Author: kathy hoffman

What It Means, Who Must Comply, and How DarkOwl Can Help

April 28, 2026

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) represents one of the most significant shifts in U.S. cybersecurity regulation in over a decade. Signed into law in March 2022, CIRCIA establishes mandatory cyber incident reporting requirements for organizations operating across all 16 critical infrastructure sectors. With CISA’s final rule expected in May 2026, the window for preparation is rapidly closing.

This blog explains what CIRCIA requires, which organizations are subject to compliance, and how DarkOwl’s dark web intelligence platform positions covered entities to meet their obligations proactively—before an incident ever occurs.

WHAT IS CIRCIA?

CIRCIA—the Cyber Incident Reporting for Critical Infrastructure Act of 2022—grants the Cybersecurity and Infrastructure Security Agency (CISA) authority to mandate reporting of cyber incidents and ransomware payments from owners and operators of critical infrastructure. The law tasks CISA with developing and enforcing a rulemaking process that creates standardized, time-sensitive reporting obligations across the private and public sectors.

Reporting Requirements

Substantial Cyber Incidents: Covered entities must report significant cyber incidents to CISA within 72 hours of reasonably believing an incident has occurred.

Ransomware Payments: Any ransomware payment made by a covered entity must be reported to CISA within 24 hours of the payment being made.

These requirements are not merely informational. Organizations must demonstrate that they have the infrastructure and processes in place to detect incidents, assess their significance, and report within these tight windows. Failure to report carries legal consequences, including subpoena authority granted to CISA.

WHO MUST COMPLY?

CISA estimates that approximately 300,000 entities will be subject to CIRCIA’s reporting requirements once the final rule takes effect. Coverage spans all 16 critical infrastructure sectors designated by the Department of Homeland Security:

Defining ‘Covered Entities’

The final rule will define specific thresholds and criteria for which organizations within each sector qualify as “covered entities.” Based on the NPRM and public comments, covered entities are expected to include:

• Private sector organizations operating systems or networks integral to critical infrastructure functions
• Government contractors and subcontractors supporting critical infrastructure programs
• Small and mid-sized businesses meeting sector-specific ownership or operational thresholds
• Entities that own or operate industrial control systems (ICS) or operational technology (OT) environments

Importantly, covered entity status is not limited to large enterprises. The breadth of the estimated 300,000-entity scope reflects CISA’s intent to create comprehensive visibility across the critical infrastructure ecosystem, from utilities and hospitals to transportation networks and financial institutions.

HOW DARKOWL HELPS ORGANIZATIONS COMPLY

CIRCIA’s reporting obligations create a fundamental challenge: organizations cannot report what they cannot detect. The 72-hour window for substantial cyber incidents and the 24-hour window for ransomware payments demand that covered entities have continuous, proactive threat detection capabilities—not reactive, post-breach discovery processes.

DarkOwl provides dark web intelligence and credential exposure monitoring that directly addresses this challenge. Our platform enables organizations to identify indicators of compromise, data exposure, and threat actor activity before they escalate into reportable incidents—or to detect them the moment they do.

Dark Web Monitoring for Early Incident Detection

Threat actors frequently surface intent, tooling, and stolen data on dark web forums, marketplaces, and encrypted channels days or weeks before a formal attack is launched or discovered by the target organization. DarkOwl’s continuous monitoring of these environments provides covered entities with:

• Early warning of data exfiltration, including stolen credentials, proprietary documents, and sensitive internal communications appearing on dark web markets
• Detection of ransomware group communications referencing an organization or its vendors, often preceding deployment of ransomware payloads
• Identification of threat actor reconnaissance and targeting activity associated with specific sectors or infrastructure types
• Alerting on newly compromised credentials that may indicate an active breach or imminent attack

This intelligence directly supports the 72-hour reporting window by giving security teams a head start—enabling them to investigate, scope, and assess the significance of potential incidents before the clock starts.

Credential Exposure Services

Credential theft is among the most common precursors to significant cyber incidents. Compromised usernames and passwords—particularly those tied to privileged accounts, VPNs, or cloud infrastructure—frequently appear on dark web forums and criminal marketplaces following data breaches at third-party services.

DarkOwl’s credential exposure monitoring enables covered entities to:

• Continuously scan for employee and customer credentials appearing in dark web breach compilations and stealer logs
• Receive actionable alerts when new credential exposures are detected, enabling rapid password resets and account lockdowns
• Attribute credential exposure to specific breach events, supporting incident scoping and regulatory notification decisions
• Maintain an ongoing audit trail of exposure detection and response actions—critical documentation for demonstrating compliance due diligence

Demonstrating Proactive Threat Detection Capability

CIRCIA does not simply require organizations to report incidents—it implicitly requires that they have the detection infrastructure capable of identifying those incidents within compressed timeframes. Regulators and legal counsel will increasingly ask whether covered entities exercised reasonable diligence in monitoring for threats.

By deploying DarkOwl’s platform, organizations create a documented, auditable record of proactive threat intelligence activity. This serves multiple compliance functions:

• Evidence of reasonable cybersecurity diligence in the event of a regulatory inquiry or breach litigation
• Structured detection workflows that align with incident response plans and reporting procedures
• Intelligence feeds that can integrate with SIEM, SOAR, and incident response platforms to accelerate detection-to-reporting timelines
• Sector-specific threat intelligence relevant to each of the 16 critical infrastructure categories

Vendor and Supply Chain Risk Intelligence

CIRCIA’s scope extends to organizations that are integral to critical infrastructure operations—including technology vendors, managed service providers, and supply chain partners. A breach at a third-party vendor can create a reportable incident obligation for a covered entity, even if the covered entity’s own systems were not directly compromised.

DarkOwl supports supply chain risk management by monitoring for dark web activity associated with key vendors and third-party partners, providing covered entities with a broader view of their threat exposure across the entire organizational ecosystem.

CONCLUSION

CIRCIA represents a fundamental shift in how the U.S. government expects critical infrastructure operators to approach cybersecurity. Mandatory reporting obligations, compressed timelines, and broad sectoral coverage create both regulatory urgency and strategic imperative: covered entities must build proactive threat detection capabilities or face significant compliance risk.

DarkOwl’s dark web intelligence and credential exposure monitoring platform is designed precisely for this environment. By surfacing threats early—often before they escalate into reportable incidents—DarkOwl enables covered entities to meet their CIRCIA obligations, demonstrate proactive due diligence, and strengthen their overall security posture.

How can DarkOwl help your company prepare for CIRCIA compliance? Contact Us.

April 14, 2026

If 2024 signaled that ransomware was becoming a systemic threat, 2025 confirmed it. Over the course of the year, ransomware evolved into one of the most disruptive forces in the cyber landscape, affecting thousands of organizations and costing billions of dollars in damages. What distinguishes 2025 is not just the scale of attacks, but the speed, accessibility, and industrialization of ransomware operations.

