Thanks to our analyst and content teams, DarkOwl published over 110 pieces of content last year, a new record for the team. DarkOwl strives to provide value in every piece written, highlighting new darknet marketplaces and actors, trends observed across the darknet and adjacent platforms, exploring the role the darknet has in current events, and highlighting how DarkOwl’s product suite can benefit any security posture. Below you can find 10 of the top pieces published in 2023.
1. Dark Web Groups Turn Their Attention to Israel and Hamas
The world was shocked by the invasion of Hamas insurgents into Israel along multiple entry points from the Gaza Strip on October 7, 2023. This has led to a huge number of posts, images and videos being shared of the incursion and atrocities on social media but also on the dark web and dark web adjacent sites.
DarkOwl analysts are closely monitoring this situation and have identified a wealth of information being shared, some of it legitimate and some likely to be disinformation. In this blog, we provide information relating to known cyber groups active on Telegram and how they have reacted to the invasion. Some groups quickly pledged their support for one side or the other. Read blog here.
2. Romance Scams on the Darknet
For Valentine’s day, our analysts put together a piece to shed light on romance scams – one of the fastest growing schemes across the globe. In the last decade, dating apps and websites have skyrocketed in popularity. As a result, nefarious actors have similarly sought to capitalize off of this booming industry by exploiting and scamming its users. In fact, according to the Federal Trade Commission (FTC), the number of reported romance scams tripled in size from 2017 to 2021. Romance scams are part of a complex criminal enterprise that exploits unassuming individuals on both an emotional and sometimes devastatingly catastrophic monetary basis. Full blog here.
When Hamas militants entered Israel along several fronts on 7 October 2023, Israel and the world were shocked. As events have unfolded this has turned to disbelief that Hamas were able to mount such a complex and successful attack without prior intelligence to indicating an attack. In the months and years to come people will surely reflect on the entirety of intelligence failures that lead to these events, but initial reports seem to suggest that Hamas succeeded by “going dark.”
DarkOwl analysts reviewed our coverage of Hamas linked Telegram channels to identify if there was any change in their activity preceding the assault. We identified that there was a period of inactivity in the run up to the attacks for some but not all the channels. This could have been a coincidence, and we have seen no hard evidence suggesting that the period of inactivity was a precursor to the invasion. However, it is important to monitor the activity of pro Hamas Telegram channels to establish if there were any patterns to the posts.
In this blog, we review some of the channels we are currently monitoring. Read blog here.
In DarkOwl’s Darknet Marketplace Snapshot blog series, our researchers provide short-form insight into a variety of darknet marketplaces: looking for trends, exploring new marketplaces, examining admin and vendor activities, and offering a host of insights into this transient and often criminal corner of the internet. This edition features Styx market. Styx is a darknet marketplace selling illegal techniques for committing fraud, money laundering, and access to stolen data. Chatter on the darknet around Styx market first appeared in 2020 before the marketplace officially opened in mid-January 2023. Styx market offers stolen data as well as a variety of products for conducting illegal cyber activities. Learn more about Styx here.
5. Glossary of Darknet Terms
The darknet is home to a diverse group of users with complex lexicons that often overlap with the hacking, gaming, software development, law enforcement communities, and more. DarkOwl’s Glossary of Darknet Terms is a continually evolving resource that defines the common vernacular, slang terms, and acronyms that our analysts find in places like underground forums, instant messaging platforms (such as Telegram), as well as in information security research pertaining to the darknet. Check it out.
6. Monitoring the War in the Middle East
DarkOwl analysts have assembled a list of Telegram channels commenting on the current conflict in the Middle East. It is important to note that the channels labeled hacktivists are hacker groups, people actively DDoSing websites (distributed denial-of-service attacks), defacing websites, etc. Conflict media includes channels that are not related to hacking but are sharing various forms of near real time content from the conflict in the form of text, audio, images, and video. Analysts have found that there is more propaganda and misinformation on the conflict media accounts versus the hacktivist accounts (not say that it does not exist). Full list here.
7. Understanding the Difference Between Scams and Fraud
Many times we use the words “scam” and “fraud” interchangeably. Fraud is an umbrella term, legally referring to various types of chargeable criminal offenses. Scams, on the other hand, are a particular segment of fraud. One way to think about the difference between these two is from a legal perspective. Fraud is serious criminal business, while scams are considered more minor offenses in comparison. Many types of fraud are classified as felonies, versus scams which are typically charged as misdemeanors. Another way to look at it is from a banks’ perspective. Financial institutions differentiate the two as such: scams are theft of funds with your permission or knowledge, while fraud is financial theft without your permission or knowledge. This blog explores the differences. Read blog here.
8. Understanding Darknet Intelligence (DarkInt)
The darknet (or “dark web”) is a thriving ecosystem within the global internet infrastructure that many organizations struggle to incorporate into security posture, but is becoming an increasingly vital component. In certain cases, that is because taking raw data and turning it into actionable security intelligence requires leveraging DARKINT – or data points sourced from the darknet and other OSINT sources that together form a risk and/or investigative portfolio. Learn more.
9. Despite FBI Takedown, Genesis Market Persists on the Darknet
Genesis Market is a well known darknet exchange that specializes in the sale of identity and account-takeover tools – which, in the case of this forum, primarily means the sale of compromised personal devices via the use of malware. When a buyer obtains a “bot” from Genesis Market, they are actually purchasing persistent remote access to an unsuspecting victims computer. In April, the United States Federal bureau of Investigations has announced the seizure of the criminal forum Genesis Market in an internationally coordinated effort dubbed “Operation Cookie Monster.” Our analysts detected the disruption in Genesis Market at early afternoon Tuesday April 4th, which is consistent with other accounts who also saw the popular marketplace replaced with the law enforcement landing page at that time. Full blog here.
10. Examining Recent Telegram Posts from Russia’s “Z Bloggers”
The letter “Z” has been heavily used as a pro Russian invasion propaganda motif since the early days of the invasion in 2022. The “Z” symbol is often associated with images of Russian leaders in the government or military. The symbol is also commonly associated with Russian war journalists, soldiers, and other Kremlin supporters typically used as vehicles for misinformation campaigns on chat platforms like Telegram. The media commonly refers to this group of individuals as the “Z bloggers”, the “Z Army”, and more generally as war influencers. This blog will take a look at recent posts from 3 different “Z blogger” channels in an effort to better understand how this content has recently been utilized as a propaganda motif. Read blog here.
2023, That’s a Wrap!
Thank you to everyone who reads, shares and interacts with our content! Anything you would like to see more of, let us know by writing us at [email protected]. Can’t wait to see what 2024 brings! Don’t forget to subscribe to our newsletter below to get the latest research delivered straight to your inbox every Thursday.
Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.
1. Russia’s AI-Powered Disinformation Operation Targeting Ukraine, U.S., and Germany – The Hacker News
Ukraine, Germany, and the United States are heavily targeted in Russia’s “Operation Doppelganger” – a new wave of fake news stories distributing falsehoods via news sites and social media accounts controlled by the actors involved. The companies involved are Structura National Technologies and Social Design Agency. The world is well aware of continued dis- and misinformation efforts by Russia. As the war in Ukraine continues, and the US 2024 election approaches, these efforts are expected to grow and continue. Read full article.
After weeks of speculation that downtime on the leak site for Ransomware group Blackcat/ALPHV was due to law enforcement action, the site has officially been seized. The DOJ announced that the FBI had successfully breached the ALPHV ransomware operation’s servers to monitor their activities and decryption keys. The site had been suffering issues since Dec 7, which the group had attributed to technical issues despite reports of Law Enforcement action. However, a new message soon appeared on the site, claiming that the site had been unseized and providing a new onion address for the leak site.
The message is translated as follows:
BEGINS
As you all know the FBI got the keys to our blog, now we’ll tell you how it was.
First of all, as everything happened, having studied their documents, we understand that they received access to one of the DC, because all the other CCs were not touched, it turns out that they somehow hacked one of our hosters, maybe even he helped them.
The maximum they have these keys in the last month and a half, it’s about 400 companies, but now they’re more than 3,000 companies will never get their keys.
Because of their actions, we introduce new rules, or rather remove ALL rules, except one, you cannot touch the CIS, you can now block hospitals, nuclear power plants, anything and anywhere.
Reight is now 90% for all the adverts.
We do not issue any discounts to companies, payment strictly the amount that we indicated.
VIP adverts receive their private affiliate program, which we raise only for them, at a separate center, full, isolated from each other.
Thank you for your experience, we will take into account our mistakes and will work even tighter, waiting for your dive in chats and requests to make discounts that are no longer available.
ENDS
The site is currently showing as seized again. Read article.
3. Major Cyber Attack Paralyzes Kyivstar – Ukraine’s Largest Telecom Operator – The Hacker News
Kyivstar suffered a cyberattack that took most internet and phone services completely offline on December 12, 2023. The incident also impacted the air-raid alert system as well as some financial sector operations. Initial reports detail that 25 million mobile users and over 1 million home internet users were affected. Kyivstar issued a public statement that it would compensate these users who didn’t have service for the outage. Kyivstar indicated that this incident occurred as a result of the Ukraine-Russia war but didn’t provide evidence for this claim. Read full article.
4. Russian Hacker Vladimir Dunaev Pleads Guilty for Creating TrickBot Malware – The Hacker News
Russian national Vladimir Dunaev was arrested in 2021 and extradited to the United States in the same year. He recently (November 30, 2023) pled guilty to developing the Trickbot malware, which was a banking trojan turned initial access tool for ransomware attacks. Dunaev is the second actor to be arrested for his role in Trickbot, and will be sentenced in 2024; the first was a Latvian national who was sentenced in June of 2023. Article here.
5. German police takes down Kingdom Market cybercrime marketplace – BleepingComputer
German law enforcement announced the seizure of Kingdom market a darkweb marketplace known to sell drugs, hacking tools and counterfeit documents. One of the administrators of the site was reported to have been arrested in the US. A seizure notification was posted on their onion site. The site has operated since March 2021 and was one of the most well-known dark marketplaces. It was announced that investigations were ongoing to identify the people who operated the site aided by the seizure of their infrastructure. Other marketplaces have taken this opportunity to invite sellers to their sites to continue their operations via Dread. Read article.
6. Kelvin Security hacking group leader arrested in Spain – BleepingComputer
Kelvin Security group is a prolific hacking group who are quite active on BreachForums and RaidForums, selling stolen data for profit. Spanish law enforcement revealed they arrested a Venezuelan national who is a possible leader of the group on December 07, 2023. This actor was heavily involved in the group’s financial activities, such as moving money through various cryptocurrency exchanges to make tracing funds more difficult for authorities. Read full article here.
7. Navy contractor Austal USA confirms cyberattack after data leak – BleepingComputer
Australia-based Austal USA, a shipbuilding company, revealed it was the victim of a cyberattack as of December 6, 2023. Austal USA itself is a subsidiary of Austal and has contracts and multiple programs working with the US Navy. Ransomware gang Hunters International group claimed responsibility for the incident. Read article.
