[Webinar Transcription] Leveraging Dark Web Intelligence for Real World OSINT Investigations

March 21, 2025

Or, watch on YouTube

Attendees of this webinar, hosted with Carahsoft, learned about how in today’s world, Open Source Intelligence (OSINT) plays a critical role in uncovering threats and mitigating risks by leveraging publicly available information. This webinar dove deep into the practical side of OSINT investigations, focusing on how dark web data can be strategically utilized to enhance threat detection and risk assessment for organizations.

During this webinar, the Director of Intelligence of Collections at DarkOwl, demonstrated the power of DarkOwl Vision through real-world examples, including:

  • Tracking stolen credentials from a recent data breach
  • Monitoring dark web marketplaces for insider threats
  • Identifying emerging cybercrime trends
  • Analyzing chatter on forums to predict potential attacks
  • Protecting executives and high-profile individuals

Participants gained hands-on insights into gathering, analyzing, and interpreting OSINT data, with a focus on applying dark web intelligence to solve real challenges.

NOTE: Some content has been edited for length and clarity.


Erin: Hi everybody. I am the Director of Intelligence and Collections at DarkOwl and I’m going to talk you through some background on the dark web and some OSINT investigations.

What we’re going to cover today, I’m going to give you a little bit of background on who DarkOwl are, what the dark web is, why it’s important, how we can use it in OSINT. And I’m going to do a couple of use cases and walk you through some examples of what we see on the dark web and how you might be able to use it for OSINT.

A bit of background about DarkOwl. We’ve been around since 2014, but collecting data I would say from the dark web in earnest since around 2017-2018. So, our goal is to collect data from the dark web so people are able to use that data for their investigations and to protect their organizations. We allow people to do that in a number of different ways, so you can access data through our platform Vision, which I’ll be showing you how to use today, but we also have APIs and data feeds which allow you to access dark web data, and the idea really is challenging to access the dark web, and also it can be against policies and violations to access it. It’s not easy to access and there are things on there that you might want to avoid. So we allow you to access that data in a secure way.

What kind of data do we have? We have layers of the deep and dark web as well as some surface web, although we are primarily a dark web company. Everything that you see here in red is something that we do collect from. We’re always looking to increase our coverage though and look at other areas where we see criminals, cyber threat actors, insider threats, people proposing violence, operating. So, we’re always on the lookout for other areas that we can collect from. But as I said, we’re primarily dark web, TOR, onion sites is where we get most of our data from, but we do also collect some surface websites, things like Doxbin, paste sites, certain forums where we see extremist activity being discussed, as well as underground criminal forums and markets and discussion boards. We also collect from Telegram and Discord. We see a lot of criminal activity operating in those areas. And this just gives you a breakdown of the volume of data that we have.

I believe there’s a polling question up on the board for you now. And that’s just to highlight, are there any messaging apps you’re seeing as part of your investigations at the moment that you would like to have more coverage of. As I mentioned, we do cover Telegram and Discord, but we’re always looking for other options. So please fill that in. You can have multiple choices. But going back to the slides, you’ll see that we’ve got a large volume of data that we collect. We have been collecting since 2017, and we do not remove any historical data because that can still be important to your recent investigations. And so, you can see the numbers that we have here. We also extract particular entities, so email addresses, IP addresses, credit cards and crypto addresses that can help you with your recent investigations. And we also have a large volume of data leak records that we’ll talk about in a little bit more detail.

And this is just to give you an overview of how our ecosystem works. We do have the Vision UI where you can access all of our data as well as APIs. We have several API products that allow you to generate scores and risk assessments based on the exposure that an individual has as well as context information about our data leaks.

And we also provide darknet services. So, for those that don’t have the resources and/or do not have the experience working with the dark web, we are able to do investigations and OSINT investigations on your behalf and produce reports regarding whichever you’re investigating. So, this is our Vision UI, it supports Boolean logic, it has darknet data within it, and it can also be used for alerting, but I will go through that in a lot more detail later in the presentation. But so, just so that we’re on the same page, let’s start with talking about what is the dark web.

No OSINT presentation is complete without an iceberg slide so this is our obligatory iceberg slide which breaks down the surface net, the deep net and the darknet.

