Darknet Threats Targeting Semiconductor Companies

April 10, 2025

The semiconductor industry powers everything from computing and artificial intelligence to defense systems and the Internet of Things. Given its strategic importance, it has become a prime target for cybercriminals, nation-state actors, and ransomware groups—many of whom operate across the darknet.

On these hidden networks, adversaries trade stolen intellectual property, zero-day exploits, and even sell access to compromised enterprise environments. This blog explores how these darknet-enabled attacks unfold.

Why Semiconductor Companies Are Prime Targets

Semiconductor companies, design, manufacture and sell semiconductors which are essential to modern electronics. Semiconductors are materials, typically silicon, that have electrical conductivity between a conductor and an insulator. They power everything from smartphones and laptops to cars and medical equipment. Due to their importance these companies are targeted for a range of reasons and in a range of ways.

Due to their use of advanced chip designs and fabrication techniques, which are worth millions, they are often targeted by advanced persistent threat (APT) groups in order to steal intellectual property. Governments seek to control semiconductor advancements for technological and military superiority, leading to targeted cyberespionage campaigns.

Due to the components that are required the companies often rely on a complex global supply chain made up on many different companies and providers. This leaves them open to vulnerabilities from cyber threat actors which could lead to compromise. The SolarWinds and Kaseya attacks, where third-party vulnerabilities led to board compromises.

Given the high cost of production downtime, attackers often use ransomware and wiper malware to extort payments or cripple manufacturing facilities. This can be in an attempt to crimple critical infrastructure or simply to extort companies worth millions of cash.

How Semiconductor Firms Are Targeted on the Darknet

Threat actors can use multiple tactics to infiltrate semiconductor companies and their supply chains. Some of their activities take place on the dark web.

Darknet Markets for Stolen Data & Initial Access

Darknet forums such as RAMP, Genesis Market (before takedown), and BreachForums can offer compromised credentials, session tokens, and MFA bypass methods for employees in the semiconductor sector. Threat actors will offer these credentials for sale to the highest bidders. They are often known as Initial Access Brokers. (IAB)

Initial access brokers (IABs) often sell pre-compromised RDP, VPN, and Citrix credentials, allowing ransomware groups to gain footholds in corporate networks.

Ransomware Attacks on Semiconductor Manufacturers

Semiconductor companies are not immune to ransomware attacks, as few organizations are these days. In fact they may appear as enticing targets due to the worth of the organizations and the technology that they deal in. As with any other ransomware attack, information relating to the organization is exfiltrated, which can include a range of document types, in this case including sensitive semiconductor designs and threaten to leak them unless a ransom is paid. Ransomware Groups such as LockBit, BlackCat (ALPHV), and RansomEXX have been observed targeting semiconductor firms.

Zero-Day Exploits and Vulnerability Markets

A zero-day vulnerability is a security flaw in software or hardware that is to the technology owner and therefore has no patch or fix available at the time it’s discovered. Zero-day vulnerabilities in ICS/SCADA, firmware, and chip toolchains can be sold on the darknet and in private Telegram channels. This is very rare and these types of vulnerabilities are worth a huge amount of money, especially when targeting critical infrastructure.

However firmware vulnerabilities in semiconductor manufacturing equipment, particularly ASML lithography systems and ARM-based architectures, are known to have been exploited in targeted attacks.

Supply Chain Infiltration and Hardware-Level Attacks

Threat researchers have identified instances where adversaries embed malicious firmware in chips before deployment. This has been a major concern for critical infrastructure sectors who could be relying on compromised semiconductor components. Attackers have also been known to compromise EDA (Electronic Design Automation) tools and semiconductor manufacturing software, injecting backdoors into fabricated chips.

Darknet Recruiting and Credential Stealing

Darknet forums have been observed offering payment in cryptocurrency for insider access or data leaks within semiconductor firms. Data leak and infostealer malware like RedLine, StealC, Raccoon, etc are widely used to harvest credentials that are resold and can be used for supply chain targeting or to target employees of semiconductor companies themselves.

Real-World Attacks on Semiconductor Companies

Several semiconductor firms have suffered high-profile cyberattacks in recent years, reinforcing the urgency of darknet threat monitoring.

NVIDIA Breach (2022) – Lapsus$ Group
- Stolen proprietary GPU designs and employee credentials.
- Attackers leaked code-signing certificates, enabling malicious driver development.

TSMC Supply Chain Ransomware Attack (2023)
- A third-party supplier was compromised by LockBit ransomware, exposing sensitive business data.
- Attackers demanded a $70M ransom.

Intel & AMD Firmware Leaks
- Engineering documentation and firmware signing keys leaked on underground forums.
- Exploited for BIOS and firmware-level rootkit attacks.

Strategies to Mitigate Darknet Threats

Semiconductor companies need proactive cybersecurity measures to mitigate darknet-driven threats. These companies and their partners should monitor the darknet to track mentions of company assets, stolen credentials, and exploit chatter. They should also actively monitor initial access brokers, ransomware leak sites, and private forums for early indicators of compromise. DarkOwl data can assist in conducting this monitoring and alerting on identified threats.

Conclusion

As semiconductor firms continue to drive technological progress, they will remain top-tier targets for darknet cybercriminals and state-sponsored attackers. A multi-layered security approach, incorporating darknet monitoring, access control, supply chain security, and proactive threat hunting, is crucial to mitigate evolving cyber threats.

By understanding how attackers operate on the darknet, semiconductor companies can stay ahead of threats, safeguard intellectual property, and ensure business continuity in an increasingly hostile cyber landscape.