July 26, 2023

The internet is a vast realm that extends far beyond the surface web we commonly explore. Beneath the surface lies the darknet, a hidden network that poses significant challenges but also holds immense potential for open-source intelligence (OSINT) investigations. In this blog post, we will delve into the importance of darknet data in OSINT investigations and how it expands the scope of information available to researchers and analysts.

OSINT 101

OSINT allows access to a vast amount of openly available information from diverse sources such as social media platforms, news articles, blogs, public records, academic publications, and more. This wealth of information provides investigators, researchers, and analysts with a comprehensive understanding of a particular subject, individual, or organization. By harnessing OSINT techniques, one can obtain valuable insights, uncover patterns, and make connections that might have otherwise remained hidden. DarkOwl analysts are able to combine the power of traditional OSINT investigations with darknet intelligence providing organizations with a more robust picture to help them protect themselves in the cyber landscape.

Darknet 101

The darknet, also referred to as the dark web, is a layer of the internet designed specifically for anonymity. It is more difficult to access than the surface web or the deep and is accessible only via using specialized software or network proxies – specifically browsers supporting special protocols. Users cannot access the darknet by simply typing a dark web address into a web browser. Adjacent to the darknet are other networks, such as instant messaging platforms like Telegram and the deep web (non-public web).

Due to its inherently anonymous and privacy-centric nature, the darknet facilitates a complex ecosystem of cybercrime and illicit goods and services trade. The dark web is a thriving ecosystem within the global internet infrastructure that many organizations struggle to incorporate into security posture. Still, it is an increasingly vital component for organizations with forward-thinking strategies.

Why Incorporate Darknet Data into OSINT Investigations?

As stated, the darknet serves as a sanctuary for illicit activities, providing a veil of anonymity for cybercriminals, hackers, and individuals seeking to engage in nefarious endeavors. OSINT investigations that incorporate darknet data can unveil hidden information, shed light on illicit operations, and expose criminal networks. By venturing into the darknet, investigators can access forums, marketplaces, and communication channels used by cybercriminals. This enables the collection of valuable intelligence related to cyberattacks, data breaches, drug trafficking, human trafficking, money laundering, and other illicit activities.

However, investigators need to have access to the right sites, with many requiring high levels of authentication and the need to interact with threat actors. Navigating the darknet(s) can be frustrating and challenging for any OSINT or darknet investigator. DarkOwl analysts have extensive experience working within the darknet, collecting data and can leverage this to assist with darknet and OSINT investigations across a broad spectrum of areas.

The darknet is a breeding ground for emerging threats, providing insights into evolving techniques, vulnerabilities, and attack vectors. Integrating darknet data into OSINT investigations helps enhance threat intelligence capabilities and enables proactive risk assessment. By monitoring darknet forums and marketplaces, analysts can identify discussions surrounding new hacking tools, zero-day vulnerabilities, exploit kits, and malware. This information is invaluable for cybersecurity professionals seeking to fortify their defenses, mitigate potential risks, and stay one step ahead of cybercriminals but don’t always have access to that data themselves. Darknet data empowers organizations to better understand the tactics and strategies employed by threat actors, ultimately strengthening their security posture.

Real-World Examples

Identity theft and fraud have become pervasive in the digital age, causing significant financial and reputational damage to individuals and organizations. Darknet data plays a crucial role in unmasking stolen personal information, fraudulent activities, and the sale of compromised data.

Below we see an example of threat actors on the popular Russian forum XSS discussing the use of TinyNuke malware and ways to solve issues.

Figure 1: Users on XSS forum discuss malware tools; Source: DarkOwl Vision

OSINT investigations involving the darknet allow researchers to monitor underground marketplaces where stolen credentials, credit card information, and personal data are bought and sold. By obtaining and analyzing this data, investigators can identify compromised accounts, detect patterns of fraudulent activity, and alert affected individuals or organizations. This proactive approach assists in mitigating the impact of identity theft and fraud, protecting individuals’ privacy and preserving the integrity of businesses.

Law enforcement agencies and intelligence organizations rely on darknet data to augment their investigative capabilities and dismantle criminal networks. OSINT investigations that encompass the Darknet provide critical leads, actionable intelligence, and evidence.

Below we see threat actors sharing Fullz information for sale on the darknet, this is darknet slang for all identifying information. This can be used by others to conduct identity theft and fraud.

Figure 2: Identifying information being sold on Darknet which can be used for identity theft; Source: DarkOwl Vision

Darknet data assists in identifying key individuals involved in cybercriminal activities, tracking their digital footprints, and uncovering connections to other criminal acts. This information aids in the apprehension of criminals, the disruption of illicit operations, and the prevention of future crimes. Darknet data is a valuable asset in combating terrorism, organized crime, human trafficking, and other serious offenses.

Below we see an example of real-world information being released on the darknet relating to a threat actor. This individual was the administrator of RaidForums, a popular site selling people’s personal data. His true identity was revealed and he was later arrested by law enforcement.

Figure 3: Identifying information about threat actor on RaidForums; Source: DarkOwl Vision

Final Thoughts

As the digital landscape expands, the inclusion of darknet data in OSINT investigations becomes increasingly important. The darknet acts as a hidden realm where cybercriminals thrive, but it also offers a wealth of information that can be harnessed for the greater good. By venturing into this enigmatic realm, researchers and analysts can uncover hidden activities, enhance threat intelligence, unmask identity theft and fraud, and support law enforcement and intelligence operations.

Integrating darknet data into OSINT investigations strengthens our ability to combat cybercrime, protect individuals and organizations, and maintain a safer digital ecosystem.

However, it is important to note that accessing and navigating the Darknet comes with legal and ethical considerations, and it should only be done by trained professionals and in compliance with applicable laws and regulations. DarkOwl analysts are able to navigate this area providing added resources to teams, expert knowledge and compliance.

---

Contact us to learn how to put our darknet expertise to your use.