We really do focus on the darknet you know collecting from onion sites, TOR, ITP, ZeroNet that is specific software that you need to download to access that and also, it’s not indexed so you need to know the URL that you are going to in order to find that information. So, it makes it a lot more difficult to navigate and identify sources that are going to be beneficial to you as part of your recent investigations. And that’s one of the things that we assist with. We, you know, have broad coverage across the dark web. We’re always looking to identify new sites and new areas where individuals are communicating or buying and selling goods. And so that allows you to be able to search that information. We also do do the deep net. So, this is not indexed by search engines, usually behind a firewall of some kind or password protected. It’s not easy to access, but it’s easier to access than the dark web. You can still do it using your usual browser. And there are a lot of forums and marketplaces and vendor shops, et cetera, that sit on the deep net. And then you also have the surface net. So this is, you know, the internet we’re all used to. It’s indexed by search engines. So, you can, you know, go to Google, go to Yahoo and find a site that you’re looking for and it’s all open. I would say more and more we are seeing fights on the surface web that are also engaging in criminal activity. People seem to be less concerned about obfuscating what they’re doing then they had traditionally been and also, I think law enforcement’s been quite successful in taking down some dark net sites and that has kind of moved people onto the surface net so that’s an interesting trend that we’re seeing at the moment and that’s why we cover those areas as well as just the dark net.

To give you a little bit of history on the darknet, It started in around 2000. The Darknet Tor project itself was actually created by the US Navy as a means of secure communications for their operations. And then they decided to make it an open source tool. The Tor project is a not-for-profit that runs Tor and the onion sites and the bridges, et cetera. It’s always worth noting that there are fully legitimate reasons for using the dark web for those that live in countries where communications may be limited and, you know, they may not be able to access mainstream media, things like that. Tor can be used for that. And also, people who do really want privacy. They can use the dark web to enable that privacy. I’m not going to go through everything here on this slide obviously it goes up to 2020, but you can see that there’s been a lot of things that have happened in the darknet, things like cryptocurrency becoming more prevalent and being a semi-private way of people transacting and law enforcement operating on the dark web to take down sites has been a game changer as well. But there’s a lot of things that have happened on the dark web ecosystem and continue to happen to this day.

Okay, so why is dark web data important? I’ve kind of touched on this, but a lot of criminals operate on the dark web. So, we see people communicating on the dark web in forums, in messaging apps, having conversations, but we also see people selling and buying goods. We see people offering services. There is a lot of activity that happens on the dark web that can be useful to your investigations. And there’s also sites where people’s data is released. So, data leaks, stealer logs will go into in a little bit of detail, as well as things like DoxBin where people’s information is released. So, it can really help you in your investigations identifying information about individuals, but also can help you to kind of protect individuals from an executive protection perspective and we’ll talk about that in a bit more detail as well.

While we’re level setting on dark web, hopefully everyone on this webinar is aware of what OSINT is, but it’s basically the collection analysis and dissemination of information that is gathered from publicly accessible sources and these are a couple the sources that are out there that I think are familiar to most people doing OSINT investigations. But people don’t always think of the dark net. I think some people think it’s scary. There are questions about whether or not it’s truly open. But it is in fact open. It’s harder to access, but all of the data is out there for people to go and view if they choose to. So, I like to think of it as a tool in the toolbox that an OSIN investigator has. you know, you should be looking at social media, you should be looking at public records, you should be looking at, you know, other mainstream websites that are out there, things like the Wayback Machine, but the dark web is an important element of that investigation and gives you kind of a broader overview of information that you might not get from other sources. I feel like, again, I have the obligatory iceberg slide, this is my obligatory AI generated image. You can see that it’s AI generated because it’s the Dark Wab and not Dark Web. It seems that when you give it a few too many prompts, it gets confused, but this is my obligatory AI image.

Okay, so but what things do we see on the dark web? So hopefully people are familiar with some of these. I think some are more well known but marketplaces are definitely, you know, a mainstream and one of the things that first started in the kind of criminal ecosystem of the dark web with things like Silk Road, which was not the first market, I believe, Farm was, but, you know, marketplaces for buying and selling drugs, illicit goods, hacking tools, tutorials. You can purchase hitmen, you can purchase all manner of strange things, whether or not that’s legitimate or not is something that we can also discuss.

There’s also a wide range of forums, so people kind of talking about things that interest them. Breach forums is probably one of the most famous forums out there that works in buying and selling data and sharing data. But there’s also extremist forums out there, things like the in-sell community, right-wing extremists operating on forums too or people just discussing general things not all of the forums are bad. There are some social media sites that are on the dark web too. There are mirrors of things like Facebook and Twitter that appear on the dark web so people can access them in countries where there might be censorship so that that’s one of the more legitimate areas and also we  talk about social media and I’ll go onto this in the next slide as a dark web adjacent area where we do see criminals operating on mainstream social media as well.