8. BidenCash dark web market gives 1.9 million credit cards for free – BleepingComputer
The Darkweb marketplace BidenCash has reportedly released 1.9million credit cards for free. This is the third time that they have made such a release although the validity of the cards is not confirmed. BidenCash launched in early 2022 as a new marketplace on both the dark web and the clearnet, selling credit and debit cards that were stolen through phishing or skimmers on e-commerce sites. Article here.
Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.
With 2023 at a close, our content and marketing teams reflect on a number of exciting events, trends and changes the DarkOwl team experienced this year. We look forward to an even more successful and prosperous 2024 and wish the same for all our customers, partners and readers! Thank you for your support over the past year and continuing to read, engage and share our content. We hope you continue to find the topics we cover valuable, enlightening and interesting. Last marketing plug of the year… don’t forget to sign up for our weekly newsletter to make sure you receive updates about latest from our research and content teams!
DarkOwl Around the World
Trade Shows and Events
DarkOwl made the rounds this year traveling all over the world for trade shows and speaking sessions and we are so glad to be able to see our customers, partners, and prospects face to face. In 2023, the team attended several events all around the world from San Francisco, Las Vegas, New Orleans, National Harbor, Panama City, London, Prague, Paris, Vienna, Munich, Singapore, Dubai, Hyberbad, Haryana, and more. Thank you to everyone who sat down with DarkOwl along the way. We hope to see even more you on the road in 2024. Check out where we will be in 2024 and request time to meet here.
DarkOwl CFO and DarkOwl FZE CEO at CyberTech Global in Tel Aviv.
DarkOwl CEO at the G-20 Conference in Gurugram, Haryana, India.
DarkOwl CBO, Director of Client Engagement and Project Engineer & Data Analyst at OsmosisCon in New Orleans, LA.
DarkOwl Director of Strategic Partnerships in Lille, France at FIC.
Darknet Hands-On Labs
DarkOwl hosted two darknet hands-on labs for the first time this year. In July, we hosted “Explore the Darknet with DarkOwl” at the Carahsoft headquarters in Reston, VA. Attendees got access to DarkOwl Vision and got to conduct hands-on searches during a Scavenger Hunt. DarkOwl’s industry leading Vision UI provides access to the largest commercially available database of darknet content in the world, without having to access the darknet directly, so you can take action to prevent potentially devastating cybersecurity incidents. After an afternoon of learning about the darknet and diving into it, attendees enjoyed networking during happy hour.
Our next hands-on lab, we hosted with Blackbird.AI at the Carahsoft headquarters in Reston, VA as well, “Explore Darknet Data and Beyond With DarkOwl and Blackbird.” In this session, attendees once again got direct access to DarkOwl Vision to explore the platform and conduct darknet searches in a Scavenger Hunt and see in real-time, how Blackbird’s Constellation Platform aggregates and adds color to this data. Blackbird provides the only purpose-built platform for organizations to detect, measure, and mitigate disinformation and information-driven risk. Together, get the complete picture you need for critical decision making.
The team is excited to do more of these in-person trainings, make sure you don’t miss the invite to our next one!
Employee Fun and Events
Not only did the team travel around the world for client meetings and conferences, but back in Denver, CO at Headquarters, DarkOwl had some fun too! With a workforce that is becoming more and more remote friendly and DarkOwl focusing on finding the best talent, making sure that everyone at DarkOwl stays connected is of upmost importance.
Team Offsite
Meeting our adopted owl
Meeting our adopted owl
Last year, we adopted an owl! This year we renewed that adoption and the team was lucky enough to meet our adopted great horned owl. He jumped early from his Michigan nest in 2015 and fractured his right wing in two places and was on the ground for about a week next to a barn before he was picked up by the landowners and brought to a rehabilitation center. He was sent to the Raptor Education Foundation in Denver in August, 2016 where he now lives. You can learn more about him on his dedicated adoption page.
We love our #Pets!
Arguably, one of the most exciting things this year was the start of the DarkOwl Pets Channel! Our furry employees brought so many smiles throughout the year and of course a couple crashed meetings and plenty of naps along the way. 😻
Porter, Apollo and P.
Biscuit, Garfield, Bentley, Zooka and Lil’ Dip.
Bevy May, Bart, Sumi, Feni, Nova and Cudi.
Reminder: DarkOwl analysts and their pets recommend you never use your pet’s name in any password combination as it is a popular term for threat actors using brute force attacks.
Content, Content, Content
DarkOwl published over 110 pieces of content this year – everything from research blogs, darknet 101 topics, press releases, webinars and more. The team will be ranking the top 10 pieces in the new year. Stay tuned to make sure to see the highlights!
This year, we also launched our LinkedIn Newsletter, “Weekly Intelligence Summary: Deep and Dark Web Round Up,” which is published on LinkedIn every Monday morning and rounds up cyber news from the week prior. Keep up to date with the latest from DarkOwl Analysts every Monday – you can subscribe here.
New Products and Enhancements
DarkOwl places great emphasis on learning from customers and making sure our products are always providing value. We make a continuous effort to enhance our dark web data products with features geared towards analyst and threat intelligence teams. Below are a couple highlights of big launches we had this year, both of new products and offerings as well as feature enhancements.
DarkSonar API Launch
In April, DarkOwl added, DarkSonar API to the product suite. DarkSonar, a relative risk rating based on darknet intelligence, measures an organization’s credential exposure on the darknet. DarkSonar enables companies to model risk, understand their weaknesses and anticipate potential cyber incidents. In turn, organizations are able to take mitigating actions to protect themselves from loss of data, profits, and brand reputation.
Built on DarkOwl’s proprietary Entity dataset, DarkSonar generates a risk rating that is unique to each company. The algorithm used to generate these signals takes into account key quantitative and qualitative factors over time of organizational exposure of email addresses with associated passwords, and weights each signal accordingly. The result is a quantifiable risk indicator that can help companies and organizations monitor and potentially predict cyberattacks.
In testing internally and with beta partners in the insurtech and third-party risk industries, DarkOwl found an elevated DarkSonar score in the months before a cyberattack in approximately 75% of the cases where a company publicly acknowledged a breach. Depending on the companies and the nature of the attacks this percentage was as high as 85% in some instances. This indicates that DarkSonar can help organizations assess their risk level as an additive data point – and potentially predict a pending threat.
Read more about DarkSonar API on our product page or in our interview with Director of Product, Sarah Prime and Product Manager, Josh Berman.
Darknet Services Offering
In July, DarkOwl announced the launch of Darknet Services, our customizable tailored, expert analyst support to enrich darknet data and provide customers with darknet risk analysis, threat actor profiling, darknet monitoring, data acquisition, and brand protection. For individuals who are not familiar traversing the darknet it can be a daunting task to search for threats and risks to an organization. DarkOwl is the darknet expert, with access to the largest database of darknet content. DarkOwl’s team of expert analysts are able to conduct these investigations on behalf of customers identifying mentions of organizations as well as data relating to them that may be exposed. Our customizable service options allow customers to leverage our in-house expertise to save time, keep their employees safe, and fulfill the need for actionable threat intelligence. Let us be an extension of your team.
Read more about Darknet Services on our product page or in our interview with DarkOwl Director of Intelligence, Senior Threat Analyst, and Darknet Intelligence Analyst to understand a little more about their backgrounds, why they love cyber, projects they’re working on, and some tips and tricks for new analysts. You can even see some example reports here.
Actor Explore: Your Ultimate Resource for Cyber Threat Actor Intelligence
In November, DarkOwl released “Actor Explore,” an exciting new addition to our Vision UI platform that provides invaluable insights into cyber threat actors. This feature is designed to empower security professionals, researchers, and organizations with analyst curated information about threat actors, enhancing their ability to understand and combat cybersecurity threats effectively.
In today’s digitally driven world, the landscape of cyber threats is ever-evolving and increasingly sophisticated. As businesses and individuals become more dependent on technology, the need to protect sensitive data and critical infrastructure from cyber attacks has never been more critical. One effective approach to enhancing cybersecurity is to track and monitor cyber threat actors. The actors that are responsible for conducting attacks; individuals or groups with malicious intent, often targeting organizations, governments, or individuals. Understanding why they are operating, what they hope to achieve and what methodologies they are using can assist analysts in protecting infrastructure and predicting future activities.
With Actor Explore, users can access comprehensive threat actor information and each actor profile includes a detailed dossier, offering an in-depth overview of the threat actor. Additionally, DarkOwl analysts provide extensive information such as darknet fingerprints, targets, tools, CVEs, contact information, and morewhen available. Actor Explore connects this information to our other data sets, including leak sites, ransomware sites, alias, cryptocurrency, etcetera that actors are associated with. This wealth of data enables users to gain a profound understanding of the threat actors, their tactics, and the potential risks they pose.
Cyber threats are continually evolving, and so are the threat actors behind them. The collection consists of threat actors in several categories, including: state-sponsored, cybercrime-focused, ransomware groups, access brokers, exploit brokers and buyers, critical infrastructure attackers, and more. Actor Explore will be regularly updated with new information and actors,prioritizing client needs, ensuring that users have access to the latest intelligence to bolster their cybersecurity efforts and research.
2023 was exciting for the DarkOwl team, as we grow our product suite and continue to improve our current products.
One of DarkOwl’s key differentiators is our product team’s ability to respond to the needs of our clients and collect the data that matters the most to them. Last year, DarkOwl was proud to assist our national security and government partnerships by providing crucial insights into data leaks and cyber activity surrounding the war in Ukraine. This year, we are pleased to have reported on and shared insights into the Hamas and Israel conflict.
DarkOwl Announces Availability of Vision UI on AWS Marketplace
AWS Marketplace serves as a comprehensive e-commerce platform featuring thousands of software listings from independent vendors, streamlining the process from discovery to deployment of software compatible with Amazon Web Services (AWS), around the globe. This collaboration offers security teams and leaders a swift and cost-efficient avenue to harness DarkOwl’s invaluable darknet data resources utilizing their AWS account.
Bringing DarkOwl Vision UI to the AWS Marketplace allows access to advanced threat intelligence and empowers organizations to fortify their defenses against evolving cyber threats. DarkOwl Vision UI on AWS Marketplace offers scalability, making it suitable for organizations of all sizes. Users can choose a subscription plan that aligns with their specific cybersecurity needs.
Clients Seeing Increased Demand for Dark Web OSINT
We understand how incredibly challenging it is to maintain insight into everything the threat actors have insight into. This year, we put an emphasis on leveraging our company’s expertise in darknet technology to gather the data that allows our clients and their customers to stay ahead of potential threats.
Newly announced partnerships include:
Don’t miss any updates from DarkOwl in 2024 and get weekly content delivered to your inbox every Thursday.