In this blog we will review ransomware attacks in 2025 and how they have evolved.

A Surge in Attacks and Victims

Estimates of global ransomware attacks in 2025 ranged between roughly 7,400 and more than 9,000 incidents, representing a sharp increase, at around 40–50 percent increase over the previous year. On average, attacks were occurring at an almost continuous pace worldwide, with hundreds of organizations falling victim each month.

Victim counts followed a similar trajectory. In some datasets, more than 7,000 organizations were publicly identified as ransomware victims, while others tracked thousands more unreported or undisclosed incidents. Growth rates in victim numbers exceeded 50 percent year over year, and the final quarter of 2025 alone saw record-breaking figures.

What stands out is not just the volume, but the breadth. Ransomware was no longer reserved for high-value, carefully selected targets. Instead, it became a high-frequency, opportunistic threat—impacting organizations across every sector and size.

Who Was Targeted

One of the characteristics of ransomware activity in 2025 was its focus on critical industries. Roughly half of all attacks targeted sectors that underpin modern economies, including manufacturing, healthcare, energy, transportation, and financial services. Manufacturing, in particular, emerged as the most frequently targeted industry, accounting for a significant share of global incidents.

When production lines halt, hospitals lose access to patient systems, or energy infrastructure is disrupted, the pressure to pay a ransom increases dramatically. Cybercriminals have become adept at identifying and exploiting this urgency.

At the same time, small and medium-sized businesses continued to bear a disproportionate share of attacks. With fewer resources to invest in cybersecurity and often relying on outdated systems, these organizations presented attractive, low-resistance targets. Ransomware groups no longer needed to focus exclusively on large enterprises to generate profit; scale alone could drive returns.

Geographically, the United States remained the epicenter of ransomware activity, accounting for roughly half of all recorded attacks. Thousands of incidents were reported across the country, with Europe as a whole, and Canada also experiencing notable increases. This concentration reflects both the density of high-value targets and the interconnected nature of global supply chains.

The Cost of Ransomware

While ransom payments themselves often make headlines, they represent only a fraction of the total economic impact. In 2025, global ransomware damages were estimated at tens of billions of dollars, with some projections placing the figure as high as $57 billion.

The average cost of a ransomware attack, including downtime, recovery, legal fees, and reputational damage hovered around $5 million. Even when companies chose not to pay the ransom, recovery costs alone frequently exceeded $1 million.

Furthermore, a single attack could also impact supply chains, disrupting thousands of dependent businesses. Industry analyses throughout 2025 consistently highlighted the systemic impact of ransomware events, particularly in manufacturing and industrial sectors.

Ransomware Tactics

The tactics used by ransomware groups in 2025 reflected a shift toward greater sophistication and efficiency. Double extortion became the standard model, with attackers not only encrypting data but also exfiltrating sensitive information and threatening to release it publicly. This ensured leverage even when victims had reliable backups.

In some cases, the data was not even encrypted with victims being extorted purely on the basis of the risk posed by having their data exposed. This approach reduced operational complexity while maintaining high pressure on victims.

Artificial intelligence also played an increasingly important role. AI-driven phishing campaigns enabled attackers to craft highly convincing, personalized messages at scale, dramatically improving success rates. Automation allowed cybercriminals to launch and adapt attacks more quickly than ever before, compressing timelines and overwhelming traditional defenses. There were also the beginnings of AI being used to develop ransomware or utilize it which has been observed in early 2026.

Underlying all of this was the continued growth of ransomware-as-a-service (RaaS) platforms. These ecosystems provided tools, infrastructure, and support to affiliates, allowing even relatively inexperienced actors to carry out sophisticated attacks. As a result, the number of active ransomware groups expanded significantly, with well over a hundred groups operating throughout the year. DarkOwl monitors these leak sites so organizations can monitor if any companies in their supply chain have been impacted.

The Most Active Ransomware Groups

In 2025, several groups stood out for their scale and impact. Qilin emerged as one of the fastest-growing ransomware-as-a-service operations, leveraging an affiliate model that enabled rapid expansion and a steady stream of attacks. Its accessibility made it particularly influential in lowering the barrier to entry for new cybercriminals.

Akira was another prominent group, targeting enterprises and critical infrastructure with a high volume of attacks.

RansomHub gained notoriety for sheer scale, reportedly linked to hundreds of victims across multiple sectors.

Meanwhile, Clop continued to execute large-scale campaigns, often exploiting vulnerabilities in widely used software to compromise multiple organizations simultaneously.

In addition to these established groups, 2025 saw the rise of more fluid, collaborative networks—sometimes described as “supergroups”—where actors shared tools, infrastructure, and intelligence. This blurred the lines between distinct organizations and made attribution more difficult.

Conclusion

Ransomware in 2025 was defined by scale, speed, and systemic impact. Attacks reached record levels; victims spanned every sector, and the financial consequences extended far beyond individual organizations. The rise of new groups, maturation of existing groups, and the evolution of attack methods underscored a fundamental shift: ransomware is no longer a niche cyber threat but a core challenge for modern economies.

As organizations look ahead, the lessons of 2025 are clear. Defending against ransomware will require not only stronger technical controls but also a deeper understanding of the threat ecosystem, greater resilience in critical systems, and a willingness to adapt to an adversary that continues to evolve.

Curious how DarkOwl tracks ransomware activity? Contact us.

April 08, 2026

Imagine this: you throw on a black hoodie, turn off the lights, and sit hunched over your computer while lines of code fly across the screen. Congratulations you’re officially a “hacker.” At least that’s how movies and TV have trained us to picture it.

For decades, pop culture has leaned hard into the stereotype of the mysterious genius typing furiously in the dark, breaking into systems in seconds while dramatic music swells. Most of the time it’s wildly exaggerated, sometimes to the point of being laughable. But every now and then, a show or film comes along that actually gets parts of it right.

In this blog, we’ll review some of our favorite portrayals of hacking in media and what they nailed, what they completely missed, and why some stand out as surprisingly realistic in a sea of blinking screens and instant “I’m in!” moments. 

Mr. Robot

When it comes to television series that portray cybercrime with striking realism, USA Network’s Mr. Robot consistently ranks among the best. Airing from 2015 to 2019, the series centers on a young cybersecurity engineer in New York City whose exceptional hacking skills draw him into an underground collective of hacktivists. As he becomes entangled in their mission to dismantle corporate power structures, he evolves into a deeply flawed and morally conflicted cyber-vigilante.

Within the first episodes of the show, Hollywood’s normal treatment of hacking is thrown out the window. What would normally be shown as maniacal keyboard typing was instead focused on social engineering and email phishing. By showing these acts, it aligned more closely with activity seen by real life threat actors.