Cryptocurrency obviously is the currency of the dark web. We still see bitcoin as the largest currency being used but things like Monero and Zcash and more of the privacy coins are also popular. You you know, wallet explorers, there are dark web wallets, there are tumblers, mixers, et cetera. So a lot of cryptocurrency activity can occur on the dark web as well as being, you know, again, perfectly legitimate information, there are a lot of new sites that are on the dark web. The BBC has a new site. I believe CNN has a new site. And there’s also just kind of other sites that share information. These can be kind of data repositories, you know, when information is leaked by whistleblowers that can sometimes appear on the dark web as well. And then we have data leaks. So rather than kind of whistleblowers, that’s more stolen data and data that’s been taken illegally. And in that vein, we also have ransomware. So, a lot of ransomware groups have leak sites on the dark web where they will kind of shame their victims into paying the ransom by saying that they are a victim and they’re gonna release the data. If the victim does not pay the ransom where they do usually then release that data which is downloadable on the dark web.

But as I mentioned, there’s also some things that we refer to as dark web adjacent. Oh, there’s a poll question. So, what areas of the dark web are of most use to you. So I’ve gone through some of them, but it’d be really interesting to know from your perspective what is most beneficial for you and your investigations and your day-to-day job. But in that thing we also have some dark web adjacent. That’s what we refer to as sites that aren’t or messaging apps or platforms that aren’t exactly on the dark web, but they’re still being used by the same community of people, i.e. usually criminals or extremists or some form of bad guy for one of the better phrase. Things like Telegram, ICQ, Jabber, Discord is a gaming site as is Twitch, where we see people are sharing classified information, they’re making threats. A lot of the so-called gore community are very active on places like Discord tends to be younger generations and people that are into gaming, as you would expect. But these are all areas that we think it’s important to also have coverage of in order to, you know, have a full coverage of these communities and these groups and how they’re interacting. Obviously, I would say there’s been some changes in Telegram. In recent months, but that we are still seeing a huge amount of people operating on Telegram in a malicious way.  And then the surface web, marketplaces, vendor shops, forums, as I mentioned before, excuse me, we are seeing some people that are operating in the same way they operate on the dark web on the surface web. You can find those vendor stores and those marketplaces, which I think is an interesting evolution and how these communities are operating.

Okay, so there is a lot of data on the dark web as well. So, we’ve kind of talked about the general themes and the types of sites that there are, but there’s also a lot of different types of data and a lot of different types of information. So, a huge amount of PII appears in data leaks and is discussed on some of the sites as well. Financial information, There’s a huge ecosystem of financial fraud, people selling credit card data, selling banking information, selling details of how to operate in a financial fraud way. So, we see a lot of people doing tutorials and giving guidance about how to conduct some of these scams. There’s also a huge, as you would expect, cyber and hacking community. So, people trading malware, and exploits, and different tools that you can use, you know, the phrase script kiddies, individuals who aren’t necessarily that sophisticated enough to build code or build these vulnerabilities, but they can purchase them and execute them and still kind of use them for criminal activity. So, we see a lot of trading of those kind of things, drugs, obviously, and cryptocurrency I’ve also mentioned. There’s a lot of activity that can come from this kind of data. We see cyber-attacks. We see data exfiltration and hacking. There’s also cyber espionage. I mean, APT groups are hard to identify, but they’re definitely operating in some of these places. And insider threats as well, people, you know, talking about sharing information that they should not be sharing or making threats to their organization. These are all the types of things that we see on the dark web.

Let’s dive in a little bit more into what data we actually see and kind of try to look at it from an OSINT perspective where possible.  Ransomware I have already mentioned. This is two examples of ransomware leak sites, one is LockBit, the other one, I actually don’t remember which ransomware site it is, but you can see like they will share the information about the company that has been victim of a ransomware attack.