Fraud is one of the most prevalent activities on the darknet, threat actors will buy and sell fraudulent goods as well as providing tips on tricks on how to how to conduct fraudulent activities. There are many different types of fraud that are conducted against many industries, and events, although financial gain is the overriding incentive, with actors often being opportunistic in who they target and when.
Here we will explore some of the types of fraud DarkOwl analysts have observed on the darknet.
E-Commerce Fraud
The targeting of e-commerce businesses such as Amazon, PayPal and Shopify is widespread on the darknet. Criminals will use a range of techniques such as refund fraud, hacked accounts and gift card fraud in order to obtain funds.
The dark web adjacent platform, Telegram is used extensively to advertise fraud and scam markets. Users are able to search for channels which provide them with ways to conduct fraud, groups that will provide fraud services for you sell you fraudulent goods.
Refunding Services
Refunding fraud is when a user will obtain a cash refund for goods that they have not purchased or for goods the buyer had already received a legitimate refund for. Refund fraud can have significant financial implications for businesses, leading to monetary losses and potential damage to their reputation.
A user knows as Bam or Amazon God offers refunding services for Amazon goods in a range of jurisdictions. They provide the refund service as well as offering methodologies and mentorship as a consultant.
Figure 1: Threat acor provides refund services on Telegram
Hacked Accounts
Hacked accounts often come from stolen credentials, or through credential stuffing attacks allowing criminals to access legitimate accounts to purchase goods. This is also known as Account Takeover (ATO). These accounts are often sold on the dark web and dark web adjacent sites.
Figure 2: DarkOwl Vision result for the sale of Amazon Prime accounts
Many organizations are targets of these types of account takeovers, with threat actors becoming more successful at obtaining credentials which can be used on multiple accounts. However, we do see many accounts being made available for streaming service accounts such as Netflix or Hulu, usually for very low prices.
This is why it is very important for individuals to practice good password hygiene – not only in their professional life, but also in their personal life. Password reuse can lead to multiple of your accounts being stolen. DarkOwl recommends the use of a password manager and routine changing of passwords.
Tutorials
Although not a fraudulent activity in its own right, DarkOwl analysts note that threat actors are increasingly selling tutorials and guidance on how to conduct different types of fraudulent activity on the darknet. This means that actors do not necessarily have to have skills or sophistication in order to be successful – they are able to purchase this knowledge and carry out the fraudulent actions themselves. Because of this sharing of knowledge, the number of individuals committing fraud can grow at a pace it might not have done or have been able to beforehand. Cracking tutorials in the darknet cover all matters of illegal “cracking” including passwords, wi-fi routers, commercial accounts, and software. For obvious reasons, we’ll not detail any of the cracking tutorial methods that we’ve spotted across popular hacking forums and Telegram channels.
Financial Fraud
Although the majority of fraud is committed for the purposes of financial gain, it does not always target the financial sector directly. However, there are multiple types of fraud that do. This continues to be a trend DarkOwl has observed on the dark web and we do not expect it to decrease.
Gift Card Fraud
Gift card fraud refers to the unauthorized acquisition, use, or manipulation of gift cards for financial gain. Gift cards are prepaid cards issued by retailers, restaurants, or other businesses, and they are commonly used as presents or convenient forms of payment. However, criminals have developed various schemes to exploit vulnerabilities in the gift card system.
Gift cards are often used as a way to launder money, allowing users to purchase goods with funds which have been illicitly obtained. Gift cards can be purchased with cash and can therefore also be used to obfuscate the purchase of illicit goods.
Figure 3: Threat actor sells ebay gift cards
Fullz
Fullz is a dark web term which refers to a complete set of personal information that cyber criminals often seek to steal and sell on the dark web for fraudulent purposes. This information typically includes a person’s full name, social security number, birthdate, address, phone number, email address, financial account details (such as credit card numbers, bank account information, and associated security codes), and other sensitive data.
This information can be used to steal a person’s identity, conduct social engineering attacks, and conduct account takeovers. Most commonly we see fullz being sold on the dark web for the purposes of conducting financial fraud, with actors using the details to open fraudulent bank accounts to be used for other scams.
Figure 4: Telegram account selling Bin and Fullz
Credit Card Fraud
Credit card fraud is common on the dark web, with many marketplaces and vendor stores exclusively selling stolen and or cloned credit cards. WWH Club us an example of a marketplace which is set up exclusively to cater to the carding community.
Credit cards will be sold with varying balances or credit limits on them, the more cash available the more expensive that they will be. Threat actors have been able to create cards, which they have cloned, and they create on mass and sell on the dark web.
Users will purchase these cards to cash out the funds or purchase illicit goods and obfuscate their identity.
Figures 5 and 6: Cloned cards and card advert
Counterfeit Goods
Another item that is very popular on the dark web is the sale of counterfeit goods. While these can vary in type, from designer goods to sporting ware, the majority of items we have seen advertised on the dark web are counterfeit documents. Passports from a variety of countries, driving licenses, birth certificates and immigration documents are available for purchase on the dark web.
Again, there are marketplaces and vendor stores that are dedicated to the sale of these goods as well as being made available on the majority of high-profile marketplaces within their own area.
DarkOwl has not verified the quality of any of these goods, and it is unclear whether the sale of these is a scam in and of itself. However, it is possible that some threat actors do have access to the materials to create these. The price of the document is usually a good indication of the quality. Some of the documents sold also appear to be legitimate, likely stolen from the original owner for the purpose of selling on the dark web.
Healthcare fraud became increasingly mainstream as a result of the 2020 pandemic, with actors selling vaccination cards and PPE (personal protective equipment). However, this has continued as the pandemic has subsided. Although vaccination cards are still available, we have seen a move towards Medicare fraud in the US as well as the sale of medical information in leaks and breaches. Mentions on the dark web related to 1095A Forms, healthcare agent credentials, and Medicare / Medicaid. We assess that this information is being made available on the dark web so that criminals can use it to conduct healthcare fraud and claim benefits which they are not entitled to. DarkOwl will continue to monitor this trend into 2024.
Figure 8: Sale of healthcare information
Conclusion
Threat actors use the dark web to conduct, learn and sell activities relating to many different types of fraud. The primary reason for this activity is financial gain and we do not expect this to change, however new trends and types of fraud continue to emerge. DarkOwl will continue to monitor these trends into 2024.
Curious how DarkOwl can help your fraud use case? Contact us.
It has been 2 months since Hamas’s October 7th surprise attack on Israel. In that time there have been many developments both on the ground and in the cyber realm. A number of groups emerged in the aftermath of the attack pledging their support to either Hamas, Palestine or Israel and cyberattacks increased in the region targeting both sides to varying degrees of sophistication. DarkOwl analysts have been tracking these events and activities, and in this blog we review some of the notable cyberattacks that have occurred and the groups that have taken responsibility.
In the first few days of the conflict, attention was largely focused on images and media reportedly coming out of Israel and Gaza highlighting the atrocities which were occurring. Telegram, which is monitored by DarkOwl, appeared to be being used as a de-facto news source, providing details of what was happening in certain areas and also posting images of the aftermath. Channels appeared or grew in size supporting one side or the other and while sharing information, there were also reports of false or fabricated information and media being shared stoking the flames on both sides.
Figure 1: Telegram channel posts image of Hamas breaching into Israel
The cyber world also reacted to the conflict with existing hacktivist groups quickly pledging allegiance to their chosen side or already fighting for the cause. Groups quickly began to post online about the targets they had successfully compromised with attacks ranging from DDoS (distributed denial-of-service), defacements to data leaks. As the conflict has progressed, the level of activity has ebbed and flowed, with some groups turning their attention back to previous targets.
Figure 2: Selection of Cyber groups profile images
After the initial invasion and activity, several cyber incidents accompanied the air and ground conflicts in the Middle East. Key activities we identified as part of the conflict are detailed below although this is not an exhaustive list and does not describe all reported activities.
A leak purportedly from the Palestinian Foreign Ministry was published on cracking[.]org which contained details of Chinese and Palestinian projects as well as correspondence documents and PII for approximately 500 people. DarkOwl was able to obtain this leak for review.
Ghosts of Palestine openly announced they will target NATO countries who support Israel although Turkey was excluded from targeting.
JFK airport was targeted by hacktivist group R_70 which is a Pro-Hamas group. The groups reported via their Telegram channel that they had taken down the JFK website due to their links to “Zionism.”
BlackSec joined the digital operations arena, claiming it would target Israel and not remain neutral in the conflict.
The RedAlert app which was used to alert Israelis to rocket attacks was subject to a spoof attack which was reported to collect personal information. It was unclear who was behind this attack but demonstrated cyber actors taking advantage of the military conflict for their own gain.
Stucx Team claimed an attack on an Israeli SCADA system via their Telegram channel, Supervisory Control, and data acquisition (SCADA) controls industrial processes. Targeting these types of systems can bring down water plants and electrical facilities and are usually one of the most concerning attacks for cyber security experts. A high level of sophistication is usually required to successfully attack these processes. However, they became a common Israeli target as the conflict continued.
Figures 3 and 4: STUCX Team Telegram post from DarkOwl Vision and on the channel
The group GlorySec posted on Telegram that they considered a firewall on Palestinian websites, indicated Palestine had prepared well in advance for a conflict in the cyber realm as well as the physical realm. They also said they’d release the data right to Israel to support their operations and encouraged them to investigate this. It is unclear what information they had or if this was shared.
Figure 5: Telegram post by GlorySec via DarkOwl Vision
Anonymous Algeria publicly warned the UAE and alerted its airline, Emirates, to a possible system compromise for what they view as “not supporting Palestine”:
Figure 6: Anonymous Algeria Telegram Post
Reports indicated that Pro-Hamas hacktivists groups were targeting Israeli Entities with Wiper Malware, the destructive malware appeared to have signatures within it linking it to the Middle East. This development highlighted the use of sophisticated tools as part of the ongoing conflict and suggests a “cyber war” may also be taking place.
As the month of October concluded, hacktivist activity relating to the Gaza conflict appeared to decrease. While the start of the conflict saw a large amount of emerging activity, with actors and groups choosing sides and issuing threats online, digital activity surrounding the Israel-Hamas conflict tapered down. However, increases were expected as the conflict continued.
November Events
AnonGhost Indonesia & Anonymous Indonesiawarned the Japanese government that for supporting Israel that they would carry out cyberattacks, the groups had already been active in targeting countries they deemed to be anti-Palestine or Pro-Israel.
GhostSecclaimed to have successfully targeted several Israeli PLCs via their Telegram channel.
Anonymous claimed to have information relating to Mossad spies which they threatened to disclose on Telegram it is unclear where this information came from or if it relates to valid data.
Figure 7: Anonymous post on Telegram
Although the hacktivist groups on Telegram appeared to quiet in this period security research reported on several activities which indicated that Iranian hackers were using new tools to target Israel and that a Hamas linked APT was also targeting Israel with a new backdoor tool. Indicating that nation states and Nation State sponsored groups continued to be active in the cyber sphere. These groups tend to avoid the publicity that hacktivist groups seek.
