws to gain control of industrial control systems. By manipulating the speed of uranium-enriching centrifuges, the malicious code was able to physically degrade the centrifuges, causing the Iranian nuclear program to suffer constant failure. Its complexity and reliance on unpatched vulnerabilities made it a groundbreaking cyberweapon. Stuxnet’s impact extended far beyond Iran, this watershed moment in cyber security put a spotlight on the capabilities cyber weapons could have in cold and hot wars.
Bug Bounty Programs and Zero-Day Brokers
In today’s cyber-driven economy, a niche market has emerged around zero-day vulnerabilities. Recognizing the value of discovering these previously unknown flaws, many organizations now offer financial incentives to researchers who report them responsibly. These are known as “responsible disclosure” or “Bug Bounty Programs”. The amount of the reward often scales with the seriousness of the vulnerability. By inviting a global network of skilled researchers to examine their websites and infrastructure, companies can more quickly identify and fix security gaps. This approach isn’t limited to private enterprises, either; the U.S. government, including the Department of Defense and various other federal agencies, has also embraced bug bounty programs to bolster their cybersecurity defenses.
Zero-day brokers also offer substantial payouts for undiscovered security weaknesses, typically far exceeding a bug bounty. These brokers could be legitimate companies, or an underground network of cyber criminals. Either way, they have no interest in reporting the software flaw to the vendor. Instead, brokers profit by selling these unpatched vulnerabilities to well-funded entities, often government agencies, seeking to compromise targets undetected. To maintain secrecy, researchers who find these bugs must sign strict non-disclosure agreements, agreeing not to alert anyone while the broker seeks the highest bidder. In some cases, brokers may merge multiple zero-days into a single, powerful cyber weapon. This approach led Israeli-based Pegasus to dominate the mobile spyware market, as the company packaged a suite of zero-day exploits into spyware advanced enough to attract government entities throughout the world.
Industry Response and Defense
Mitigating zero-day attacks is challenging because these security gaps are unknown until they’re uncovered. Still, companies, organizations, and individual consumers can take measures to reduce their susceptibility. As a consumer, one of the most effective steps you can take is to install software updates as soon as they’re released. While zero-day vulnerabilities are initially unknown, once identified and patched, they no longer pose the same threat. Keeping your software current helps close these security gaps. For example, victims of the WannaCry ransomware had a month to apply Microsoft’s available patch for the EternalBlue zero-day, which would have protected their systems from the attack.
Organizations also need to be proactive if they want to decrease the likelihood of zero-day exploits affecting their networks and infrastructure. Since it’s impossible to write code that’s entirely immune to hidden vulnerabilities, embracing robust security measures is essential. Regular participation in bug bounty programs, comprehensive penetration testing, thorough code reviews, and responsible disclosure practices can all lower the risk of being compromised by simpler cyber-attacks and code flaws.
Curious how DarkOwl can help your organization? Contact us!
The founder and CEO of Telegram, Pavel Durov, was arrested on August 24, 2024, at Paris-Le Bourget Airport. French authorities detained him as part of an investigation into Telegram’s alleged insufficient moderation of illegal activities on its platform, including child exploitation and drug trafficking. Following his arrest, Durov was indicted on multiple charges on August 28, 2024. He was placed under judicial supervision, prohibited from leaving France, and required to post bail of €5 million. As of February 2025, Durov remains under judicial supervision in France, awaiting further legal proceedings where he must appear at a police station twice a week. Should he be found guilty the most serious charge complicity in the administration of an online platform to enable organized crime and illicit transactions carries a maximum penalty of 10 years’ imprisonment, and a €500,000 ($521,000) fine.
In response to their CEO’s arrest Telegram announced plans to enhance its moderation policies and has expressed a willingness to cooperate more closely with law enforcement. They have been seeking to ensure that they are co-operating with authorities while claiming to continue to prioritize users’ privacy.
In this blog, we will explore what changes Telegram have said they have made, what effect DarkOwl analysts are seeing in response to these changes and what impact we expect to see in the future.
What have Telegram Said?
In September 2024 Telegram announced, via Durov’s account, that they would be changing their terms of service in order to deter criminals from using the messaging platform. It was reported that Telegram would provide details of IP addresses and phone numbers to law enforcement and government agencies if they were provided with proper legal requests.