A component of Mr. Robot’s accuracy is derived from experts behind the scenes. The show consulted with Michael Bazzell, a cybercrime detective with 10 years’ experience with the FBI. In interviews, Mr. Bazzel states that all code used in the show was real and was created by the individuals on the team. If aspects of the hacking were unable to exist in the real world, those storylines would often be scrapped. Many individuals within cybersecurity applauded the show’s accuracy, expressing positive opinions of legitimate attack patterns and authentic hacker methodology.

WarGames (1983)

Released during the Cold War, the 1983 film WarGames follows high school student, David, who accidently hacks into a military computer and wages a war between the U.S. and USSR. After David mistakenly identifies the military supercomputer as belonging to a video game company, two experienced hackers introduce him to the concept of “backdoor passwords.” Using this hidden access method, they can bypass normal security protocols and enter the system, reinforcing the film’s surprisingly realistic portrayal of early computer security vulnerabilities.

Despite a seemingly unrealistic plot, President Reagan ordered a full national security review after viewing the film. This led to a determination by the Joints Chief of Staff that the plot was “technically possible” and 18 months later, President Regan released the first Presidential directive on computer security. Eventually the Computer Fraud and Abuse Act was passed in 1984 with the House Committee making specific reference to the film.

One of the key factors behind the film’s technical credibility was due to the depth of its research. During development, the screenwriters consulted with Willis Ware, author of the influential 1967 paper, Security and Privacy in Computer Systems. Ware confirmed that military computer systems could, in fact, have remote access points — a detail that helped shape the film’s central premise.

BlackHat (2015)

Leveraging the star power of Chris Hemsworth, the 2015 action thriller Blackhat follows a furloughed convict and elite hacker who becomes the only person capable of helping authorities track down cybercriminals responsible for breaching a nuclear power plant. While the film delivers explosive, high-stakes action, many cybersecurity experts have noted that its depiction of hacking techniques reflects a surprisingly authentic approach to real-world cyber operations. While the film eventually departs from realism, many experts praise the setup and the more practical elements presented in its first half.

The characters in the film are trying to prevent a malware attack, based on the Stuxnet attack, targeted at critical infrastructure. The Stuxnet attack refers to the 2009 malware attack that caused substantial damage to the Iran nuclear program after it was installed on computers at the Natanz Nuclear Facility. The malware reportedly destroyed one-fifth of Iran’s nuclear centrifuges.

Viewers also praised the film for its relatively authentic portrayal of hacking. Instead of relying solely on flashy visuals, it depicts Chris Hemsworth’s character working with black terminal screens, command-line arguments, and tools such as Tor and keyloggers. Like many successful tech-focused films,  Blackhat relied on multiple consultants during the development and production phases. One of the most prominent was former blackhat hacker turned journalist Kevin Poulsen, who previously served three years in prison and contributed extensively to the film’s technical realism. Some viewers have even speculated that Hemsworth’s character was partially inspired by Poulsen. Another consultant was mathematician Christopher McKinley, known for his analysis and hack of the dating site OKCupid.

What Hollywood Gets Wrong

While researching shows and movies for this blog, one theme repeatedly appeared when discussing believability: time. To maintain pacing and excitement, many portrayals show hacking happening almost instantly. After only a few keystrokes and quick swipes across a screen, the hacker is suddenly inside the most secure government databases. For instance, in the 2001 film Swordfish, the main character is held at gunpoint and forced to hack into the DEA’s system; something he manages to accomplish in just sixty seconds.

A separate scenario seen in entertainment, especially when focused on law enforcement, is when a victim “knows” they are being hacked. The main point of hacking a system is to do so as quietly as possible in the hopes to acquire a large amount of information. Additionally, systems will rarely start displaying UI elements that would notify you that your system is under attack.

A common theme in many cybercrime films and television shows is the choice of targets. These stories often focus on hackers going after the biggest and most powerful entities, such as governments or major financial institutions. In reality, the most frequent victims of cyberattacks are ordinary individuals who often lose personal information when hackers breach databases containing private customer data.

And finally, even though the media often depict someone yanking the power cord from a monitor to stop a hack, remember that unplugging your monitor won’t actually stop an attack on your system.

Conclusion

A trend seen with many of the shows that are praised for being realistic is the use of consulting with experts in the field. Sometimes real-world events are so strange or unbelievable that they feel like they were written for TV. Those moments can make great plot devices and when shows draw from situations that have happened, it can make their stories feel even more realistic.

As demonstrated by the film WarGames, fictional stories can still drive real-world change. President Reagan’s inquiry following the movie prompted intelligence efforts to strengthen the United States’ defensive and offensive cyber capabilities. This underscores one of the many reasons why getting these portrayals right matters – entertainment projects can leave a lasting imprint on history.

Subscribe to our weekly newsletter to get the latest delivered to your inbox!

March 17, 2026

The dark web has become a central marketplace for criminal and illicit activity, which ranges from data breaches and identity theft to the sale of illegal goods. Unlike the surface web (publicly accessible websites) and the deep web (private databases, internal systems), the dark web can only be reached through specialized tools such as the Tor browser. Although it was originally created to enable anonymity and protect user privacy, the dark web has increasingly become a hub for cybercriminal activity.

Dark web marketplaces are concealed online trading platforms that typically operate on Tor or similar networks, where anonymous sellers offer illegal goods and services. Marketplaces rely on layered security and trust systems (user verification, escrow, and PGP(pretty good privacy)-encrypted transactions), often with updates shared via channels like Telegram. To avoid takedowns, many rotate domains or use mirrors. But invite-only platforms limit access to vetted users, strengthening their safeguards.

As these threats continue to grow, law enforcement agencies around the world are stepping up their efforts to disrupt and dismantle dark web networks. Through coordinated international operations and the use of advanced digital forensics, organizations like the FBI and Europol are making measurable progress in breaking down these hidden criminal ecosystems.

Takedown Cases

Over the past several years, international law enforcement agencies have successfully dismantled multiple major dark web marketplaces. Below are brief rundowns of some of the more famous seizures of dark web marketplaces.

Silk Road

First launched in 2011, Silk Road is known as the first major Tor-based marketplace. Marketing itself as “a black-market bazaar”, it sold everything from illicit drugs to hacking tools and counterfeit IDs. In October 2013, the FBI seized the website and arrested its founder, Ross Ulbricht. Using undercover investigations, identifying server locations, and bitcoin tracking, the bureau was able to track funds back to Mr. Ulbricht and arrest other vendors operating on the site.

WallStreet Market

Prior to its seizure, Wall Street Market was the second-largest dark web marketplace in the world.In 2019, law enforcement, led by Europol, were able to track the IP address of one the administrators following the failure of their VPN. The operation involved Germany, Australia, Denmark, Moldova, Ukraine, the United Kingdom (the National Crime Agency), and the USA (DEA, FBI, and IRS), showcasing a successful cross border collaborative effort.  