But you can see they’re also operating the yellow image. You see that they have a Telegram channel. They are on Twitter and they are on Facebook. So they have a dark website where they share this information, but they’re also operating on kind of more of the mainstream areas. And that can be really useful for you as part of an OSINT investigation. If you’re trying to identify more information about these, you’re building that kind of what we call darknet footprint and digital footprint for these groups and how they’re operating. So, you know, their sites can give you information about them that can help with understanding how they operate. But also, you know, the information that they share while stolen and really should not be shared can be used as part of investigations as well. Especially if you’re concerned about supply chain or third party risk, understanding what data has been released about an organization can help you protect your organization if, you if one of your supply chain vendors is in there, or if you are the person that has been leaked, sorry, had been ransomed, knowing what of your data has been released and is out there for other criminals to kind of delve into, is an important thing to know. And I think some people get concerned about this data and it’s stolen data, but the thing I think people need to understand is criminals have access to this data, threat actors have access to this data and they will use it to conduct more criminal attacks, so it’s important to know what is out there from a risk perspective so you can better protect yourself.

Financial crime I’ve mentioned, we see a lot of marketplaces but also places like Telegram being used as a market for people to sell financial information. So, you can see here there’s stimulus checks being sold, there’s people selling plain credit cards, there’s other things that they’re making available on here, cash apps, etc. So there is a huge ecosystem of this financial crime.

And in the theme of markets, we also see people selling drugs and weapons on the dark web as well.

You’ll see that a lot of these markets look similar to what you would expect to see from, you know, a commerce website on the surface web as well. They provide pricing, they provide images, they also provide reviews. And that can be really useful for us from an OSINT perspective. So, you know, things that you might want to look into on these markets that can give you some clues that you can go and look through in more traditional sources. So, you know, you’ve got OSINT, sorry, you’ve got reviews, as I just mentioned. So, these are some examples of reviews. I don’t know that they are legitimate to be honest, but you’ve got the username, you’ve got the date that they purchase, And sometimes they give some information in there, like, you know, it arrived really promptly that could give you ideas about, you know, where are they based? Where are they purchasing from? And, you know, how it operates. We’ve also got here, like, more descriptions about the drugs that they’re selling. So, they’re telling you the type of drug. It’s a pressed pill. They’re made in-house. So that’s something that they’re, you know, Again, you can never really trust a threat actor, but they might be operating this themselves. That’s something to go on. And they’re also saying that we ship worldwide.

We’ve got other examples where they tell you where they’re shipping from. So, this is actually counterfeit money that they’re shipping. And they’re telling you kind of how they operate it, what techniques they have in terms of producing this counterfeit money, but also they say they’re shipping from Romania. It’s a pretty good starting point that they could be operating in Romania and that they’rei ndividuals based in that country. Again, with OSINT, you also always have to verify everything. You can’t take anything at face value, but these are data points that I think it’s important that you pull out.

And this one is a little bit maybe harder to read, but I thought it was important because they’re giving them details and almost like TTPs of how they’re operating. So they’re telling you they ship it in an envelope that it uses anti-extra bags and if it’s inspected, it will get through it. And they’re actually saying that the National Post Service is the safest way to order it and that they also use express shipping. So, if you’re doing an investigation into kind of the methodology of someone selling these drugs or counterfeit goods, I think I believe this one was still a counterfeit money. You can get from these marketplaces and from these sites information about how they are actually operating, which can really help you in your investigation and maybe where you wanna focus to identify things from other sources that are out there.

Stolen data is also a big one. I’m not really going to show real examples here because I don’t want to expose people’s PII, there’s some of that. But these are, this is Breach Forums and I believe LeapBase. These are sites that appear on the dark web where people are sharing data. And again, we get a lot of questions about is this open? I would say predominantly on these sites; the data is shared freely. Sometimes you need credits, so you need to have a reputation on the sites and that have built kind of some of that persona. But by and large, this is freely available data that again, criminals are going to have access to and it’s something to be aware of.

This gives you an idea. This is a breakdown from data that’s in our platform and Vision.

I looked at the last 90 days and it gives you a breakdown of some of the PII that is available in these leaks. So, you know, names and email addresses you’d expect, but you’re also seeing identification numbers, information about people’s genders, information about companies, phone numbers, dates of birth. You know, there’s kind of two use cases for this kind of data, I think, in the OSINT realm. One is, you know, attribution of looking at threat actors. There’s so much leaked data out there now, but threat actor information is going to appear in there as well as, you know, legitimate people’s data. So, it can really help you with that kind of attribution use case but also from a risk analysis perspective understanding what information is out there about yourself or your employees or you know individuals that you might seek to protect. This lets you know kind of what level of risk they have, what level of exposure they have and how criminals might be able to target them.