Figure 1: Announcement on Durov’s TG channel regarding changes to terms of service
As well as agreeing to comply with valid legal requests to share user information, they also announced that they would be changing how the global search feature works to make it more difficult for users to find certain channels and bots. They claimed that the global search feature had previously made it too easy for illicit channels to be discovered.
Telegram had made some changes in the past, despite claiming to be a platform that respects privacy and freedom of speech above all things, they did remove 78 ISIS channels in response to the Terrorist attack in Paris in 2015. They had also taken some action for the platform to be in reinstated in Brazil after it was banned for lack of cooperation with government agencies. However, these changes appeared to have more impact.
What Reaction have these Changes Had?
DarkOwl analysts immediately observed reactions to the arrest of Durov, but there have also been reactions to the announcements to the changes in the terms of use and the fact that they have agreed to work with law enforcement.
Not only were users talking about what had been announced by the platform, they were also appealing to them directly to ask them not to remove (ban) their channel as they were not breaking any of the terms or conditions.
Figure 3: Source: DarkOwl Vision
They were following the rules….
Figure 4: Source: DarkOwl Vision
However, Telegram was not clear about what type of content they considered to be illicit and or contravenes their terms of service.
Some other users and or groups took the decision that they would move away from Telegram and move to other platforms which they believed were more secure or more accepting of their views.
Figure 5: Source: DarkOwl Vision
Figure 6: Source: DarkOwl Vision
Others stated that they would not leave the platform, but they would continue to operate on multiple other platforms, presumably with the hope that any channels which may be removed would not stop them from being able to spread their message.
Figure 7: Source: DarkOwl Vision
While some prepared for when they thought their account would be banned.
Figure 8: Source: Telegram
What Action is Telegram Taking?
DarkOwl analysts have observed that, when using the global search fewer results are being returned which related to generic terms which relate to illicit activity. This is different behavior than the global search previously had. However, if you know which specific channel you want to find in most cases it will still appear, but not all.
Figure 9: No results returned from global search
DarkOwl analysts have observed that a number of channels which were used to share illicit material have been removed by Telegram. A variety of reasons have been provided by the platform for which they channels have been removed. They have also provided details of the specific jurisdiction that the channel broke the laws of.
Figure 10: Source: Telegram
They have also removed channels and or messages that they claim have contravened copyright laws, which indicates ha they are not just removing illicit channels but those that are contravening other types of laws.
Figure 11: Source: Telegram
One area in which Telegram have always claimed to take action is in the area of Terrorism, particularly the group ISIS. As mentioned about, since 2015 Telegram have claimed that they remove content relating to the terrorist group. However, channels continue to “pop up.”
Figure 12: Source: Telegram
Some Telegram users have taken the matter into their own hands, with groups like ISIS Watch reporting how many channels they have identified related to terrorist content and how many of them have been removed.
Figure 13: ISIS Watch Telegram Channel
Reviewing their posts from February 2023 and February 2025, it is clear that the number of channels that have been banned from the platform has increased massively. Although it cannot be confirmed, this does seem to be in correlation with the new terms of service that Telegram introduced in 2024. However, it is also possible the number of channels relating to Terrorism activity has also increased massively in the intervening time as the popularity of Telegram has grown.
Figure 14: ISIS Watch post from February 2023
Figure 15: ISIS Watch post from February 2025
What is the Future?
While DarkOwl have observed channels being removed or banned by Telegram and users talking about moving to other platforms we have not observed and actual migration away from the use of Telegram to date.
Telegram is unlike other messaging apps in that it operates more like a social media platform, allowing users to chat with strangers and share views across a wide audience. Many other messaging apps do not allow for this kind of activity, making them less attractive to Telegram users.
While telegram does seem to be making a concerted effort to make it more difficult for user to find illicit channels, if users are already in these communities, they will likely be provided with invite links to new or existing groups. Meaning that the company has only made it more difficult for outsiders to fine this information.
And while channels are being removed, there is nothing that stops users from creating new channels which share the same information. Therefore, the company are inadvertently entering a game of Wack-o-mole which is unlikely to change. It is yet to be seen if their willingness to work with law enforcement will be a deterrent to criminal actors using the site – for those outside of wester jurisdictions it is unlikely.
DarkOwl will continue to monitor this evolving situation.
Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.
In a February 11 press release, the U.K. government—along with the U.S. and Australia—announced the imposition of new sanctions targeting the Russian cyber entity “Zservers.” A day after the announcement of sanctions, Dutch Police dismantled Zservers/XHost and seized 127 associated servers. As noted in the U.K.’s press release, the Russia-based bulletproof hosting (BPH) services provider was a “key component of the Russian cybercrime supply chain” and was responsible for “facilitating crippling ransomware attacks globally.” Zservers notably provided “essential attack infrastructure” for the notorious LockBit ransomware gang. Read full article.