Hydra Market

In 2022, the Justice Department successfully investigated and dismantled Russian marketplace, Hydra, which at the time was the largest and longest-running marketplace on the dark web. Beginning in 2015, Hydra accounted for an estimated 80% of all dark web market related cryptocurrency. In conjunction with German authorities, the IRS Criminal Investigation branch used cryptocurrency tracking methods to identify criminals using the site and pinpointed physical server locations. German authorities were then able to arrest Dmitry Pavlov, the infrastructure provider.

Archetyp Market

In June 2025, law enforcement agencies across Europe dismantled “Archetyp Market”. At the time, the market had obtained over 600K users and boasted a total transaction volume of 250 million euros. The operation, titled Deep Sentinel, unfolded over several years with investigators tracing complex financial flows and conducting extensive digital forensic analysis. More than 300 officers from Germany, the Netherlands, Romania, Spain, and Sweden coordinated efforts to dismantle the network and targeted platform administrators, moderators, key vendors, and the underlying technical infrastructure.

By combining cyber expertise, undercover operations, and partnerships, law enforcement continues to evolve its playbook to disrupt dark web marketplaces. While these shutdowns don’t eliminate the activity entirely, they create a chain reaction undermining trust in major platforms and making vendors and buyers more cautious about where and with whom they do business.

Tactics

Over the course of law enforcement’s fight against dark web marketplaces, agencies have developed and evolved an arsenal of tools and strategies to discover and dismantle the operations. Below are a few commonly used practices used in major marketplace takedowns and seizures.

Undercover Operations – In some instances of dark web marketplace takedowns, agencies will take over a market by pretending to be an administrator.In 2017, Dutch authorities operated the Hansa marketplace for approximately one month, enabling them to identify and track user information. Similar tactics have been employed by the FBI, which has previously infiltrated marketplaces and conducted small purchases to collect intelligence on sellers and administrators.

Blockchain forensics – Using blockchain forensics/intelligence, investigators are able to follow the flow of digital assets and can identify wallets that cybercriminals use to store illegal funds. This tactic has been employed in multiple dark web marketplace seizures (Silk Road, Hydra) by providing investigators with a means to identify those operating the site. Once thought to be untraceable, the process has frequently enabled the identification of cryptocurrency transactions.

Network Investigative Techniques (NITs) – In previous marketplace seizure cases, the FBI has used NITs to discover users IP or identity. These operations are authorized via a warrant and use malware or exploits to extract information from users and administrators active in the marketplace. As demonstrated in numerous cases, NITs are routinely used by law enforcement and have drawn scrutiny over the scope of data they are able to collect.

As new dark web marketplaces emerge and expand, law enforcement has adapted by developing more advanced and impactful investigative methods. Techniques such as the use of Network Investigative Techniques (NITs) have proven effective, though they remain controversial. Privacy advocates continue to raise concerns about these tactics, but as authorities refine and expand their capabilities, challenging their use may become increasingly difficult.

Conclusion

Previous law enforcement operations have demonstrated that no marketplace is beyond reach. As the mentioned cases illustrate, buyers and sellers on the dark web are not truly anonymous. Each major shutdown has resulted in numerous arrests and the seizure of millions of dollars. While these take downs have been successful, they have not curbed the creation of new marketplaces. Following the shutdown of Hydra, dark web marketplaces rebounded, and revenue climbed to $1.7 billion. Although the fight remains an uphill battle, law enforcement agencies around the world have successfully taken down several high-profile marketplaces, creating significant disruptions across the cybercriminal ecosystem.

DarkOwl has previously covered several of the aforementioned markets. Check out our blogs on Hydra and Archetyp.

March 12, 2026

The January 28 law enforcement seizure of RAMP (Russian Anonymous Marketplace) marks another inflection point in the ransomware ecosystem.

According to security researchers, RAMP was created in 2012 but “rose to prominence” in 2021 and was reportedly operated by members of the Babuk ransomware group. RAMP functioned as a Russian-language darknet forum positioned as a curated space for ransomware operators and affiliates.

Research from Yelisey Bohuslavskiy suggested RAMP may have been created by individuals with ties to Russian security services, partly as a countermeasure to the rapid expansion of Ransomware-as-a-Service (RaaS). Prior to 2020, Russian, Belarusian, and Ukrainian security agencies reportedly had substantial visibility into highly organized groups such as Ryuk, Conti, REvil, and Maze. In that context, RAMP may have functioned, in part, as an environment that allowed continued observation of the ransomware landscape as it evolved.

In a LinkedIn post, Bohuslavskiy offered a nuanced assessment of the forum’s seizure:

• Impact on lower-tier actors: RAMP’s closure disproportionately affects smaller operators who relied on the forum for distribution, recruitment, and visibility.
• Distribution disruption: Underground sellers lose a structured marketplace, though platforms like Telegram may absorb some of that displacement.
• Limited impact on top-tier groups: More sophisticated ransomware groups largely avoided RAMP, wary of its associations and potential exposure.
• Reduced visibility for Russian security services: If RAMP did function as a monitoring node, its disappearance may reduce insight into ransomware activity.

Daniel Wilcock, a threat intelligence analyst at Talion, also noted that while the RAMP operator claims to have no plans to create a new forum, actors will likely migrate to alternative darknet forums. As a result, the broader impact on the cybercrime ecosystem may be limited. In the short term, fragmentation is likely. Lower-level actors lose access to established reputation systems and launch channels. Larger entities, however, have historically demonstrated strategic resilience and operational adaptability.

The broader takeaway remains consistent: infrastructure disruptions rarely eliminate ransomware ecosystems; they redistribute them.

From a collection standpoint, this reinforces how quickly reputation and activity shift across forums when a central node disappears. We see similar dynamics in other threat environments. When a TOR-based extremist site is seized or a Telegram channel is banned, communities rarely dissolve; they fragment, migrate, and reconstitute elsewhere. The same adaptive behavior applies to cybercriminal ecosystems.

Lower-tier actors will likely continue interacting across a mix of darknet forums and messaging platforms, including Telegram.

Forums to Monitor Post-RAMP

With RAMP offline, attention is shifting toward other established and emerging hubs:

• Exploit – A longstanding Russian-language forum with structured reputation systems and consistent exploit sales, initial access offerings, and broker activity.
• DarkForums – An English-language platform blending data leaks, credential sales, cracking services, and mid-tier cybercriminal collaboration.
• XSS – Historically one of the most influential Russian cybercrime forums. Despite recurring honeypot rumors, it remains active and operational.
• BreachForums (clones and successors) – High churn, rapid rebranding cycles, and volatile trust environments that often attract opportunistic actors following major disruptions.
• ReHub – A smaller but growing Russian-language forum that has seen increased visibility following recent enforcement actions, frequently hosting access sales and service advertisements.
• LeakBase – Primarily focused on breached data distribution, credential leaks, and database sales, functioning more as a leak-centric marketplace than a full-service criminal forum.
• XForums – A mid-tier forum combining exploit discussions, account sales, and service advertisements, attracting actors displaced from larger platforms.
• HydraForums – Not directly affiliated with the original Hydra marketplace but leveraging brand recognition; hosts cybercrime services, data leaks, and marketplace-style listings.