December Events So Far…
Cyber incidents began to increase after the temporary ceasefire between Hamas and Israel completed.
Cyber Toufan hacking group claimed to have breached Israeli company SodaStream, and exfiltrated 100,000 records:
Figure 8: Post for SodaStream data on dark web forum via DarkOwl Vision
Conclusion
Hacktivist groups and cyberattacks have been a component of the Israel Hamas conflict since it began, with many groups getting involved and attacks across of a scale of sophistication being conducted on both sides. Although the activities have ebbed and flowed in the first two months of the conflict, it is clear that they are likely to continue for the length of the military conflict – if not longer. DarkOwl will continue to monitor the activities of these groups as the conflict continues.
DarkOwl analysts have observed an increase in stealer log data available on thedarknet in the past couple years.Stealer logs are logs of sensitive information that have been stolen from compromised victim devices. Data from stealer logs can be more damaging to victims in the hands of a bad actor than the credentials found in leaks and breaches. The data obtained through an infostealer allows a bad actor to get multiple kinds of information, such browser data, credentials, IP addresses, crypto accounts, about the victim rather than the limited information generally offered in a leak.
From email accounts to banking credentials, stealer logs can grab it all. This could result in a number of attacks such as identity theft, tricking individuals or institutions to transfer money (or drain accounts), account takeover, fraudulent purchases, and other forms of fraud. Many victims do not know that their machine is infected by stealer malware since they are often distributed by phishing emails, fake websites, fraudulent software and apps, and other social engineering methods. In this blog, DarkOwl analysts will break down what stealer logs are and how they work. As stealer logs start replacing the role of leaks and breaches, they will be the ones to look out for.
Stealers, Infostealers, and Stealer Logs
Stealer log-related terminology is defined below:
A stealer is another word for an infostealer, or information stealer. Per DarkOwl’s darknet glossary, a stealer is “a software-based program, typically malware, that is deployed on victim devices that when executed or downloaded is designed to take credentials, cookies, and sensitive information to take advantage of the victim financially, engage in fraud, and possibly identity theft.” After the stealer has covertly accessed stored information, it will transmit the data back to the cybercriminal.
Infostealers are commonly delivered by social engineering, such as malspam campaigns and phishing emails. Typically, attachments with malware are included in the email. The email likely has a “lure,” or a legitimate-looking trap to encourage victims to open the attachment or link and install the malware onto their device. Information stealers are on the rise and promise lucrative business opportunities for cybercriminals.
While researching for our piece “Pardon Me While I Steal Your Cookies – A Review of Infostealers Sold on the Darknets,” darknet analysts also learned many infostealers are offered in alignment with a malware-as-a-service (MaaS) or stealer-as-a-service (SaaS) rental model with subscriptions-based access to the malware executables and associated command and control C2 botnets.
Stealer logsare thelogs that are extracted from what is generated from the information stealers. The logs contain credential data created after the information stealer has been installed on a device. After the malware (the infostealer) has gone through the system and extracted the valuable information, these logs are sent from the compromised machine to a C2(command and control), controlled by the cybercriminal, and can be distributed from there, such as being sold on the darknet.
Autofill: a feature found in most browsers that will automatically populate previously entered information into form fields.
Cache: a cache is a system for the storage of temporary files such as web browsers and other media so that the page can be accessed without being downloaded again.
Cookie: text that is sent by a server to a web client, and returned by the client each time it uses that server. This technology is typically used for authentication of website users, session tracking, and also for maintaining information about the users.
Session Cookies:a file with a string of letters and numbers, known as an identifier, that is sent by a website server to a browser for use during a limited timeframe. A session cookie is sent with the browser request for a web page from a server. The session cookie communicates to the server which parts of a page the browser already has so that the server does not re-send them. When the browser is closed, the session cookies are deleted.
Persistent Cookies: persistent cookies are not deleted after the browser is closed and the sessions ends. Persistent cookies are data files that can give websites saved user preferences, information, settings, and login credentials.
Hardware Identifier: the Hardware Identifier is used by Microsoft in Windows. A hardware identifier is an identification string defined by the vendor used by Windows to match a device to a driver package. The particular HWID is produced when the operating system is installed.
Why do Stealer Logs Matter?
The information in stealer logs can give a cybercriminal the information they need for identity theft crime, financial crime, and could essentially result in a total online takeover in some cases.
Stealer logs can obtain everything that you do on your machine. How many applications have not been signed out of? How many accounts open directly without credentials? How many cookies have you accepted? Do you log out of Amazon every time? Is your credit card saved to your account? A bad actor using information from a stealer log can get acces to all of this and more. Everyday mundane actions on the technology that we’ve come to rely on in our daily lives can be accessed, stolen, and sold.
The data from stealer logs can be so useful to bad actors because of the types of data it can target and exfiltrate, including browser data and cookies. Browsers save information such as sites visited, search histories, cookies, cache, and autofill data.
Browsers are the applications such as Chrome, Safari, and others used to access the internet. Browsers save browser histories, which is a record of the sites the user has visited. Browsers save cookies, search history, download history, and cache. Browsers will also save usernames, passwords, credit card information, addresses, and more if the user elects for the browser to save that information.
This information also comes from autofill data saved to browsers. Exfiltrated browser data in a stealer log can give a bad actor a trove of PII (SSN, dates of birth, addresses, phone numbers) as well as financial information (credit cards) and credentials (usernames and passwords). A bad actor can combine this data and use if for theft and fraud against the victim.
Cybercrimninals can access accounts by recreating credentialed sessions using cookies taken from victim devices by infostealers. If a bad actor has the cookie from an authorized credentialed session, they can re-create account access and get to the account. Even if the bad actor does not have the username and password to a site, if they have the cookie from the browser they can use that cookie to take the credentialed session to clone access to the account. The browser may recognize the credentialed cookie session as the victim logging in, not the bad actor. Email services and banks may not raise a red flag when a bad actor logs in with stealer log cookie data, because with cookies the actor is accessing the credentialed session.
Another reason why stealer log data is so valuable to cybercriminals is because stealer log data tends to be more timely. Leaks and breaches can occur years after a user initially registered, and therefore the credentials (such as passwords) may not be up-to-date. However, stealer log data will contain the victim’s most recent details. A stealer log pulls the most recent passwords and credentials from the victims machine rather than the third pary where the account was registered.
Even if a user is following healthy cyber-hygiene practices and changing their password every 90 days, a stealer log can make those efforts moot. Furthermore, a victim may not be aware an information stealer has infected their device even if they use antivirus software. When a user authorizes the action to download the malware, antivirus softwarewill not be able to prevent the infection. Since stealers are typically downloaded by accident, can bypass antivirus software, can be difficult to locate unless by an expert, and give the most up-to-date information, they are incredibly valuable to cybercriminals.
Breaking Down a Stealer Log
The following sections will break down the different components of a stealer log. Data is obtained from a stealer log found in DarkOwl Vision.
Browser Data
Many browsers will ask users if they want to save information that has been entered into forms (e.g. remembering a password for a website) while on that browser. A stealer log can exfiltrate saved browser information from a victim device and send it back to a bad actor.
Figure 1 from DarkOwl Vision displays some of the browser data that can be found in a stealer log. In the example below phone numbers, dates of birth, usernames, and passwords have all been taken from saved browser data by a stealer log.
Figure 1: Source: DarkOwl Vision
Browser Data and Cookies
Technological cookies are text that is sent by a server to a web client, and returned by the client each time it uses that server. This technology is typically used for authentication of website users, session tracking, and also for maintaining information about the users. DarkOwl analysts have observed cookies in stealer logs from the darknet.
A bad actor who has access to cookies could use those cookies to recreate a victim’s credentialed session—meaning after they have signed in—to gain account access. Below data of a stealer log taken from DarkOwl Vision shows saved cookie information in stolen browser data from a stealer log.
Figure 2: Source: DarkOwl Vision
Autofill Data
The autofill data taken from a browser in Figure 3 gives a victim’s username and password to multiple accounts as well as the URL and application used. The username and password for the Google account as well as the scholarships.gov credentials could be used to impersonate and financially harm the victim. Additionally, any financial credentials saved on other sites with compromised usernames and passwords, such as Trip Advisor, could be leveraged by a cybercriminal.
Figure 3: Source: DarkOwl Vision
In Figure 4, the autofill data from the stealer logs gives the victim’s phone emails, addresses, full names, dates of birth, and social security numbers.
Figure 4: Source: DarkOwl Vision
Another file from the stealer log in Figure 5 distinguishes the most important autofill data. This way the most beneficial auto-filled data is readily available for a cybercriminal to use, and they don’t have to waste time searching for it.
Figure 5: Source: DarkOwl Vision
Domain Detects
A file found in stealer logs observed by DarkOwl analysts contains a “DomainDetects.txt” file. This file gives access to the highest priority domains found in the log.
Figure 6: Source: DarkOwl Vision
Installed Browsers
A specific file shows all of the installed browsers and versions of those browsers from the victim device.
Figure 7: Source: DarkOwl Vision
Installed Software
Another file has all of the applications on the victim’s compromised machine.
Figure 8: Source: DarkOwl Vision
This kind of information is especially helpful to investigators, as they can see what VPNs are being used. A bad actor could also leverage some of the information for advanced social engineering—from this entry we can see that the device has games including Grand Theft Auto and an Epic Games Launcher.
User Information
Finally, the stealer log contains a file called UserInformation with details about the victim’s device. This includes IP address, country, zip code, HWID (hardware ID), language, the height and width of the screen, time zone, operating system, UAC (user account control), keyboards, hardware’s, anti-viruses, and storage (RAM, MB, bytes).
Figure 9: Source: DarkOwl Vision
Information taken by stealer logs can be used to defraud people in general and to identify specific individuals and machines. Individuals can be identified if their social security number is taken by the stealer. A machine can be specifically identified by certain kinds of hardware, including a HWID (Hardware Identifier) that is redacted but pictured in Figure 9.
Final Thoughts
Stealer logs are a reminder how fragile online identities and accounts are. At any moment, with the few wrong clicks of a button, everything could be taken over usually unbeknownst to the victim. Stealer logs are becoming more prevalent on the darknet and may soon replace leaks and breaches as cybercriminals’ preferred method for stealing credentials. The data is generally fresher than credential data found in leaks and breaches and individuals tend to be an easier target than a corporation with a security team. However, cybercriminals can also be victims of infostealer malware which could be very useful to investigators.
Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.
1. Iranian Cyber Espionage Group Targets Financial and Government Sectors in Middle East – The Hacker News
Iranian cyber actors have run a campaign for the past year targeting various entities in the already conflict-laden Middle East. Victims include Jordan, Kuwait, Oman, Iraq, Israel, and Saudi Arabia. Tools used in the 8-month long campaign include custom web shells and backdoors, indicating an elevated level of sophistication. Read full article.