Stealer Logs is something that we’ve seen a huge rise in. They’re not new, but they just seem to be a lot more prevalent in the last year or two than they were previously. This is an example. ALIEN TXTBASE is a group that have been sharing not full stealer logs, actually, but what we would call combo stealer logs, where it has the URL, the password, and the username of an individual. And they’re making that available on Telegram. So, you know, this is great for criminals in terms of they are able to log into accounts, do account takeover attacks, depending on what URLs appear here, it could be access into someone’s network. But CELA logs are basically malware that exists on your computer or a victim’s computer and steal things like cookies like your auto fills on your browser, your passwords, and your usernames. It can also steal things like cryptocurrency wallet addresses, basically anything you’re doing on the internet, it can hoover up and we have some good blogs that I would recommend about stealer logs and how they work and how they operate and the different types of them. But they have a huge wealth of data in them.

And again, threat actors have been victims of these as well as legitimate citizens. And we’ve seen a lot of research where you are able to search for places like XXS or exploit, you know, dark web forums and see people’s user information and that can really help with attribution, but also knowing that risk of your password and your username is out there and that can be used for a variety of different attacks is really important and also because the cookies are in there it can help threat actors get past two-factor authentication and OTP codes as well, so that’s something to bear in mind. Again, I said I wasn’t going to share actual data, so I wanted to give a really basic description of how some of this data can be useful. But if you have an email address for a threat actor or someone you’re interested in understanding more about, you can search for that in leak data, and it might appear and show that it’s linked to a password. Depending on how unique that password is, you might be able to identify other accounts that they’re using because we all reuse passwords. We shouldn’t and we get told not to all the time, but most people do. So, you might be able to identify other email addresses and then you can use other OSINT techniques to find more information linked to that. There are tools out there that will allow you to search for an email address and using open-source techniques can find things like telephone numbers that link to social media accounts, that link to things like Cash App and Venmo that can give you access to the real identity of an individual. So, this is a very basic, simplistic way of talking about the workflow, but you can definitely use information and data leaks to be able to investigate individuals. I see it as another tool in the toolkit of data that’s open that you can use as part of your investigation.

We also see a lot of extremist activity on the dark web and on particularly Telegram. So, these are some images that we identified related to ISIS but we also have things on there that are you know right-wing, extremist, racist information that’s being shared and it’s important to monitor these because they can lead to real world threats and so we need to identify what is being done. You can see with the ISIS threats these were around some sporting events where they were encouraging people to target the sporting events and they were giving specific areas that they should do that and this is something we’ve definitely seen an increase of is using the dark web using things like telegram to incite violence in others and create loan actor attacks. So, it’s definitely something that needs to be monitored.

Executive protection is also a use case that we’re seeing more and more active on the dark web or the data on the dark web helping with that use case I should say. So here I’ve got and I apologize for some of the language in this, but just to highlight, on the left-hand side, we’ve got a post from DoxBin where they’re talking about X FBI agent, whether this information is accurate, I don’t know, but you can see they’re providing things like date of birth, address,] telephone number, his wife’s information, what their role was. He’s also got their daughter’s information. So, huge amounts of data are being shared about individuals on Doxbin. If you’re not monitoring that, then that’s going to be an issue because, you know, a lot of when people’s information is shared here, it can lead to real -world attacks, like things like swatting attacks. A lot of that information would come from Doxbin. You can also see we’ve got a data leak here that specifically mentioned CrowdStrike employees. Again, I haven’t provided any of the actual data, but you’ve got first name, last name, email, where they’re located, their phone number, their job title. So, this is information that’s being released about employees. And again, why you need to kind of be monitoring data leaks for your employee’s information being shared. And I think it’s really important as well that you do that from a corporate perspective of looking at corporate email addresses, but to do this completely you also need to have access to personal information too. And then the the one with the not great language so apologies again for that is it’s from 4Chan and it is an example of a particular individual that I have blanked out being threatened and being said he will be shot, shot like the healthcare CEO and it’s a long time coming. So, we can see kind of chatter and rhetoric of people making threats against individual on dark websites as well. And it’s really important to analyze those and make a judgment about, you know, the risk that these individuals pose and then using OSINT techniques to see if you can identify who these individuals are so you can have a bigger picture. 4chan unfortunately, is a difficult one to do that with because it’s anonymous, but it’s so important to know what people are discussing.