Rather than a single dominant ransomware forum emerging immediately, we may be entering a prolonged phase of decentralization: parallel ecosystems, shorter trust cycles, and increased cross-platform migration. The BreachForums seizure produced a similar dynamic. These actors do not stop operating – they evolve, reorganize, and migrate. For threat intelligence teams and researchers, this reinforces the need to expand monitoring horizontally and strengthen cross-forum actor correlation.

Stay up to date with the latest in the dark web space. Follow us on LinkedIn.

March 09, 2026

On 28 February 2026, the United States and Israel launched airstrikes against Iran targeting key military commanders, nuclear facilities, and government infrastructure. The attacks reportedly resulted in the death of Supreme Leader Ali Khamenei, along with several senior officials. Iran immediately retaliated using drones and missiles against U.S. bases in the region as well as targets in Israel. Missile strikes were also reported in Saudi Arabia, the UAE, and Qatar. The conflict continues to escalate, with the U.S. government reportedly pursuing regime change while Iran seeks to demonstrate regional military capability.

As these real-world events unfold, communities on the dark web and adjacent platforms have also reacted to the conflict. Some groups have participated in cyberattacks, others have provided commentary, and many have used messaging platforms such as Telegram to share real-time updates. This blog explores reactions observed across these ecosystems.

Hacktivist Groups

Hacktivist groups are online collectives or loosely organized networks that use hacking or disruptive digital tactics to promote a political, social, or ideological cause. These groups have become increasingly visible on platforms such as X (Twitter) and Telegram, where they seek notoriety for their activities, particularly during major geopolitical events such as the conflict in Ukraine and the October 7 attacks in Israel. The strikes against Iran have similarly prompted increased hacktivist activity.

Common attack types associated with hacktivist groups include:

• Distributed Denial of Service (DDoS) attacks: overwhelming a website or online service with large volumes of traffic, rendering it slow or unavailable to legitimate users.

• Website defacement: compromising a website and replacing its content with propaganda, slogans, threats, or political messaging.

• Data leaks: hackers steal and publish emails, documents, or internal files to embarrass or expose targeted organizations.

Although other types of cyber activity may occur, these represent the primary tactics observed among the hacktivist groups tracked by DarkOwl.

There has been a noticeable increase in hacktivist activity following the airstrikes on Iran, with many groups taking sides and targeting organizations or countries they perceive to be involved in the conflict. Several groups that previously supported pro-Palestinian causes have also opposed the strikes on Iran due to their broader opposition to Israel.

According to a recent report from Radware, 110 organizations were targeted across 149 hacktivist-driven DDoS attacks in the immediate aftermath of the U.S.-Israel campaign against Iran. Of these incidents, 107 were targeted entities in the Middle East, primarily focusing on public infrastructure and government institutions.

The Tunisian hacktivist group Hider Nex posted on 28 February, after a 10-day hiatus, claiming to have launched an attack against an Israeli telecommunications company in response to the strikes on Iran. The activity appeared to involve a DDoS attack. In their messaging, the group stated they “support Iran in the war against the enemies of Islam.”

The group has continued to target organizations in Israel. However, while conducting these attacks, they have also attempted to sell DDoS services and alleged Israeli data leaks, suggesting their motivations may be partly financial rather than purely ideological.

Another hacktivist group, Nation of Saviors, changed its Telegram profile image to depict the deceased Iranian Supreme Leader.

A Russian-affiliated hacktivist group known as Babayo Eror System began posting on 1 March, claiming attacks against U.S. and Israeli websites.

The group has also reposted content from Keymous+, a pro-Russian collective that has issued threats against Gulf states, arguing that these countries stand to benefit from U.S. and Israeli strikes on Iran. The group has framed these activities under the hashtag #Op_Epstein_Gulf, an apparent reference to disgraced financier Jeffrey Epstein.

While most hacktivist groups observed have focused primarily on DDoS attacks and website defacement, some are expanding their messaging to include references to potential targets and reported casualties. Additional information related to this activity is discussed later in this blog.

Many of these groups are also sharing videos and images related to the conflict, as well as commentary from politicians and public figures. While some of this content appears to be AI-generated, other material appears legitimate; however, the authenticity of these images and videos has not been independently verified. Some media also appears to be forwarded directly from news sources.

The mixture of authentic media, reposted news footage, and AI-generated imagery reflects a broader pattern of information amplification and narrative shaping commonly observed in hacktivist online ecosystems.

The group Z-BL4CX-H4T shared a video appearing to show a hanger filled with drones and followed this with posts listing countries they claimed Iran had successfully attacked.

The group also claimed that North Korea was supporting Iran in attacks against US and Israel affiliated sites.

News

As with previous conflicts, Telegram has become a major source of real-time information sharing. Numerous posts on the platform have circulated footage of missile strikes, images of military equipment, and updates from official organizations.

The Telegram channel ايران بالعربي (Iran in Arabic), which supports the Iranian government, shared images, and video footage of protests allegedly criticizing U.S. imperialism. The post claimed the protest took place in Stockholm, although DarkOwl has not verified the authenticity of these images.

The channel also shared images that appear to show people celebrating in the streets of Tehran.

As during the October 7 attacks, the IDF Telegram channel has been used to share official updates and warnings with Israeli citizens, including guidance on whether residents should take shelter.

News agencies have also circulated urgent warnings, identifying areas being targeted.

Additional videos circulating on Telegram appear to show damage from airstrikes in civilian areas. These images have not been independently verified by DarkOwl.

Other imagery shared on Telegram attempts to link the conflict in Iran with the ongoing war in Gaza.

Several groups associated with white supremacist ideology have also commented on the conflict.

One group stated that while they oppose Israel due to antisemitic beliefs, they also do not support Iran due to its Muslim identity, reflecting their ideological vision of a white, Christian ethno-state.

However, another Telegram channel shared an AI-generated image supporting Iran, which included both the Iranian flag and the Sonnenrad symbol, commonly associated with neo-Nazi and Atomwaffen-affiliated extremist groups.

This example highlights a broader trend in which ideological boundaries are increasingly blurred, particularly among groups linked to Nihilistic Violent Extremism (NVE).

