Arms, Drugs, and Human Trafficking on the Darknet

November 09, 2022

After reporting on their discovery of multiple marketplaces on the darknet claiming to be affiliated with various organized crime organizations, our analysts decided to take a closer look to identify potential connections and overlap between the spheres of arms, drugs, and human trafficking on the darknet.

To further examine this topic, our analysts conducted an extensive survey of vendors trading on the darknet in weapons, drugs, and human trafficking. In doing so, DarkOwl analysts uncovered a confluence between the three economies, indicating a possible interrelationship between the supply routes moving drugs, weapons, and people around the world.

Weapons for Sale

Using the darknet, deep web, and high-risk surface web data, DarkOwl analysts discovered multiple arms-centric marketplaces, vendor shops, and other classified-style advertisements for the sale of illegal firearms on the darknet.

DarkOwl discovered arms for sale on darknet onion services hosted on the Tor anonymous network in English, Russian, German, and Chinese Mandarin. A few sites offer mostly similar weapons found in gun stores or gun re-sellers found around the United States. Other sites advertise military-grade weapons that are typically not available to civilians, including anti-tank guided munitions (ATGMs), e.g. Javelins, AT-4s, and NLAWs, and rocket propelled grenades (RPGs).

Darknet weapons dealers from BMG (Black Market Guns) advertise that the weapons have not been used, arrive in the original manufacturer’s factory condition, and originate from NATO stockpiles. Some of the photos of the weapons on offer include visible serial numbers and others are stock photos sourced online. Most darknet services offer worldwide shipping with some exceptions to Russia due to their strict import controls.

Figures 1 and 2: Screenshots from Black Market Guns (Source: Tor Browser Anonymous Network)

A study by Rand Corporation found that weapons sold on the darknet are typically weapons that were already in the black market or weapons that were legally owned and then redirected to the darknet. According to the same study, the US was the most common country supplying markets. Europe was cited as the largest market for darknet-purchased firearms.

Figure 3: Cache of Weapons Seized by US Department of Justice (Source)

Figure 4: Weapons for sale on Empire (Source: Tor Browser Anonymous Network)

Figure 5: Weapons for sale on FREEGUN (Source: Tor Browser Anonymous Network)

Our analysts also found listings small arms for sale on darknet and deep web services similar to those seized by law enforcement from individuals charged with conspiring to traffic narcotics and firearms.

On average, DarkOwl analysts found that the prices of firearms for sale on the darknet were the same or lower than what the same products cost on surface web sites. However, in most cases darknet traded weapons were not significantly lower than prices advertised in the surface web.

For example, a “Bushmaster AR15 Tactical Package Semi Auto Rifle” from Empire Market costs $769 USD compared to $1,800 USD on a surface website.

A “Springfield 1911 Ronin Caliber 10 mm” handgun goes for $800 USD on FREEGUN darknet marketplace and for slightly more ($899 USD) on a surface web commerce website.

Figure 6: Springfield 1911 Ronin Offer (Source: FREEGUN, Tor Anonymous Network)

Purchasing a gun online in the United States is not illegal. However, laws and regulations vary from state to state with most requiring a background check as well as other licenses to purchase more deadly weapons, especially fully automatic and semi-automatic rifles like AR-15s. Gun regulations in other parts of the world, such as the European Union, are stricter, resulting in limited access. Therefore, depending on where you are, who you are, and what legal processes you have gone through it is quite possible to purchase a weapon legally on the darknet. However, it is rational to assume that weapons are sold on the darknet for the purpose of circumventing the processes required for legal purchase.

For example, FREEGUN advertises that they work directly with smugglers and offers worldwide shipping with the exceptions of North Korea, Sudan, Tunisia, Algeria, Egypt, Iran, Iraq, Syria, and Paraguay.

“We work with smugglers from Europe, Asia and USA. They will deliver firearms to your house or drop the package at specific place.”

They also mention their stealth practices to avoid detection, including that pistols are taken apart and hidden in power tools.