2. Boeing Breached by Ransomware, LockBit Gang Claims – Dark Reading
Threat group LockBit claimed to have infiltrated Boeing’s systems using a zero-day. Boeing appeared on the LockBit leak site at the end of October 2023, but they offered no proof of data or material belonging to Boeing. Article here.
3. General Electric, DARPA Hack Claims Raise National Security Concerns – Dark Reading
Notorious actor “IntelBroker” published their purported access into General Electric (GE) and the Defense Advanced Research Projects Agency (DARPA), claiming credentials, military and other sensitive data was for sale. GE confirmed an incident occurred, but didn’t provide additional details. IntelBroker claims to have access to GE’s development environment. Read more.
4. Researchers Expose Prolific Puma’s Underground Link Shortening Service – The Hacker News
Prolific Puma is distributing phishing services, malware, and other scams via link shortening services. They have registered tens of thousands of unique domain names since the spring of 2022 and are consistently abusing DNS infrastructure in their efforts. They have not been observed advertising these services on underground markets as of yet. There is also no indication as to where Prolific Puma operates from or what language they speak. Read here.
5. Ardent Health Hospitals Disrupted After Ransomware Attack – Dark Reading
30 hospitals in the Ardent Health Services system have been hit by a ransomware attack, resulting in all emergency services being redirected. While Ardent is headquartered in Tennessee, the impact has been felt throughout six states. Learn more.
6. Cybercriminals Using Telekopye Telegram Bot to Craft Phishing Scams on a Grand Scale – The Hacker News
A new bot, Telekopye, has emerged on Telegram. Actors are using it in seller, buyer, and refund scams. The criminal group known as the “Neanderthals” has pioneered the use, tricking innocent users to enter payment details to buy goods and/or services via emails or SMS that do not exist. The groups ensure use of VPN, proxy, and TOR technologies to remain anonymous. Read full article.
7. Meet the Unique New “Hacking” Group: AlphaLock – Bleeping Computer
Russian cyber group AlphaLock debuted on Telegram this week, advertising various services such as “training pentesters.” This is often code for ransomware operations, with Russian groups using this language as they don’t want to be seen as malcious ransomware actors. The group also offers customized online courses, directed to be used for training the future, and then using said newly trained actors to establish a marketplace on DDW forum XSS where they sell the pentesting services. Read full article.
8. Russian-speaking threat actor “farnetwork” linked to 5 ransomware gangs – Bleeping Computer
Russian-speaking actor “farnetwork” contributed to the Nokoyawa RaaS operation as a project leader and recruiter, and contributed to the development of JSWORM, Nefilim, Karma, and Nemty ransomware variants. The actor recruited for the various gangs, and actively speaks to analysts from various intelligence firms to promote their work. Their online aliases include: farnetworkl, jsworm, jingo, razvrat, piparkuka, farnetworkit. Learn more.
Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.
As the holiday season approaches and kids and young adults spend more time online, there is never too much to do to ensure they remain safe. In this webinar, DarkOwl and Mr. Bill Wacker share how a close family member of his was exploited online.
As the leader in dark web intelligence, DarkOwl constantly sees:
Solicitation of minors and children, asking for pictures, personal information, and more
Blackmailing the youth, threatening to extort them or reveal personal information about them or their families if they don’t comply with the requests of the actor
Malicious actors posing as a younger individual in the hopes of luring children to meetup in person in order to carry out abduction or kidnapping operations
Mr. Wacker details his personal story about the family member who went through this, how he helped them, and what you and your family can do to keep children safe in an ever connected world that preys on them.
For those that would rather read the presentation, we have transcribed it below.
NOTE: Some content has been edited for length and clarity.
Bill: My name is Bill Wacker, I live in the Cleveland Ohio area and my daughter was affected by an almost child abduction. I wanted to talk about it because I don’t want this to happen to anyone else and would love to try to figure out ways to prevent this. If we can save one kid, that’s the goal for today and to inform everyone that it can be you, I know people say “not my kid, no way,” but it could be your kid, for sure.
Steph: I’m Steph Sample. I have 18 years of experience in various roles of cybersecurity. I started off focusing on the Iranian states as well as their allies in the cyber world, their cyber program, their developments, and then moved into all things criminal because the criminal world, as you’re about to find out, never ceases to stop, is always malicious, is always active, and we can do a little bit more and learn a little bit more to share with partners in the criminal world. So Bill again, cannot thank you enough for being here today. This is such an absolutely amazing story. So I think let’s jump right in so that we can educate our audience and share your incredible story that has a happy ending.
Let’s do that. So Bill, how was your family member approached? Can you please name specifically what social media platform? I think that’s important.
Bill: So it was Instagram. My daughter was involved. She’s always been a kid that didn’t have friends perse. She’s always struggled with her peer group. She’s never had trouble finding friends that are, you know, younger or hanging out with adults. It’s always bothered me and my inner mother. We’d catch her just talking to people here and there, and we just did our best to monitor it. But one day I was taking her back to her mom’s, and my partner at the time said, hey, I noticed something on Madeline’s phone that she was showing people and I would look at it if I were you. So I did. So we were driving home and not being a very good driver, I decided to look at the texting and Instagram exchange, and it only took a about three sentences for me to know that this was very serious, and I literally just did a U-turn and went right to the police station. I can tell you that the content… it was so awful. Use your imagination about the worst possible thing you could read from a sexual perspective, a sick sexual perspective. And think about it being said to a 12 year old kid.
Steph: That’s really important perspective. Because let’s be serious, the online world, whether it’s social media, gaming platforms, all of it is used and in a good way can help kids find people if they don’t relate at school, if they don’t have their peer group, that’s why they gravitate towards it. But then there’s these incidents and that’s absolutely atrocious.
Okay, so you had the observation – great vigilance on your on your partner’s part and getting involved. Did you approach your daughter about it? Did you message with the app?
Bill: Well, so she was with me in the car, literally. I asked her for the phone and she looked at me like, why? Because she knew something was up. And I said, I’ve heard that there’s some stuff on your phone that’s alarming, and I have to look at it. And I said, just please give it to me. Literally once I saw it, it’s the first couple sentences, it was off to the police station and getting them involved ASAP. I didn’t read everything, but what the police told me is it went down like a dialog. As they looked at the exchange, the next step was that this person wanted to meet her at a place called Crocker Park. It’s the largest shopping area in the Cleveland metro area, and it’s also a large child trafficking hotspot, which I didn’t know either until the police told us. It’s because of its location, proximity to the highway. It’s an outdoor mall. So the next step was he was trying to coerce her to meeting somewhere at Crocker. And I can’t, four years later, I still can’t believe it was that close. And it was just, it was a miracle we caught it. It really was.
The police got very involved, but they never caught him. They got an IP address. They worked on it for about four months, it just never worked out. We also had some visibility with the event with local channel 19. Tiffany Tucker was the anchor. She was a marvelous. She was so helpful, very involved, wanted to help out, wanted to bring the message to people in Cleveland. She’s fantastic. It’s a happy ending because nothing happened to her. But, you know, there’s trauma for her, there’s trauma for us. But we got over it. It’s. We’re just very lucky. I just want to make sure everybody knows that could happen to them. They’re tricky. They’re clever. They’re master psychologists. They know what they’re doing. You just got to be vigilant. And it will probably make your kids angry, but it just doesn’t matter. It’s a messed up world, as you’ll show later with some of the things that you’re going to bring up as slides.
Steph: So about how long, if you can give a ballpark, did the actors start speaking to your family member versus when you discovered it? Can you estimate?
Bill: Keep in mind, it’s like four years ago and I didn’t have the ability to go track the messaging, but I would say it was about a two month process.
Steph: It’s not that long, not a long time. And let’s be clear to your daughter was under 13, so she was a pre-teen, right? And you’re exactly right. That’s how these actors work. They know to go for younger, you know, the cognitive functions aren’t there. The social and the IQ not quite there. They’re just not developed. They [cyber actors] know what they’re doing.
So do you think that your daughter would have gone to meet in person?
Bill: Yes, absolutely. Well, let me take a step back. I mean, she’s 12 years old. But she would have had to figure out a way to get there. But she would have, because she’s very clever and she would have gotten what she wanted somehow. I’m just thankful that it never came to that. But yeah, I think she would have tried to figure out a way to meet.
Steph: You said that the location that the actor chose, the outdoor mall, is commonly used for child and human trafficking operations. Do you feel that there’s more awareness surrounding this venue now in your area, or would you like to call further attention to these which exist in every city?
Bill: I think that is a great question, and I don’t, I think the answer is probably no. People tend to forget these stories pretty quickly, unfortunately. I mean, with everything like gun control, everything it’s like goes away. We have so much coming at us. But yeah, I think it needs to definitely be brought up more. I don’t know how a mall like that would feel about putting fliers or signs up to, you know, if you feel like you’re in danger, call this number. That type of thing or text this if you feel like you’re being approached or I don’t know what to do.
Steph: That’s a really great point because airports have that, right. Let’s be serious. They’re usually in the restrooms or they’re in lounges, you know, a human trafficking number. Here’s something to call. Here’s a sign you can take.
So you mentioned that you you went to the police, which is great. Got the authorities involved. And you went to media, which I think is also great for calling attention. Do you have any recommendations as far as software monitoring for younger kids? I know there’s a privacy discussion, but look at what’s happening. Do you have suggestions on parental controls and monitoring?
Bill: I don’t at this point because we did have those tools and I guess we didn’t… I think the tool is only as effective as how you implement it or use it. And I’ll take the blame. I mean, she’s only with me a couple of days a week because we are divorced, but yeah, we just didn’t catch it and still have trauma. I beat myself up about it still, but we were able to catch her. But yeah, we did.
Steph: This is not to to beat yourself up over. This is important to reflect, to teach lessons. Because Bill, four years ago tech and social media weren’t what they are now. Let’s be serious. You know, there were issues. Of course we’re seeing that. But it evolves so much. And these kids, we just talked about how clever, how resilient, how intelligent they are. But, you know, parents have to try to stay one step ahead. And that’s impossible. So this is the point of this webinar, why we’re sharing what we want to educate.
How about her school Bill? We didn’t touch on that. Did you talk to her school afterwards? Did you share this news with other kids? How’s the school doing in this role?
Bill: School really didn’t do much. We told them, we notified them, but we really got nothing else out of them. I know the police were very frustrated that they just couldn’t find the perpetrator because the police that read the messages – you could just see the rage in their face, like when they read the whole thing. But no, we didn’t really get much out of the school. I think there’s talks at Westlake all the time about this. So not say that Westlake is not educated because they certainly have parent led discussions to prevent this from happening. But as far as this particular incident, I think there’s also a lot of shame, embarrassment, maybe from both parents and not telling many people outside law enforcement, you know, outside a particular close group of friends.