Islamic Extremist & Jihadist Responses

DarkOwl monitors a range of Telegram and Rocket.Chat channels used by jihadist groups and their supporters, including communities linked to ISIS and al-Qaeda. Early reactions to the Israel–Iran conflict have emerged across these platforms.

A statement attributed to a group calling itself the Cyber Jihad Movement was identified on March 4, 2026, by counterterrorism researchers. The English-language document presents the group as an “IT organization linked to al-Qaeda” and calls on supporters to participate in what it describes as a “global cyber jihad.”

The statement encourages technically skilled supporters to conduct cyber operations targeting the governments and institutions of the United States, Israel, Pakistan, India, and several Arab countries, including cyberattacks designed to disrupt financial systems and government infrastructure.

The document also announces the group’s “entry” into the Iran–United States conflict and the Afghanistan–Pakistan conflict, expressing support for the Pakistani Taliban (TTP) and the Islamic Emirate of Afghanistan (Taliban).

While there is currently no public evidence of operational capability associated with the Cyber Jihad Movement, the messaging reflects ongoing attempts by jihadist-aligned actors to frame cyber activity as a legitimate extension of militant struggle.

Supporters of the Islamic State also discussed the conflict on an unofficial Rocket.Chat server historically used by IS sympathizers.

Users shared reactions to early reports of the conflict, often expressing hostility toward Iran and Shia Muslims.

Some users suggested that prolonged military pressure on Iran could create opportunities for expansion by Islamic State Khorasan Province (ISKP).

Some participants framed the conflict as validation of Islamic State narratives about its ability to challenge global powers.

Discussion on the server also revealed growing paranoia about infiltration by researchers and law enforcement, particularly following arrests linked to previous administrators of the community.

These conversations illustrate how jihadist communities interpret geopolitical events through ideological narratives while simultaneously dealing with internal distrust and operational pressure.

Iranian Aligned Militia Responses

Iranian-aligned militia groups across Iraq and the broader “Axis of Resistance” ecosystem have also used Telegram channels to shape narratives surrounding the conflict, combining operational claims, ideological messaging, and propaganda directed at regional and Western audiences.

Safwa Unit (Kata’ib Hezbollah)

The group وحدة الصفوة (Safwa Unit), which claims affiliation with Kata’ib Hezbollah, has circulated graphics identifying alleged Israeli targets, including Israeli officials and public figures.

The channel has also shared imagery commemorating individuals it describes as Hezbollah “martyrs.”

Such messaging blends propaganda and intimidation and reflects a broader pattern of militant-aligned channels using visual propaganda to signal potential targets while reinforcing narratives of resistance.

Ashab al-Kahf (PMF / Kata’ib Sarkhat al-Quds)

Another Telegram channel monitored by DarkOwl is أصحاب الكهف (Ashab al-Kahf), affiliated with Iraqi Popular Mobilization Forces (PMF) factions including Kata’ib Sarkhat al-Quds (كتائب صرخة القدس).

Recent posts on the channel have focused on the conflict and tensions involving U.S. forces.

One statement claimed responsibility for targeting a U.S. military base in Kuwait using drones, warning that operations would escalate.

Other posts emphasized ideological alignment with Iranian Supreme Leader Ali Khamenei, framing the conflict as part of a broader struggle against Western influence.

The channel also shared stylized propaganda imagery depicting Khamenei in militant imagery.

Taken together, this content illustrates how Iranian-aligned militia channels blend operational claims, ideological messaging, and propaganda to frame regional conflict narratives.

Conclusion

Communities across the dark web and adjacent platforms are actively reacting to the escalating conflict between Iran, Israel, and the United States. These reactions vary widely depending on the ideological orientation of each community.

Hacktivist groups have attempted cyberattacks against perceived adversaries; news channels have used Telegram to disseminate real-time updates, and extremist communities have leveraged the conflict to amplify propaganda narratives.

As the conflict continues to evolve, online discourse within these ecosystems will shift alongside real-world developments. DarkOwl will continue monitoring these platforms for emerging threats, cyber activity, and extremist messaging related to the conflict.

Follow us on LinkedIn to stay up to date.

March 5, 2026

Ransomware isn’t just malware, it is an operating model. Increasingly, ransomware groups as well as extorting victims themselves, have also operated “affiliate programs,” often called Ransomware-as-a-Service (RaaS). In this arrangement, a core team provides the tooling and brand, while affiliates conduct intrusions and share the proceeds with the owners of the malware.

This blog breaks down how the affiliate model works, why it persists, and which ransomware “brands” researchers most often associated with affiliate-driven operations in 2025.

What is a ransomware affiliate program?

A ransomware affiliate program is a partnership structure between a core operator group – usually developers and infrastructure maintainers – and affiliates which usually consist of intrusion teams who deploy ransomware and run extortion negotiations with the victim, with revenue typically split between them. Think of it as a criminal version of a platform business: the “platform” team builds and maintains the product (ransomware + infrastructure), while “partners” scale distribution (intrusions) in exchange for a share of profits.

The RaaS division of labor – who does what?

The core group are usually responsible for maintaining the ransomware codebase and continually updating it to evade defenses; they will also host negotiation portals, victim dashboards, and leak sites where victim data is shared on the dark web.

They will also provide “support” to affiliates by providing troubleshooting services, process guidance and other things to ensure that the affiliates are successful.

Affiliate programs usually have a strict set of rules on how the ransomware can be used. The core group sets these rules and enforces program rules; these usually cover who can target what, what tactics are allowed, and dispute handling.

The Affiliate groups are usually responsible for choosing targets and executing intrusions using the malware they are supplied by the core groups. They will also perform data theft and later-stage deployment steps, run negotiations, which can sometimes have operator oversight or supplied templates. They will also coordinate payment verification and handoff of decryption. However, this can vary by program with different groups having different practices and different revenue shares.

Although the core group and the affiliates are the main practitioners, other threat actors can also be involved in this ecosystem such as Initial Access Brokers (IABs) who sell access to compromised environments which the ransomware group or affiliates will then use to target victims. There can also be specialist roles for credential theft, phishing, negotiation, laundering, etc.

This separation makes attribution harder for researchers and explains why the same intrusion patterns can “carry over” even when a ransomware “brand” changes.

What affiliates “get” from the program

Most established RaaS operations provide a bundle that looks like a grim SaaS product, this can include Affiliate panels / dashboards to manage victims, builds, and negotiations, a standardized extortion workflow which can include victim instructions, negotiation playbooks, as well as product support. They will also be provided with access to leak site infrastructure, hosted on the dark web, to publish victim data and increase pressure. As well as being provided with all the tools, being an affiliate is an attractive prospect as it also provides brand credibility. A known “name” can increase perceived threat and victim payment rates. Not all ransomware groups are the same, and some have the reputation for being successful and or being able to target high profile victims.