Figure 7: Screenshot from FREEGUN FAQ (Source: Tor Anonymous Network)

Countries geographically close to the United States likely do not need to purchase firearms on the darknet and can rely on direct smuggling across the border. For example, it is estimated between 70% and 90% of guns recovered at crime scenes in Mexico can be followed back to the US drug cartels who smuggle them across the border. Annually about half a million weapons from the US illegally enter Mexico. Many of them are military-grade weapons and land in the hands of drug cartels.

In other areas of the world, like Europe, there is more reliance on weapons purchases via the darknet; one underground marketplace advertised itself specifically as a provider of guns to the European Union.

The legitimacy of arms for sale on the darknet is widely debated by darknet communities. As is typical on the darknet, many state that any listings of weapons for sale on Tor are scams.

Drug Trafficking

Arguably, the most well-known source of revenue for organized crime is drug trafficking. DarkOwl analysts have previously released a report detailing the presence of alleged cartel-affiliated marketplaces on the darknet and detailed some of their product offerings including sophisticated concealed shipping.

Drug trafficking is exclusive to the darknet. The marketing and sale of illicit substances occurs on the surface web, encrypted and non-encrypted chat platforms, via social media direct messages, in addition to the darknet. Online purchases of drugs are often delivered to a mailbox or a “dead drop” location, or sellers utilize mail services or international trade networks.

Encrypted communications networks can serve as a work-around to traditional darknet marketplaces and facilitate single-vendor trade or “direct deals” by interfacing with users directly. Utilizing direct deals via encrypted chats give both buyer and seller more privacy, especially from law enforcement which has become more adept at infiltrating and shutting down darknet marketplaces dedicated to illicit drugs.

According to UNODC, most of the drugs sold in the darknet ship from North America and Europe. The most common country of origin or country of shipment from greatest to least were listed as the United States, the United Kingdom, Germany, the Netherlands, Australia, and Canada.

Darknet Vendors’ Trafficking Methods

It is common for darknet vendors to talk about their delivery and stealth methods to reassure customers that their purchases will be delivered as advertised and not seized by the authorities. However, vendors and marketplaces must balance revealing enough information about their concealment techniques to gain their customers’ trust while not exposing their methods and routes resulting in law enforcement interdiction.

Some sites will simply sate that their stealth precautions are robust and therefore good for the buyers but – but do not publicly more details. Others promise that they use the “best equipment” for the “highest stealth and security possible” – or reassure customers that they are experts in some other manner.

A weapons vendor on the darknet commerce site Empire Market advertises that all items are sent with a tracking code, and offer major shipping providers like DHL, UPS, FEDEX, and postal mail as shipping options the buyer can choose from. The market suggests that small orders are shipped inside of magazines or binders, while large orders are shipped in boxes with labels made to look like eBay or Amazon packages. Rifles are often disassembled and then are shipped inside larger appliances, and customers will receive instructions separately detailing how to assemble their weapon.

Another listing from a drug vendor found on DarkOwl Vision claims that the packages they send are “untraceable” and “the most discreet.” This vendor claims to take precautions such as vacuum sealing the package, that they are all alcohol cleaned, dog proof, and x ray proof.

Human Trafficking

Some of the darker illicit goods and services able to flourish on the darknet due to its anonymity and privacy-centric nature include pornography, such as child sexual abuse material (CSAM), human trafficking, and the exploitation of humans both online and in the physical world. Criminals and traffickers have increasingly turned to the online cybersphere to exploit victims. Social media platforms can be used to identify possible victims, target them, recruit them, and then to advertise their exploitation services. The internet and darknet can be used to broadcast live acts of exploitation for distribution to a wider audience. While distributing CSAM material is not human trafficking, the production of CSAM is usually the result of trafficking children for exploitation. CSAM material is available on the darknet and in darknet-adjacent platforms.