Steph: See, that’s another issue that we need to fix with public education because parents are not omnipresent. They can’t be everywhere. Neither is law enforcement. Neither are schools. Again, this is not a finger pointing exercise. It just goes to show with how quickly tech moves and how available it is, especially to kids. You know, we have to try to stay on top of it. We have to share our notes. We have to share our groups and share our resources because no one can do this alone, no one at all. So what would you hope the takeaway message is? Now having spoken to the media, law enforcement, the venue, schools, what do you want to tell our audience as far as how to address this in the future? Monitor their current kids activity. What are your thoughts there?
Bill: So I would sit down with your kid and and just have a just discussion about it. I would try to get educated as much as you can about what’s out there, what people are doing, and just have a discussion and just say, hey, have you ever had anything like this happen? Have you been approached? You’re the parents, parents know their kids better than anyone. And when something like this happens, make sure your kids are aware of it. Make sure your family is aware of it and your friends are aware of it. I don’t think there’s any silver bullet, right answer, I just think it’s really awareness. I think it’s trying to be involved as much as you can with your child, and then knowing that something might be off. You don’t know what it is, but you sense something’s off and you act upon that. That’s what happened here. That’s what saved us, is that something just seemed awry, off. And it’s you know, the analogy I use is everybody has a, you know, a pet. You know, when your pet’s sick, you just know something’s off with them. It doesn’t matter what. And I think the same is with your kid. You know something’s bothering them, on their mind if you have a good relationship. But it’s also embarrassing for them and scary for them. So I think the other thing is you have to make sure that whatever you tell them, whatever is going on, you’re a parent. We love you. We want to protect you. We want to help you. There’s nothing to be embarrassed about. These things happen. These people know what they’re doing. They’re psychopaths, sick people. And that’s all I can do. The biggest thing, Steph, is I wish I had better answers, but it’s just, it can happen to any of us. It can happen to any parent. It doesn’t matter.
I was hoping just to build a little bit more awareness, and I’m more than welcome to talk to anybody on this call if they want to just talk to me one on one, I’m more than happy. You can give them my contact information. But yeah, I just want to save a kid and prevent this from happening. It’s so awful for the family. It’s just it’s still tough to talk about four years later.
Steph: I believe it, I believe it, and that’s why we have to be thankful that you are here. You know, we talk to our kids about everything, right? There’s nothing else we haven’t done. So you have sex, drugs, alcohol, smoking. Now we have active shooter drills in schools. Right. So maybe there is something to be said there that we could get cyber drills in schools. It’s got to maybe start to be part of the curriculum because these kids have devices sometimes before they’re even out of the womb. They have social media accounts. And again, that’s not malicious activity on the part of the parents or family members, but they don’t know what they’re setting their kids up for. And you’re so right that awareness and education is the most essential part. So on that I have some slides I’d like to share.
Kathy: Before we move on, there’s a question for Bill. Now that your daughter is 16, how is your relationship about privacy and transparency between you, your co-parent and your daughter?
Bill: That’s a good question. I mean, obviously she’s 17, she’s a teenager. And communication can be tough. But I think she learned. We constantly talk to her about it because she’s still not socially mature for a 17 year old. So we have to be very, very careful about monitoring her still. And like I said, I’m only with her a couple of days a week, so it’s harder. And unfortunately it’s on her mom and mom’s busy as heck too, so it’s just really having the constant conversations. Fortunately, I don’t think fortunately is the best word to use, but she almost was taken and she got a second chance. Most kids don’t. And so it’s just keeping her aware, monitoring her very closely with my son who’s 12, the same age when it happened. It’s not a non-issue. It’s like he doesn’t have anything to do with this stuff. He’s got his circle of friends. That’s all he cares about. But he’s still, you know, aware and remembers what happened. I hope that answers the question.
Steph: So I pulled this news article up. Bill, you and I have discussed this before. This happened in Atlanta. It sounds a little bit similar in that it was the targeting of an underage girl.
The difference on this one, being in the huge part is that this individual was part of the parents social network approved, right? So they were friends on Facebook. They knew each other from a religious gathering. They thought that they knew what this guy was all about. And in reality, he was combing the parents accounts, the pictures of their daughter, her locations, to attempt to sell her online. There’s a dark web market. Obviously, we are DarkOwl – we know the dark web very well. The market is called slave market. It sells children from all over the world. It is not just the United States. So this is an example. Bill, you know, you talked about how when we see this, we have some headlines and then they go away. And you’re right because this was earlier in the summer of 2023. It was June. This little girl was also saved. She’s fine too. Happy ending like you Bill, her mom speaking out to the Atlanta press. But I think it’s more important to draw attention to that. And with that, I want to segue.
So again, DarkOwl, we comb telegram, discord. We are on the dark web. This is what we see and deal with all day. This is not easy subject matter.
My top screenshot is this individual who’s offering how to get kids social media accounts and sell them on telegram. Why? Because kids, even if you’re not going to physically go after them, right? Attempt to kidnaping, attempt to procure them, if you will. Kids social media is easy to steal their PII (personal identifiable information), passwords, credentials, because kids don’t have job histories, credit scores, all the complications that adults do. So this telegram channel is talking about how kids accounts are clean, and to steal an identity or start a criminal ring. That is what this actor is doing. He’s going after children.
You can see the middle one, which is again from the summer of 2023. We’ve got a child slave market. This is an offering on a dark web site. This is absolutely live. This was only a few months back. This is still happening.
And then we have a May 2023 article about certain tech marketplaces, platforms, all of it that are unfortunately criminals misusing to recruit, trap, approach and then attempt to buy and sell children, whether that’s kidnaping or another way. We’re not saying this is the tech giant’s fault. It’s just that this is happening everywhere, on every platform to kids as young as seven, eight, when they can start typing.
The final data and slide that I have here, which I thought was also really pertinent. Again, not going after physically attacking children or kidnaping them or taking them. This is a different dark market advertisement. Again, from 2023, you can see that the children’s social security numbers and dates of birth are available.
Fools in the cyber criminal world means that it’s a record with complete information. It means it’s the highest chance that you have to steal someone’s information. So these fools are going to have not only what the actor is listing, they will have locations, metadata, coordinates where they attend school, what sports they play, anything that can really help provide a complete picture for children for that identity theft. You can also see that they specified the dates of birth for these children are 1999 to 2020, again targeting those younger ages, those people who do not have the fully developed cognitive skills, who aren’t going to be able to understand that somebody online messaging them might not be who they say they are. And the final part of that post is you can also see that the guardians information, whether parent or other family member, other legal guardian is there, further allowing for a criminal actor to potentially impersonate a guardian and do further harm to that child or other children.
These are just some of the examples that we pulled. Again, we wanted to keep this focused on Bill and his family and the educational part of this, but we have to share how essential it is to protect your children online. Yes, everybody wants to share pictures and vacations and milestones. That is what unites us as human beings. We get it. But there is a dark, nefarious side to this. And unfortunately, criminal actors have really caught on how to quickly and efficiently and effectively make money off of innocent children or innocent families and do further harm. So I thought these were really important recent examples to share. Bill, anything else on these examples that you wanted to add? Did they approach her with any of this, or use any terms that you’d like to share as well? Lingo is important too.
Bill: No, I wish I knew. I just reading that and the other examples. It’s just horrendous. I just am speechless about the stuff that’s out there. I had no idea. I think it’s awareness. Like you said, technology has changed a lot in four years. Things change so quickly. So then it’s like you have to educate yourself on, well, all right, so this has changed. What am I going to do now? Keep pace I guess. I wish I knew what the answer was in terms of how to stop these people and how to find them. That would be, I would hope, our next breakthrough. I really thought we’d find that other person. We did not, I was surprised, actually.
Steph: It’s interesting that the actor wasn’t found because, you know that a lot of time and effort was spent on that. But it also goes to show that using location hiding software obfuscation techniques and then disposable infrastructure. Right now that we have cloud IP addresses, they’re ephemeral, you can change them. So these actors really do know that. And it’s terrifying how quickly they can disappear. We know they’re going somewhere else, we know they’re re-appearing elsewhere. So all right we’re going to try to get some schools and educations involved. We’re going to keep talking to the media. We’re always going to go to our respected law enforcement. Let them know. I think that vocabulary is one way that we can do this. You know, there are definite repeated terms that criminal actors will use. After we publish this, let’s have it in writing for people so that they can copy paste, put them into their parenting software, implement them live right. And then we can kind of keep a running list and also gain feedback from the audience. Undoubtedly, there are parents and cyber professionals in our audience who are going to watch this. So let’s keep that a growing task and list, which also facilitates continued conversation. We don’t want this to fall apart, fall away. We want to keep it visual.
Kathy: Bill, someone would like to know what was the response from Instagram. Did you get a chance to speak to them about the problem?
Bill: That’s a great question. I know we alerted them. I know the police took care of that. It made them aware of the problem. I can find out what Instagram went back and said. I know that they they did some things on their end, and I know the police were involved to try to figure out how to find them. That’s really all I know about what Instagram did. I kind of took my hands off it and let the police just do their job, as much as I wanted to take over.
Steph: That had to be hard to sit back and let someone else take action on this. But again, they were probably well versed, you know, so that had to be really difficult. And I think that’s a good point to share. There’s nothing about this process that’s going to be easy. It’s uncomfortable. It’s terrifying. It’s traumatic. So let’s focus on that too. And just really, you know, talk to your families about it, talk to mental health professionals too.
Kathy: Did the police have a cyber unit or only traditional investigation?
Bill: That’s a good question, too. Traditional investigation.
Steph: I want to highlight that should the FBI ever become involved, because these are definite cases for the FBI and your local law enforcement. But the FBI has a cybercrime not only unit and specialist, but they also have a reporting forum. You can use the hotline, you can use an anonymous email address. And I think that’s also important to share too. So that can be another thing that we provide in our follow up resources is not only your local law enforcement, but the FBI as well. Because if we have more eyes on this problem, we have just a little bit more monitoring and a movement towards a solution.
Kathy: I’m sure it may be difficult to have the data to confirm, but how often are these bad actors caught on the dark web in these instances?
Steph: I will be honest, not enough. I, in my almost two decade long career, know I’ve seen more ransomware, DDoS, more of the technical actors that are taking down, say, your critical infrastructure and I am not seeing enough attention given to nationally or internationally human trafficking efforts, kidnaping efforts that happen frequently online. And one thing I should highlight there, too, is the actors are also smart, right? So they are moving from the more common public forums on the dark web. They’re moving more towards one on one communications. So like in Bill’s instance, of course, it was private messaging on Instagram. What we’re seeing is a general trend is that they will advertise those keywords like you just saw in those slides I had. They will say children, they will say slave market, etcetera , etcetera. But there’s no further context or detail, and they entice people to message them directly, which of course hinders law enforcement operations. You can’t get into private messaging. So no, data’s not perfect. Maybe we can get some input from law enforcement too as we continue to drive awareness, but they are not being taken offline as quickly or as as needed.