The typical lifecycle

While the entry method differs by actor, many affiliate-run incidents follow a familiar lifecycle:

1. Initial Access: The threat actor will obtain access to the victim’s infrastructure commonly via stolen credentials, exposed services, or purchased access, from an initial access broker. Increasingly data leaked after a ransomware attack can be used to target a supply chain.
2. Data Theft: While traditionally ransomware encrypted data so the victim could not access it, that is not usually the case anymore with most actors simply exfiltrating as much data as they can from the victim. This data will then be used to extort the victim in the hope that the “ransom” will be paid to avoid the financial and reputational damage of having data shared on the dark web.
3. Encryption & Ransom: Some actors do still use an encryption method as part of their tactics, and in all cases will issue a ransom note which will provide details of their demands – usually payment in cryptocurrency. Many groups position themselves in these notes as researchers who are helping the victim avoid damage. Whether encryption occurs is sometimes secondary, the “business” is often extortion, not encryption.
4. Negotiation: Usually through the ransom note the victim is provided with a timeline in which to pay the ransom to avoid having their data released; this can also appear as a countdown on the darkweb leak site. The actors will often provide a portal for the victim to contact the threat actor, often on the dark web where negotiation can happen. As most victims do not disclose if they have paid the ransom or not, we do not have a clear picture of how these negotiations play out.
5. Payment or Leak: If the victim chooses to pay the ransom, they will be provided with a cryptocurrency address in which to make the payment to. They will be provided with a decryptor, if the data was actually encrypted and the victim’s name will be removed from the leak site. However, the fact that the victim appeared on the page and then removed can suggest payment was made and can still cause reputational damage.

Many 2025 “top group” lists rely on data-leak site postings as a proxy for activity, but it undercounts failed extortions, private settlements, and unposted victims. Furthermore, as the data has been exfiltrated, there is no guarantee that making the payment means the data will not be released at some point. If the payment is not made, the data will be made available for download on the leak site.

How the money works: revenue share + trust problems

Affiliate programs need incentives and mechanisms to manage distrust and also to attract “good” actors to run operations. The programs usually work on the basis of revenue splits, where the affiliate keeps the larger portion, and operators take a platform fee.

Affiliates will often choose a ransomware brand that has not only had public success but also that are perceived as reliable payers. They may work with multiple groups. RaaS operators compete for affiliates with better splits, better support, more stable infrastructure, and broader “brand” recognition.

However, the core group can also be picky about who they work with, some groups are reported to only work with affiliates from certain countries and will set up their systems in a way to avoid exit scams, where operators steal all of the proceeds and do not pay the platform fee.

Takedowns, leaks, and internal conflicts lead can lead to splits, rebrands, and “new” groups that may be continuity operations rather than truly new actors. When a brand is disrupted, affiliates don’t disappear; they migrate, bringing tradecraft and victim targeting patterns with them.

Main ransomware brands commonly linked to affiliate-driven activity

Below are ransomware “brands” reported to be operating in an affiliate-friendly or RaaS-like manner. This is not exhaustive, and “brand” ≠ a single consistent team.

All of these groups are tracked by DarkOwl, with their leak sites being closely monitored for new victims.

Conclusion

Ransomware affiliate programs persist because they’re efficient; they turn a complex criminal operation into a repeatable platform. In 2025, the most important researcher takeaway isn’t just which brand is “on top,” but how affiliates move, how brands compete for them, and how extortion infrastructure evolves across disruptions.

Learn how DarkOwl tracks these groups and more. Contact us.

February 26, 2026

Cyberattacks rarely occur on impact. There are often early warning signals.

Long before ransomware detonates, credentials are stolen and sold, meaning data is quietly being exfiltrated from the system. Meaning there are indicators. Slight behavior shifts. Fragments of telemetry that, viewed individually, look harmless. Viewed as a collective, they tell a story.

Most organizations do not fall victim because they lack tools. They become victims because they lose or dismiss early warning signals as noise.

If you want to interrupt an attack before it becomes an incident, you have to know what to look for and you have to treat weak signals seriously.

1. Identity Anomalies that Do Not Make Sense

Identity is the primary control plane in modern environments. According to the 2024 Verizon Data Breach Investigations Report, the majority of breaches continue to involve the human element, including stolen credentials and social engineering.

Early warning signs often appear in authentication telemetry before anything else.

Look for:

• Repeated failed logins followed by a successful login from the same account
• Logins from atypical geographies or impossible travel scenarios
• Dormant accounts suddenly becoming active
• Privilege escalation requests that do not align with job functions

These are not necessarily breaches. But they are often precursors.

Adversaries frequently test credentials quietly before operationalizing access. The MITRE ATT&CK framework documents techniques such as credential stuffing, password spraying, and valid account abuse under Initial Access and Persistence tactics.

If identity behavior shifts, assume it is meaningful until proven otherwise.

2. MFA Fatigue and Push Bombing

Multifactor authentication is not invincible. Attackers increasingly exploit user behavior instead of cryptographic weaknesses.

Push bombing, also known as MFA (multifactor authentication) fatigue, floods a user with repeated authentication prompts until they approve one out of frustration or confusion. The Cybersecurity and Infrastructure Security Agency has published guidance highlighting this growing tactic.

Early warning indicators include:

• Multiple MFA prompts within short time periods
• Authentication approvals outside normal working hours
• Users reporting repeated push requests they did not initiate

When a user comments, “I keep getting login prompts even though I’m not trying to sign in” that’s not a help desk or internal IT nuisance. It’s an intrusion attempt in progress.

3. Unexpected Changes in Account Permissions

Privilege creep happens naturally over time. Attack driven privilege escalation looks different.

Take notice when you see:

• Service accounts added to privileged groups without change control documentation
• Administrative roles assigned temporarily and never revoked
• API keys created outside normal deployment pipelines

The 2023 IBM Cost of a Data Breach Report noted that organizations with mature identify and access management practices experienced significantly lower breach costs compared to those without.

Access to expansion without operational justification is rarely accidental. It is often reconnaissance or staging.

4. Anomalous Network Behavior that is Subtle

Before large scale data exfiltration occurs, the threat actors have already mapped out the environment. They enumerate systems, prob for open ports, and test lateral movements before escalations.

Signals to look for:

• Internal port scanning from a user workstation
• Lateral traffic patterns that do not match baseline behaviors
• DNS queries to newly registered or suspicious domains

According to the 2024 CrowdStrike Global Threat Report, adversaries continue to reduce breakout times, meaning the time between initial access and lateral movement can be quite short.

If your only alerts are on large data transfers, you may be waiting to react until it’s already at the end of the story. Early detection means paying attention to reconnaissance.

5. Endpoint Drift and Security Control Tampering

Attackers frequently attempt to disable security tooling before executing payloads.