Using the internet, traffickers can physically exploit the victim in one location but operate in multiple places at once and across borders. These are labeled as “cyber flows” and “are often characterized by victims held and coerced into video performances, allowing the perpetrators to connect with potential clients living abroad. This type of trafficking has been identified in several countries and typically relies on the availability of video equipment and digital recording devices to broadcast victims’ exploitation.”

This is the type of exploitation and human trafficking commonly seen on the darknet. For example, many times listings for human trafficking victims on the darknet will be advertised as “escort services,” “child escort services,” “rentals,” “kid rentals,” and more.

Figure 8: Screenshot from a dark web site (Source: DarkOwl Vision)

Drug Trafficking and Weapons – Connections to Organized Crime and the Darknet

Connections between drug trafficking and arms trafficking are well documented. The relationship between drugs and weapons is corroborated by both research from the government and other non-profit organizations. This same relationship is also seen on the darknet.

A darknet marketplace claiming to be affiliated with CJNG discovered by DarkOwl analysts offers drugs for sale. CJNG is one of the strongest cartels currently operating in Mexico, and would require weapons to maintain their drug trafficking routes and control.

In January of 2022 the Justice Department arrested four defendants in connection with an investigation targeting a domestic firearm trafficking organization that supplied weapons and ammunition to the Cártel Jalisco Nueva Generación.

Furthermore, the indictment alleges that a “Whittier man led the gun trafficking organization that used narcotics proceeds to purchase assault rifles, hundreds of thousands of rounds of assault rifle ammunition, and numerous machine gun parts and accessories – some of which were smuggled into Mexico, mostly since the beginning of the COVID-19 pandemic.” There is evidence suggesting that organized crime groups such as the CJNG are trading high-powered weapons for drugs with other organized crime groups operating in Colombia.

The flow of weapons from the United States to organized crime groups (as the indictment above indicates) such as CJNG can then be leveraged by criminal groups to trade for drugs in Colombia, which will travel to Mexico and the United States. Thus, weapons from the United States typically end up in Mexico and Colombia and Colombian drugs find their way back to the United States.

The Relationship Between Drugs, Weapons, and Human Trafficking on the Darknet

While there is a long history of connections between drugs and weapons, DarkOwl analysts were curious if a similar relationship could be observed between weapons and human trafficking, and drugs and human trafficking. By performing a keyword and language correlation analysis across drugs, weapons, and human trafficking related advertisements in DarkOwl Vision, our analysts discovered at least 7 unique vendors who are involved in human trafficking are also involved in drug trafficking activities.

Running a similar correlative analysis with 78 aggregated terms for weapons, analysts found that although it is common for weapons and human trafficking to be advertised in the same posts or forums, but not as many vendors dealt in both weapons and humans.

Nevertheless, vendors were identified that offered human trafficking services and other darknet services, such as hitman and hacking for hire. While the content is intentionally redacted for public distribution, the Telegram channels offering the services are the same. DarkOwl analysts also considered the very real probability that the threat actor offering these services is a scammer.

Figures 9 and 10: Screenshots from dark web sites (Source: DarkOwl Vision)

During our analysis, a rare case stood out where one vendor was identified as associated with all three: human, weapons, and drugs trafficking. Although the contact is redacted for this publication, the Wickr ID is the same.

Figures 11 and 12: Screenshots from dark web sites (Source: DarkOwl Vision)

Figure 13: Screenshot from dark web sites (Source: DarkOwl Vision)

Final Thoughts

The darknet cannot show the full extent of the complicated relationship between arms, drugs, and human trafficking. However, using DarkOwl Vision to explore these relationships offers a snapshot into both the physical and digital realms of illicit goods and exploitation that often accompany each other. Looking at arms, drugs, and human trafficking online ties into the very real-world implications of these practices.

Regardless, if some of the darknet marketplaces or vendors mentioned above are scams or law enforcement “honey pots,” the fact that many vendors who advertise arms, drugs, and human trafficking show up in at least two out of the three demonstrates the intertwined markets and perhaps victims and economies, and that the illicit markets of the darknet in many ways mirrors the real world.