And then you can also do threat actor investigations and attribution. So, this is a bit of a historic one, but Pompompouren was the admin of Breach Forums previously. He was also on raid forums, and you know, from analyzing the data, we were able to look at the username and see that he was active on all of these different dark web forums. We were really able to build that footprint of how he’s operating, but you’ll see he was also, on Discord. And so, it really allows you to kind of understand how this person’s operating, and obviously you can analyze their language and what they’re talking about. And if there’s any clues within those forums to location and information. But I highlighted the DoxBin for executives through Actors Get Docks all the time as well. So, this is an example of information relating to him that was shared online. Several people doxed this individual. So, it’s clear now that Pompompouren was Conor Bryant Fitzpatrick. He was subsequently arrested. So, using the data, and again, this is a very simplified version, but you’re able to identify a real person based on a username and kind of how people are interacting in the community. And from that, we were able to identify telephone numbers that they use that you can do further research on IP addresses that we use. And I believe one of the IP addresses that was associated with of Fitzpatrick was actually where he was hosting breach forums, and the FBI were able to use that. He is now or he was incarcerated, he was charged. So using the data and the information online can really help you doing investigations into threat actors as well.

Okay, and we have a third question. So what use cases are most important to you? I think it’s important to understand what use cases people are working on so we can best identify kind of the data that’s going to support that from the dark web.

But with that said, I’m going to move on to a couple of quick demos to show you real world examples of how we can find data using the Vision platform (see recording for demo portion).


Interested in your own demo? Request one.

Threat Actor Spotlight: The Terrorgram Network: Origins, Operations, and Downfall

March 19, 2025

DarkOwl analysts regularly follow threat actors on the darknet who openly discuss cyberattacks and disseminate stolen information such as critical corporate or personal data. Such analysis helps DarkOwl’s collection team direct crawlers and technical resources to potentially actionable and high-value content for the Vision platform and its clients.

In April 2024 the UK took the unprecedented step to sanction a group known as Terrorgram as a terrorist organization.  The UK was the first country to take this step, proscribing the group which consists of various Telegram channels which have been used to share and encourage extremist ideologies and methodologies. This marked the first time a group that is primarily organized on a messaging app has been declared a terrorist organization.  

In this blog we will explore the origins of the group, how they operated and the current status of the organization. 

Terrorgram (logo to the left) was an online network of neo-Nazi and white supremacist extremists that was formed on the messaging app Telegram. The group are devoted to militant accelerationism – the idea of hastening societal collapse through violent acts and used a number of different telegram channels to spread this message.

The group’s overarching objective was to inspire terrorism, leveraging propaganda to promote white supremacist ideology and encourage both organized and lone-wolf attacks. The concept of encouraging terrorist attacks, rather than conducting them yourself is known as stochastic terrorism. Over the past few years, Terrorgram’s activities have triggered international law enforcement crackdowns as officials sought to contain its spread of hate and violence. 

Origins, Ideology, and Objectives 

Terrorgram emerged in the late 2010s as an extension of earlier extremist forums and subcultures. A major influence was the now-defunct Iron March forum, which, despite only ~1,200 users, had an outsized impact on modern neo-Nazi ideology.

Iron March popularized James Mason’s book Siege, which advocated leaderless terrorist cells to destabilize society and spark a fascist revolution. From this foundation, Terrorgram adopted a militant accelerationist doctrine: it seeks to collapse the current order through stochastic terrorism, inciting followers to commit acts of violence in hopes of triggering broader chaos. 

Terrorgram promoted the ideologies of neo-fascist and white supremacists. Many of the channels they operated glorified Hitler and other fascist figures, and promoted slogans like “TRAITORS WILL HANG.” Saints culture was also heavily promoted by Terrorgram users, the culture treats right-wing terrorists and mass killers as martyrs or “saints,” praising their deeds and encouraging others to emulate them.  

Figure 2: Rules to be made a “Saint” by Terrorgram 

The ultimate objective of this ideology is to radicalize young extremists and drive them to commit hate-fueled attacks – against minorities, government, infrastructure – to accelerate a hoped-for collapse of multicultural society.

Communication Channels and Platforms 

Terrorgram’s primary base of operations was Telegram (Figure 3 to the right) – an encrypted messaging and social media app that up until recently gave extremists a relatively unpoliced platform.