Warning signals include:

• Endpoint detection agents being stopped or uninstalled
• Logging services disabled or modified
• Registry or system configuration changes affecting security posture

Again, the MITRE ATT&CK technique Impair Defenses specifically outlines how adversaries disable or modify security tools to evade detection.

If telemetry goes dark unexpectedly, treat that as an alert, not as an inconvenience.

6. Dark Web Mentions of Corporate Assets

Not all early signals originate inside your environment.

Compromised credentials, exposed API keys, and proprietary data often appear on underground forums and marketplaces before being weaponized at scale. Proactive darknet monitoring can identify leaked corporate emails, password dumps, and access listings tied to your organization.

Routinely monitoring for credential exposure and enforcing password resets and token revocation when compromise is suspected.

External signals can provide a critical time advantage.

7. User Behavior that Feels Off

Security telemetry is critical. So is human intuition.

Sometimes employees notice:

• Suspicious emails that somehow bypassed filters
• Files appearing in a shared drive that no one claims ownership of
• Systems behaving slower or differently than usual

Encouraging reporting without penalty. The 2024 Verizon DBIR emphasizes that human reporting remains a key detection source for many incidents.

If your culture discourages raising small concerns, you will only hear about problems when it is too late.

Why Weak Signals Matter

Attackers operate in stages. Initial access. Persistence. Privilege escalation. Lateral movement. Exfiltration. Impact.

Each and every stage generates signals.

Organizations that wait for definitive proof of compromise are often responding during the Impact phase. At that point, containment becomes expensive and public.

Early warning detection shifts the timeline left.

It creates opportunities to:

• Reset credentials before privilege escalation
• Isolate endpoints before ransomware deployment
• Revoke tokens before data exfiltration

The financial implications are significant. IBM reports that organizations that identified and contained breaches under 200 days save substantially compared to those with longer dwell times.

Speed matters. However, speed cannot increase without signal recognition.

Building an Early Warning Discipline

Recognizing early indicators is not about being paranoid. It is about pattern awareness and pattern detection.

Practical steps include:

• Baseline normal behaviors across identity, network, and endpoint telemetry
• Correlate weak signals across multiple control layers
• Treat identity anomalies as high priority events
• Integrate darknet monitoring into threat intelligence workflows
• Encourage user reporting and close the feedback loop.

You will never be able to eliminate all risks. The goal is to reduce attackers’ dwell time.

Cyberattacks rarely occur unannounced. The warnings are just whispers, not shouts.

Organizations need to learn to listen to those whispers and how to act before they become a crisis.

Learn how. Contact us.

February 24, 2026

Introduction

Dark web research remains a difficult domain. It is essential for uncovering illicit activity, yet fraught with ethical, operational, and legal complications. Unlike traditional threat intelligence work, dark web investigations often require some level of immersion in communities built on illicit activity and therefore requires its own set of rules and practices.

While DarkOwl Vision allows researchers to safely search and monitor the dark web without embarking on these complications, it is important to understand what the ethical and legal best practices are and what guidelines need to be followed and are followed by DarkOwl analysts.

This blog explores the key ethical and legal tensions, maps them against the DOJ’s (Department of Justice) guidance, and offers practical considerations for responsible dark web research.

DOJ’s 2020 Guidance

In February 2020, the DOJ’s Cybersecurity Unit released a guidance document titled Legal Considerations when Gathering Online Cyber Threat Intelligence and Purchasing Data from Illicit Sources.

This is the guidance in the US for which dark web research and interactions should comply with. The guidance is aimed at companies and security firms who engage in online threat intelligence gathering; this includes monitoring dark web forums, marketplaces, or purchasing data, malware, or exploit information offered in “dark markets.” The goal of the guidance is to help analysts assess their potential exposure under federal criminal law when participating in certain activities or the purpose of their research. It particularly focuses on accessing, purchasing, or using illicitly obtained data.

However, the document is not legally binding, and it does not create rights or immunity from prosecution. And it does not address all use cases and activities. For example, it explicitly does not purport to deal with every scenario (e.g., child-pornography forums or illicit drug markets may involve additional legal issues).

The guidance recommends private actors who do more than “passive monitoring” (e.g., active communication, purchasing) to:

1. create a written operational plan or “rules of engagement”
2. keep records of how data is collected and used
3. work with legal counsel before engaging in risky activities

Let’s explore some of the specific activities the guidance covers and what best practices should be.

Passive Monitoring

According to the DOJ, passive monitoring of publicly accessible dark web forums or marketplaces (reading, collecting posts, observing patterns) “poses little risk of federal criminal liability,” provided the researcher does not exploit vulnerabilities or misuse credentials.

Best practice: still maintain documentation — e.g., record what tools you used (crawler, VPN, etc.), what forums you monitored, timestamps, and your research purpose. DarkOwl Vision does this for you, so you don’t have to.

Active Participation, Purchasing Data, or Engaging on Forums

Per DOJ guidance, active communication, use of unauthorized credentials (stolen credentials), or purchase of stolen data or malware can trigger liability under federal statutes. Therefore, any of these actions need to be undertaken with extreme caution and legal advice. While researchers can create fake personas, or sock puppets, they cannot use third-party or stolen credentials to access sites. Creating sock puppets does not guarantee immunity and should be done in compliance with company policy and with documentation of what was created and for what.

Purchasing data is a very risky area; it is a must that you have proper legal authorization in place before purchasing any data. This should only be done in a “defensive” way, buying back your own data, for example. However, you must make sure that you evidence that there is no criminal intent and document the reason for purchasing the data. Legal review is essential, as well as clear and thorough documentation.

This is not just a legal matter, however. Ethically we want to ensure that we are not supporting the criminal ecosystem by providing funds to threat actors that could be used for further attacks in the future. This is why DarkOwl never buys data.

If analysts need to interact directly on the dark web, the following practices are recommended:

• Passive monitoring only (no purchases, no unauthorized credentials)
• Maintain written operational plan and rules of engagement
• Keep full logs and records of activity (what, when, why)
• Seek legal counsel before any active engagement (purchase, communication, exploit use)
• Minimize or avoid storing sensitive/stolen data; prefer metadata or anonymized indicators
• If publishing, treat attribution as probabilistic; avoid definitive claims without strong evidence
• Avoid methodologies that exploit vulnerabilities or unauthorized access to private systems/services

Conclusion

With the release of DOJ’s 2020 guidance, dark web research is no longer a completely lawless frontier for private researchers — but neither is it risk-free or ethically trivial. The guidance provides a valuable baseline for lawful behavior, but it should be treated as a floor, not a ceiling. Ethical, responsible research demands transparent documentation, strict adherence to “least-impact” principles (passive monitoring, data minimization), and legal review before engaging in higher-risk activities.

DarkOwl is the leader in darknet data. Contact us to learn how we can help with your research and monitoring.