Bill: And why is that? I was just going to say. Why do you think that? What do you think? What needs to be done to, in your opinion, to find these perpetrators or what other steps can we do? Because like you said, it’s hard to get them. We didn’t get the guy for my daughter. I know that dark web is very mean with Tor and everything is really hard, but I don’t know what your suggestions are.
Steph: It’s unfortunate that technology is is neutral, right? Technology is only good or bad, depending on whose hands it’s in. And like you said, it’s unfortunate that you didn’t catch yours. But like I detailed, they’re using all these hidden softwares, all of these obfuscation techniques, again, not just for human trafficking but criminal operations writ large. And that is unfortunately a really dark and nefarious side of technology, that if somebody is very sharp and knows what they’re doing, you can’t nab them, you can’t remove them. So I think all we can honestly do as hard or as ineffective as it might sound, because we’re people of action is continue talking about it, raising awareness, giving lingo, headbutting into your kid’s life. Right? Like, hey, who are you talking to? Who is that? Do you know that’s who that is? You’re not going to meet them in person, are you? Do it. There’s a really common thing in cyber where we do tabletop drills. So we do. All right. You got a DDoS attack. How do you bring your system back online? Go. Okay, you’ve got ransomware. Same situation. And unfortunately, it sounds like we’re just going to have to keep doing this with kids. Again, I think that curriculum in schools could be a good place to start. Do an impersonation in school off this, a person approached me online. He said this. He said that he asked for pictures and just try at age appropriate levels to make your kids aware in addition to parents, teachers and community members.
Kathy: Does DarkOwl help with detection of these issues?
Steph: Oh, my gosh, we certainly do. I mean, one of the numerous reasons I’m absolutely privileged to work here, not only do we contribute to criminal operations and stuff, but we also donate our platform to anti-human trafficking efforts. We have all of our coworkers who generally work nights and weekends to do that, because our executives feel it’s important. We at the analyst level feel it’s essential. I mean, look at what we just talked about, so we contribute to it. We will pass a tip information, we also love to share with other members of the cyber community. It takes everybody for the more technical criminals to be identified. We have partners that we would go to and say, what can you tell me about this IP address? Can you geo it? What can you do here? What can you tell me about this handle? Are they using a ProtonMail, an anonymous mail? Are they using Gmail? Do we have a chance to track it? Are they on any other platform aside from Instagram? Can you give me their handles on steam, Twitch, any gaming situations, right. So DarkOwl is definitely in the fight and that’s one of the reasons I’m just so unbelievably happy to be here and privileged to be speaking about this.
Kathy: Steph, you touched upon it a little bit, but interested in how this takes place in our public education curriculum. Back in the day, we were teaching Stranger Danger, and the participant is wondering if, you know, are we bringing these critical dangers from social media into the school setting?
Steph: You know, I don’t have kids in a school setting or a system. I don’t want to speak writ large to that. I’m sure that there are various areas of the country that are trying to take the don’t talk to strangers, don’t go into a white van, don’t take candy from strangers. I am sure that those efforts at certain levels are occurring, but what we need is a national, united one, right? We need a formal mandate to have this curriculum and have these teaching incidents in schools as well as, you know, a church, a mosque, a synagogue. Maybe you could touch on those community places on weekends or nights. Boy Scouts, Girl Scouts, I mean, the opportunities for education are endless. I don’t know of anyone that’s doing them minus individual grassroot efforts, but let’s build on it. That’s the point of this.
Bill: Going to the schools I mean, doing a national mandate. I don’t even know how to get started with that. But a local school, would you do a presentation, say to a school to talk?
Steph: Absolutely. We have parents here at DarkOwl who are definitely well versed and unfortunately are going to probably see these slides and lose a little bit of sleep. But yeah, I think starting at schools petitioning, you know, politicians to change the curriculum, implement these things, these are all potential ideas that we have. And whatever the community comes up with to add to and make them more robust, we’re all ears. Absolutely.
Kathy: In the dark web are there only sightings of individuals partaking in human trafficking? Or have you also seen movements by bigger criminal networks?
Steph: Oh, there are entire networks. There are absolutely networks. Generally speaking, what happens is much like every criminal conglomerate, they are set up like a business. So your lower level affiliates who maybe have that knack for speaking to younger children and attracting them, are sent out to recruit them. But then, you know, it’s horrible to say, but I have to say, you know, those lower level associates essentially have numbers that they have to hit. They have to get five kids a month, ten kids a month, right? Or else they face repercussions. So that’s the desperation into the criminal chain. One thing I’d really like to highlight is that internationally, because again, this is not just a United States problem. People from war zones are unfortunately horribly targeted, and that is generally by criminal networks. So they will say, okay, for $5,000, I will get you out of X war zone. Okay, here’s your passport. Here are your documents. Meet me at this location and we will transport you out. That is obviously not legitimate. It’s a huge criminal conglomerate. And I want to say that the money from human trafficking is only part of the criminal supply chain. The money that they pay for humans, children, women, boys, you name it, you know, they get that money from, say, online operations like ransomware, selling weapons in some cases. We’ve seen that in the Middle East and Africa. The funds from drugs, the funds from IEDs. Right. I mean, I spent two years in Afghanistan and was former military, and we’ve seen this criminal supply chain, and it is not any different than human trafficking is just another cog in that wheel. It is definitely networks, but it starts small with one individual going after their target and then it builds up.
Kathy: This may seem a little strange, but would you recommend that children say they are 18 on social media when they fill out the birthday sections? Would that make a difference or deter potential predators? If there are accounts that they’re older than they are, or would that be more harmful?
Steph: I would like Bill to take this one too. My input on that to start is that I don’t think they should misrepresent any ages because, listen, young women 20, 25, 18 are still victims of human trafficking. Very much so. It might change the way that they are approached, but I don’t think it’s going to deter them. Again, those actors have mandates and numbers to hit. And I don’t think that saying you’re 18 or 19, if you’re 13 or 14 is going to make a difference. Bill, how about you?
Bill: I don’t think it matters whatsoever. I think they don’t care, as Steph said. I mean, you know, you see signs everywhere about abduction in college bars. There’s signs everywhere that give a text code that if you feel like you’re in danger. But no, I don’t think it matters what age they have on Instagram. I mean, face it, my daughter should never have had this happen based on our age in the first place. I don’t think it matters at all.
Kathy: We hear that TikTok is being used very actively for targeting children. Do we have monitoring as part of this?
Steph: I can’t with with TikTok, I absolutely cannot – from where the data flows through to all of the dangers that have been identified to the types of media that’s on there. That is a personal choice. I scream at my nieces and nephews and brothers and sisters-in-law to get off TikTok. But that is a personal choice. And so that would have to be monitoring on the part of the parents guardians, etcetera, etcetera.
Bill: But what do you say to them to get them off? It’s like everybody. I’ve never used it. What do you say to them to prevent them? I mean, they’re kids. The peer pressure is intense just to share videos and such. It’s just that’s a tough one.
Steph: That’s a very tough one. DarkOwl does not work on TikTok as of right now. That would be part of social media, which we don’t really cover. So I would love to collaborate and have ideas as far as TikTok and how to protect its users, but that’s a that’s a really big conversation that’s happening in places. Right? I think there were a couple of efforts to block TikTok. They’ve gone back and forth. You know, obviously there’s some privacy issues there. Citizens would be up in arms. That is a very hard question, but it needs to be discussed. Absolutely.
Kathy: And our last question, Bill, kind of leads in a little bit to the peer pressure and the support. Thank you for your courage to share your story. How did your daughter’s friends react and support her and support themselves? Curious of the support?
Bill: It’s a great question because they didn’t know. They didn’t. We didn’t tell them. I’d say primarily because she really, at that time especially, did not have many friends, her age group. We definitely talked to my ex-wife’s closest friends. I know that they knew about it so they could talk to their kids privately. But yeah, it was a very private issue. It was very traumatic for her. It’s just having those conversations like organically as opposed to doing a big broadcast about it just because of the nature of it. She didn’t really have any friends to discuss it with. Just to be frank.
Steph: Bill, how about your you know, you mentioned your ex-wife’s friends in that community. And how about just the adults in your community? The adults at the school, were they more interested in paying attention after they found out what happened? The ones that you shared it with.
Bill: I don’t know because they’re not my friend group anymore. I would say knowing the women, I know they would have cared greatly and did everything they can to make sure that their kids and then their friends with their kids. I mean, they’re all good people. Everybody was horrified by it.
Steph: Yeah, and I think you’ve made a lot of new friends and garnered a lot of interest on this, Bill. So again, cannot thank you enough. Thank you for sharing your story.
Bill: I appreciate that. I hope I’ve answered all the questions. Well, I guess it’s four years ago and I feel kind of inept as I’m answering some of these questions because some of the details are kind of, it’s been a while and it’s kind of like blocked it off and now comes all roaring back. But I’m glad to do it just because I just want to help anybody I can. And I know you and Kathy, and Dustin’s mission is the same, so I’m more than happy to do this anytime and help anybody I can. If anybody ever wants to talk to me about it, just please let me know.
Steph: I’m going to wrap with, just thank you to everyone, Bill and the audience included. We are very much open to, you know, please contact us on LinkedIn, emails or anything. We want to continue this conversation. We want to have a follow up. And thank you for your time on a difficult subject for sure, but the holidays are coming up. This is why we timed it this way. When kids are off school and on their devices, let’s all just open our eyes a little bit more. So thank you all so much.
In preparation for the upcoming Black Friday and Cyber Monday events, DarkOwl analysts wanted to identify how this was being addressed on the dark web and if there were any emerging scams in relation to the years biggest sales. Analysts used DarkOwl Vision to determine mentions of either Black Friday or Cyber Monday on authenticated forums like XSS, Exploit, carding forums, carding stores, marketplaces, and Telegram channels.
Black Friday and Cyber Monday advertisements on the dark web are expected in the weeks leading up to the holiday, however, DarkOwl analysts also predict an increase in various types of e-commerce fraud during the same time period due to the high volume of consumers taking advantage of November’s deals. In this blog, we first take a quick look at some of the “Black Friday” dark web deals followed by an overview of various types of fraud typically perpetrated against e-commerce companies like Amazon, Ebay, and Shopify.
Black Friday Discounts on the Dark Web
At this time of year most of us expect a rise in the commercials we see advertising the latest technologies, gifts and household goods with deals associated with them culminating in Black Friday deals. The dark web is no different with vendors and marketplaces using Black Friday discounts to entice consumers to buy their goods.
On the well-known Russian language credit card fraud forum WWH Club, dark web vendors are advertising discounts for hacked accounts associated with a wide range of companies from fintech, crypto exchanges, rental property platforms and more. They claim that everyone has discounts for Black Friday and that they will give big discounts although they don’t stipulate what the discounts are. These type of Black Friday discounts are common across other credit card fraud forums and marketplaces like: Carding Store, Ascarding, Shadowcarder, and others.