2. Russian military hackers deploy malicious Windows activators in Ukraine – Bleeping Computer
The Russian hacker group Sandworm (also known as “Seashell Blizzard”) has been observed targeting Windows users in Ukraine with malicious Windows activators. The cyber-espionage group—which has been linked to Military Unit 74455 of the GRU—has specifically deployed trojanized Microsoft Key Management Service (KMS) activators, fake Windows updates, and DarkCrystal RAT malware via a BACKORDER loader. It is believed that the attacks began in late 2023 and aim to “collect sensitive information from infected computers and send it to attacker-controlled servers.” Article here.
3. Meta Confirms Zero-Click WhatsApp Spyware Attack Targeting 90 Journalists, Activists – The Hacker News
Meta has confirmed that WhatsApp users have been targeted in a global spyware campaign. The campaign involved the use of spyware developed by the Israeli company Paragon Solutions, which has since received a cease and desist letter from Meta following the incident. Nearly 100 WhatsApp users were impacted by the campaign, most of whom were journalists or “other members of civil society.” As noted by The Guardian, WhatsApp shared that it had “’high confidence’ that the 90 users in question had been targeted and ‘possibly compromised.” Read more here.
4. Winnti APT41 Targets Japanese Firms in RevivalStone Cyber Espionage Campaign – The Hacker News
Researchers at the Japanese cybersecurity firm LAC have identified a new cyberespionage campaign dubbed “RevivalStone” targeting Japanese companies. The activity has been tied to the China-linked advanced persistent threat (APT) group Winnti (also known as APT41). The campaign took place in March 2024 and specifically targeted companies in the manufacturing, materials, and energy sectors. According to the researchers, the campaign uses an updated version of Winnti malware with new capabilities. Read here.
5. E.U. Sanctions Three GRU Officers For Cyberattacks Against Estonia – The Hacker News
On January 27, the Council of the European Union announced the sanctioning of three GRU officers for their role in cyberattacks against Estonia’s government in 2020. As noted in the Council’s press release, the three Russian nationals—Nikolay Korchagin, Vitaly Shevchenko, and Yuriy Denisov—gained “unauthorized access to classified information and sensitive data stored within several government ministries […] leading to the theft of thousands of confidential documents.” Learn more.
6. Spain arrests suspected hacker of US and Spanish military agencies – Bleeping Computer
Spain’s Guardia Civil and Policía Nacional have arrested “Natohub,” a notorious 18-year-old hacker in Alicante who allegedly conducted more than 40 cyberattacks against Spanish and international organizations, “including the Guardia Civil, the Ministry of Defense, NATO, the US Army, and various universities.” According to the Policía Nacional’s official press release, the suspect utilized three different pseudonyms while targeting international government organizations and accessed databases containing personal information belonging to employees and clients, as well as internal documents. Read full article.
7. North Korean Hackers Exploit PowerShell Trick to Hijack Devices in New Cyberattack – The Hacker News
The North Korean hacker group Kimusky (also known as Velvet Chollima and Emerald Sleet) has been observed using a new tactic which involves tricking its targets into “running PowerShell as an administrator and then pasting and running code provided by the threat actor.” As noted by the Microsoft Threat Intelligence team, the threat actor masquerades as a South Korean government official and attempts to build rapport with the victim before ultimately sending a spear phishing email. Read full article.
8. CISA and FBI: Ghost ransomware breached orgs in 70 countries – Bleeping Computer
On February 19, the Cybersecurity & Infrastructure Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint advisory detailing indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with Ghost (Cring) Ransomware. Since 2021, threat actors utilizing Ghost ransomware have targeted organizations in more than 70 countries. Victims have included organizations in a variety of sectors, including critical infrastructure, education, and healthcare. Learn more.
Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.
DarkOwl participated in ISS World Middle East & Africa in Dubai, UAE earlier this February. ISS World Middle East & Africa is a conference where cybersecurity technology providers exhibit to the global law enforcement and intelligence community. ISS describes itself as “the world’s largest gathering of Regional Law Enforcement, Intelligence and Homeland Security Analysts, Telecoms as well as Financial Crime Investigators responsible for Cyber Crime Investigation, Electronic Surveillance and Intelligence Gathering.”