The carding forum, Shadowcarders, also have Black Friday deals, providing up to a 50% discount for credit card databases in several jurisdictions. The vendor shares the data has a 96% validity rate and includes the following PII (personal identifiable information): names (first/last), addresses, and phone numbers.
DarkOwl analysts identified another Black Friday “deal” on a darknet marketplace called Kingdom Marketplace. The product listing provides some more details than the previously mentioned advertisements. The post states that the vendor is selling verified PayPal accounts, but also offers methodologies and tutorials to teach a prospective threat actor how to engage in this sort of fraud. These types of offers are commonly observed across various darknet and deep web marketplaces.
The dark web economy is known to be reliant on reputation and reviews, as this is one of the only recourses that consumers have against the rampant scams and exits. Although it is clear that threat actors also seek to entice potential customers with discounts and deals just as the mainstream stores do.
E-Commerce Fraud
More and more these days, consumers will conduct their shopping online rather than venturing into busy stores. In recent years this has led to the advent of Cyber Monday for customers to take advantage of online deals. But as more of us move to online shopping, online fraud also continues to rise.
E-Commerce fraud comes in various different forms. Some of the most common methodologies DarkOwl have observed on the dark web are the selling of refunding tutorials/methodologies, hacked accounts, stealer logs, credit card information with fullz, as well as gift card fraud, and the sale of verified seller stores from sites like Shopify and Ebay.
Refund fraud is one of the most prevalent types of fraud as it does not take a high degree of technical sophistication to successfully defraud the target. Refund fraud is “the act of abusing a return or refund process for monetary gain. There are many types of return fraud, but most commonly, it consists of obtaining an item from a store (through purchase or theft), and then defrauding the store by returning it for a refund.” This is also a common money laundering tactic.
Refunding services and refunding methodologies are very common on various Telegram channels as well as marketplaces and forums like Kingdom Marketplace, Abacus Market, XSS, Exploit, Cracked, and Nulled.
DarkOwl analysts discovered a Telegram user known as Bam or Amazon God that both sells refunding services as well as methodologies and mentorship for a consulting fee.
Figure 1: Screenshot of Amazon fraudster’s Telegram bio
In the below image, this user advertises Amazon refunding for various domain locations, including amazon.com/.ca/.co.uk/.nl/.de/.pl/.be (United States, Canada, United Kingdom, Netherlands, Denmark, Poland, Belgium).
The user also provides evidence of the methodologies that they use as well as success rates and the period of time that it will take for the refund to be returned.
Figure 2: Screenshot of Amazon God’s Amazon Refunding Advertisement including screenshots showing the process
E-Commerce Vendors Targeted
DarkOwl analysts discovered a user advertising hacked Amazon Prime accounts that are allegedly valid for one year and include a warranty. These sorts of advertisements are commonly seen across Telegram fraud channels. Amazon Prime accounts offer a large number of services which can be used by actors to conduct ongoing fraud, as the account is not associated with their personal information. This can include purchasing goods as well as streaming services.
eBay is another e-commerce vendor that is commonly targeted by fraudsters on Telegram as well as darknet and deep web forums and marketplaces.
The following screenshot is from a Telegram fraud channel showing eBay gift cards being sold at significantly discounted rates, 89 USD for a 200 USD gift card.
In another post mentioning eBay on a Telegram fraud group chat, DarkOwl analysts discovered a user advertising hacked accounts with logs and additional PII like SSN and bank accounts, for eBay, PayPal, and Skype.
A user is looking to sell counterfeit gold through a verified eBay seller posted across multiple darknet forums seeking a partner to sell his counterfeit goods as he had had issues setting his own accounts as they had been shut down by eBay. DarkOwl analysts discovered the below post on the well-known hacking forum, Breach Forums.
One of the more unique fraud offerings was discovered on the famous Russian hacking forum, Exploit. A user posted on the site in both Russian and English, advertising claiming to offer a Shopify vendor investigative service. The poster indicated that they would be able to provide details of the store including their customer information and revenue. It is likely that this information is provide so threat actors can target the most profitable store. The poster is charging $5k for this service.
Furthermore, DarkOwl analysts identified a user claiming to sell well reviewed Shopify stores with sales over 100K Euros for 3,000 USD on the well-known Russian hacking forum, XSS:
Conclusion
Dark web vendors see the value of discounting their products for Black Friday in much the same way that legitimate stores do, multiple advertisements have been identified across our monitored marketplaces which would indicate that these deals are popular and successful. We expect to see an increase in these advertisements in the lead up and proceeding the Thanksgiving holiday.
As consumers also endeavour to take advantage of Black Friday and Cyber Monday deals from legitimate stores they should be vigilant to the ever increasing e-commerce fraud which can take a variety of forms.
Curious how your security posture can benefit from darknet data? Contact us.
Disclaimer: DarkOwl does not endorse nor support these vendors, sales, or listings in any way. DarkOwl has historically partnered with organizations such as the Global Emancipation Network and Kruger Park to eradicate human and animal exploitation.
It’s always a difficult topic to research, but calling attention to the online dark web forums, markets, and Telegram operations that sell and harm animals is an absolute necessity to give a voice to innocent creatures and draw legal attention to this cause. Like many things, animal sales have been augmented by the ease and speed of technology and the perceived anonymity of the dark web.
DarkOwl observed recent trends concerning the online sales of animals and animal products in 2021, including sales of reptiles and bears; offering objects made from less-common animal materials such as ivory or exotic fur; and a steady interest in dog fights.
In this blog, we aim to cover the latest identified trends in nefarious animal activity on the dark web and adjacent platforms to call awareness to these practices as well as the efforts to stop the harm of innocent animals. We have provided a list of online links and resources to contribute to the effort at the end of this blog.
Actors Attempt to Hide
Selling any live creature online could and should attract law enforcement and animal rights groups’ attention. For instance, dog fighting is illegal in all but five countries worldwide; there are constant efforts to break up dog fighting rings, the sales of dogs themselves. Selling rare materials from endangered animals, such as ivory which is often procured from animal poachers, can result in fines and other legal action. However, actors who participate in these kinds of sales and events know how to watch the vocabulary and keywords they use in posts for advertising and selling.
Animal abusers know law enforcement officials and animal rights groups are monitoring deep and dark web forums and marketplaces to identify any information in the hopes of shutting down illegal animal activity. Usually, advertisements for anything surrounding animals are vague and only offer a preview of the kind of animal for sale, or the kind of activity they are advertising, forcing logins and other processes so vetting can take place before interested parties can gain access, in hopes of rooting out investigators and validating user interest:
Figures 1 and 2: Conversations about animal abuses on the darknet found in DarkOwl Vision
Exotic Animals for Sale
The exotic animal and wildlife trade is another sphere of illicit trade found on the darknet. Illegal wildlife trafficking is estimated to be the third largest illegal business in the world after drugs and weapons.The following findings from DarkOwl Vision introduce some of the darknet’s leading vendors in the darknet wildlife trade community, along with their sources.
“The Dark Jungle” is an onion site that considers itself “…the dark web’s premier classified site” and offers turtles, snakes, as well as animal products such as fur jackets for sale. It has been around so long that it migrated from a V2 onion site, with only 16 characters to the V3 onion site, with 56 characters.
Figure 3: The Dark Jungle homepage
Darknet adjacent sites such as Telegram have been used to advertise sites, including clear net sites which offer exotic animals for sale. Bears are a feature of this June 2023 post on Telegram offering a link to a website where they can be purchased. DarkOwl will not publish this in order to not drive traffic to this website:
Dog Fighting
Unfortunately, dog fighting has long been a popular pastime, especially in places such as the Philippines. As of 2023 it is still legal in Russia, Japan, Honduras, Afghanistan, and Albania. Even in nations with criminal laws against this activity and fines, many people still choose to engage in dog fighting, and use anonymous platforms to organize and conduct these events.
The dark web combines its darker side, with actors soliciting drugs for “fight dogs” to improve their performance in fights, combining the underground markets of narcotics and illegal animal activities:
Dog fighting activity continues to gain traction and spread to other geographical areas – Iran and China also have dog fighting rings and sales on Telegram. DarkOwl will not publish the content of the channels. However, below we show some examples of the channel information.
A Persian dog fighting channel, offering the sale of “war dogs”:
Figure 4: Source: Telegram
This Russian channel discusses the history of dog fighting in Moscow, and how it has evolved as a sport with an avid fanbase:
Figure 5: Source: Telegram
People from backgrounds of all kinds participate in horrific activities involving dogs. Not long ago, news broke of a United States Pentagon official leading a dog fighting ring. It’s not just famous people from movies, TV, and sports industries. Politicians and governing officials also get involved as we can see in the example below from Telegram:
Ear Cropping
Ear cropping is the practice of surgically altering or removing ears from dogs. This practice is legal for certain species in some countries, including the US, for hygiene reasons. However, in other countries such as the UK, the practice is totally illegal. The RSPCA reports that they are seeing an increase in ear cropping in the UK due to celebrities and influencers “glamorizing” the look. DarkOwl analysts have identified mentions of this practice on the dark web and adjacent sites.
DarkOwl analysts identified an onion site which offers ear cropping videos and examples as of October 2023. It is unclear where these were taken and if it was in a country where the practice is legal, but it highlights there are individuals who wish to view this type of activity.
Deception Methods
As animal rights activists use technology to combat these activities, online operations turn to methods used to fool those who legitimately sell animals, such as bringing children or other family members when they go to purchase. On the below Telegram channel, users discuss how some people use children or other family members to hide that their animal purchases are actually for fighting:
Online Efforts to Combat Animal Abuse
There are also many petitions and people identifying harmful practices, such as puppy farming, on these platforms. They combine their efforts on other social media sites, such as Facebook, in order to spread the word about harm to animals and enlist civilian and government efforts to inflict harsher penalties. Below, a Facebook post identifying Irish puppy farmers is posted.
An Australian also comments on the commonality of puppy farming, and shares a resource for potential pet parents to avoid buying from breeders:
Final Thoughts
Previously, DarkOwl predicted that like many other activities, animal trading and sales of exotic animals and exotic animal materials could move to darknet-adjacent platforms such as Telegram. The trends we see now, in the fall of 2023, confirm this move continues to these platforms, and also includes some social media platforms such as TikTok and Reddit. An upside to this trend is that some of these platforms can be easily monitored and tracked, reducing these horrible activities and hopefully bringing about the arrests of those involved. Additionally, social media sites are more likely to respond to takedown requests, while little action can be taken against dark web sites.
Despite activist efforts, these online activities continue and unless there is intervention from law enforcement and animal groups, these activities will unfortunately continue.
If you’d like to contribute to the effort to stop the animal activities described in this blog, or learn more about general efforts to save animals, please see:
DarkOwl is a Denver-based company that provides the world’s largest index of darknet content and the tools to efficiently find leaked or otherwise compromised sensitive data. We shorten the timeframe to detection of compromised data on the darknet, empowering organizations to swiftly detect security gaps and mitigate damage prior to misuse of their data.