DarkOwl has attended ISS for the last 10 years as it is an effective medium to help reinforce and grow our international presence.
ISS World takes pride in focusing on education and training covering the areas of law enforcement, public safety, and government and private sector intelligence communities. The first full day of ISS events are dedicated to training and in-depth sessions. Talks throughout the event cover topics ranging from geolocation, exploiting and circumnavigating masking tech, advanced techniques in tracing suspects, open-source tools, artificial intelligence, and more.
ISS conferences are held in various cities across the world every year like Dubai, Kuala Lumpur, Prague, Singapore, and more. ISS Dubai has consistently provided valuable opportunities to engage with law enforcement, government agencies, and commercial partners across the GCC and MENA regions.
Key Takeaways:
✅ Industry Presence: Noticeably smaller than other ISS events, but this conference is closed to the public in part because of the strong representation from regional government agencies usually affiliated with law enforcement and intelligence. ✅ Market Trends: We noted 12+ sessions devoted to the subject of OSINT and/or Darknet on the first day of the conference, alone. OSINT vendors more generally had a strong presence, from Epieos and OSINT Industries, to Cyabra and Cognyte. ✅ Strategic Partnerships: Productive discussions with potential OEM partners for whom Darknet data has become essential for end user investigators, globally. Alongside existing data partners like TRG Solutions, Maltego, Innefu and IPS, there was strong interest from key regional system integrators and government AI innovators. ✅ Speaking Session Success: Our session drew a large audience that asked several questions. The crowd was nearly 50% Emirati, but also representation from other regional agencies like the Kingdom of Jordan.
Live Demonstration of DarkOwl Vision: Darknet Intelligence Discovery and Collection
In addition to networking and promoting DarkOwl at the booth, Lindsay Whyte was able to give a live presentation to attendees demonstrating DarkOwl Vision: Darknet Intelligence Discovery and Collection. Vision UI is the industry leading platform for analysts to simply, safely, and comprehensively search the largest commercially available source of darknet data. The goal of this session was to further educate the international intelligence community on how threat actors on the darknet are evolving in their use of new tools and methodologies.
Due to the layer of anonymity it provides, the darknet is often a hub for illegal activity. However, investigating crime on the darknet and deep web poses technical challenges, including the fact that darknet sites are continually coming on and offline with pages vanishing from one minute to the next.
The technology DarkOwl leverages to scrape and index hidden digital undergrounds are key to the mission of obtaining proactive situational awareness for protection of the nation’s security initiatives.
DarkOwl Vision provides a user-friendly interface with powerful querying capabilities to search, monitor, and create alerts for critical information. DarkOwl Vision has been used to support local and federal police investigations, as well as work done in intelligence/fusion centers and federal agencies to uncover human trafficking, opioid selling, terrorism, security issues, and other illegal activity, making it the perfect tool for this audience.
After 10 years of participating in ISS Dubai, DarkOwl will continue to attend since these events reinforce our position as the “go-to” darknet search & monitoring solution in the MENA region.
In 2024 threat actors continued to be extremely active. Major cyber-attacks occurred across multiple industries and ransomware attacks increased year over year. These attacks had huge financial and reputational implications for all those targeted. However internationally, law enforcement continued to fight back against cyber actors making several high profile and important arrests.
In this blog we explore some of the more notable law enforcement activities and arrests.
Operation CRONOS
Led by the UK’s National Crime Agency (NCA), this international operation targeted the LockBit ransomware cartel. The operation dismantled key infrastructure and exposed the identity of the group’s leader, Dmitry Yuryevich Khoroshev, undermining the gang’s operations. The groups’ Dark Web site was taken offline for a period of time. Highlighting a new technique by law enforcement the NCA “hijacked” the leak site in order to update on the actions of Op CRONOS.
Figure 1: LockBit leak site taken by NCA
Rui-Siang Lin (aka “Pharoah”)
In May 2024, Rui-Siang Lin was arrested at JFK Airport for operating “Incognito Market,” a dark web narcotics marketplace that facilitated over $100 million in illegal drug sales worldwide. The Taiwanese national went by the alias “Pharoah” on the dark web drug site. According to the indictment as “the leader of Incognito market — Lin supervised all of its operations, including its employees, vendors, and customers, and had ultimate decision-making authority over every aspect of the multimillion-dollar operation.”
In a strange twist to the story, it emerged that LIN had actually trained law enforcement officers in St Lucia on cybercrime and cryptocurrency on the dark web which had been organized by the Taiwanese embassy.
Snowflake Data Breach
In June 2024 at least 100 Snowflake customers were affected by a Cyber-attack. Threat actors used exposed credentials to log in to Snowflake portals and target their customers for data exfiltration. They then sold this information on the dark web for financial gain. High profile targets included Ticketmaster, AT&T and Santander.
In November 2024 Canadian authorities arrested Alexander Connor Moucka accused of compromising multiple Snowflake cloud storage accounts and the behest of US law enforcement. Additionally, the U.S. charged John Binns in connection with these breaches, highlighting the international collaboration in combating cyber threats.
Figure 3: Ticketmaster data advertised on the DW
Tenzin Orgil
In May 2024, Tenzin Orgil was sentenced to 168 months in federal prison for participating in a drug trafficking enterprise that included the sale of methamphetamine and fentanyl on the dark web, as well as the manufacture of ecstasy and methamphetamine in clandestine laboratories. Orgil had operated on several dark web markets under several aliases selling the drugs he produced in underground laboratories. The Orange County resident pled guilty to the charges in 2023.
A prominent figure in the ransomware community, Mikail Pavlovich Matveev was arrested in Russia for his involvement in cybercrimes against Russian entities. This arrest signaled a potential shift in Russia’s stance toward domestic cybercriminals.
According to the FBI MATVEEV is linked to several ransomware variants, including LockBit, Hive and Babuk. He had previously been charged by the US government for computer crimes in 2022 but remained in Russia.
He has allegedly conducted significant attacks against both United States and worldwide businesses, including critical infrastructure. Matveev was identified as one of the alleged developers/administrators behind the Babuk ransomware variant. Matveev has been charged with multiple LockBit attacks which included a police department located within New Jersey. He has also been charged with multiple Babuk attacks including the attack against the Washington D.C. Metropolitan Police Department. In addition, Matveev has been charged with Hive-related counts of conspiracy and intentional damage to a protected computer, including an attack against a New Jersey-based company.
Scattered Spider Group
Following high-profile attacks on companies like Okta, MGM, and Caesars by a group known as Scattered Spider, authorities arrested several members of the group.
The individuals, including Ahmed Hossam Eldin Elbadawy, Noah Michael Urban, Evans Onyeaka Osiebo, Joel Martin Evans, and Tyler Robert Buchanan, faced charges related to wire fraud and identity theft. Officials said the suspects’ illegal activity spanned from September 2021 and April 2023.
Scattered Spider are a loosely affiliated group of young individuals assessed to be based in the US and UK who have conducted multiple cyber and ransomware attacks. They are known to conduct sophisticated phishing attacks and social engineering attacks on call centers in order to gain access. They are also affiliated to several ransomware groups. According to security researchers, “The group has been blamed for unusually aggressive cybercrime sprees, targeting major multinational companies as well as individual cryptocurrency investors.”
Operation Endgame
Europol coordinated an extensive operation against botnets, leading to multiple arrests and the seizure of hundreds of servers. The crackdown targeted platforms facilitating ransomware deployment, significantly disrupting the cybercrime ecosystem.
According to Europol, between 27 and 29 May 2024 Operation Endgame targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. The agency focused on arresting high value individuals, taking down infrastructure and tracking and seizing cryptocurrency payments. The operation consisted of input from several different countries as well as private companies highlighting the need for coordinated efforts to stop these cyber activities which have no borders.
Conclusion
Although law enforcement has been very successful in targeting a number of high-profile threat actor and criminal groups in 2024, many groups continue to operate in slightly different forms. The nature of criminal cyber operations means that they are very difficult to combat. Actors are spread throughout the globe, usually in countries which will not cooperate with US and European law enforcement agencies. However, it is important that law enforcement continue to send a message that these activities can be combatted and there are consequences to these actions.
As we move into 2025, we expect law enforcement activities to continue to combat the increase in ransomware attacks and disrupt markets and other areas where criminals operate. However, the pardon of Silk Road owner Ross Ulbricht by President Trump appears to send a message that leniency will be shown to some of those who profit from criminal activities.
DarkOwl is a Denver-based company that provides the world’s largest index of darknet content and the tools to efficiently find leaked or otherwise compromised sensitive data. We shorten the timeframe to detection of compromised data on the darknet, empowering organizations to swiftly detect security gaps and mitigate damage prior to misuse of their data.