The name “Terrorgram” itself is a mashup of “Telegram” and “terrorism,” reflecting how deeply the group is tied to the chat platform.  The network of Terrorgram was made up of hundreds of decentralized channels which were used to communicate and share propaganda with followers. In 2021, the network encompassed 200+ neo-Nazi channels on Telegram, many openly sharing bomb-making manuals and calls to violence. Some popular channels amassed thousands of followers (one had over 16,500) despite Telegram’s nominal efforts to ban violent content. 

There is little evidence of a significant dark web presence dedicated to Terrorgram; its preferred “underground” forum is effectively Telegram itself. However, when faced with crackdowns, some members discussed migrating to more obscure encrypted apps like Signal, Briar, or Session to evade surveillance.

Figure 4: Propaganda booklet created and shared by Terrorgram

Terrorgram’s propaganda machine was sophisticated and deliberately geared toward inciting violence from its followers. An inner circle of propagandists, the self-described “Terrorgram Collective,” produced digital manifestos comprising of hateful ideology and practical guides. These e-magazines – circulated as PDFs in the channels – carry titles like Hard Reset and explicitly instruct readers how to commit terror attacks. In mid-2021 Terrorgram published a guide urging attacks on power grids and violence against minorities, police, journalists, and other “enemies.”   

Figure 5: Propaganda shared by Terrorgram encouraging followers to attack Government, law enforcement and critical infrastructure

A second manifesto released in late 2021 combined accelerationist and eco-fascist ideology with step-by-step manuals for making weapons. By 2022, the Collective put out a third installment (the Hard Reset series) that glorified recent white supremacist attacks and detailed critical infrastructure targeting strategies, in December 2023 a Terrorgram manual described how to manufacture explosives from urea nitrate fertilizer.

Figure 6: Propaganda created by Terrorgram 

Text publications are not the only types of publications that Terrorgram have produced, they have also leveraged multimedia. In October 2022, it released a 24-minute film titled “White Terror,” which celebrated dozens of terrorists from 1968 to present, hailing them as saints and martyrs. The video used actual shooter livestream footage, including clips from the 2019 Christchurch massacre and 2022 Buffalo supermarket attack, and news reels, as well as extremist messaging. The video explicitly urged viewers to carry out new terror acts, promising that “future attacks will be honored.”  

In order to spread this information, the group maintained multiple channels. The channel admins would cross-promote one another’s groups, sharing posts and links to encourage followers to subscribe across the network. This created an environment in which any newcomers who found one Terrorgram channel would soon be exposed to many more.  

The group also heavily relied on the use of memes and images to share their propaganda; controversial memes, catchy slogans, and insider symbols, like skull masks and sonnenrads, were used to build a subcultural identity that could appeal to alienated individuals.  

Figure 7: Telegram message depicting the skull mask widely used by terrorgram and mass shooters 

The Terrorgram group were successful in using their propaganda to incite real world acts of violence:

  • In October 2022, a 19-year-old gunman attacked an LGBTQ bar in Bratislava, Slovakia, killing two people. In his manifesto, the shooter explicitly credited the Terrorgram Collective as an inspiration. Terrorgram channels hailed him as a martyr after the fact, adding him to their list of “saints.” 
  • In early 2023, FBI agents foiled a plan to attack the electrical grid around Baltimore, Maryland, arresting Brandon Russell (an Atomwaffen Division founder) and an accomplice. Both were active in Terrorgram circles and had been sharing the network’s materials.  
  • In January 2024, agents raiding the Florida home of a man found he had a Terrorgram-produced manual and a copy of Mein Kampf alongside plans for a mass shooting. Lightner had posted on Telegram about wanting to murder people of color and Jews. 
  • Brazilian investigators suspect that a 2022 school shooter in Aracruz, Brazil (who killed 4 people) had engaged with neo-Nazi online content aligned with Terrorgram’s ideology. 
  • In August 2024, a young man carried out a knife attack at a mosque in Eskisehir, Turkey, injuring several worshippers – an incident the U.S. State Department later cited as having been “motivated and facilitated” by Terrorgram propaganda.  
  • In January 2025, an extremist in Nashville committed a school shooting that channels in the network celebrated as part of their “accelerationist” campaign.

It is believed that the Terrorgram were successful inciting violence in others and encouraging lone wolf attacks as they were very specific about what they were asking their followers to do. The group would often provide targeting lists as well as tactical guides and information about the successes and failures of previous mass shooters as a blueprint for future attacks. The network has circulated spreadsheets of critical infrastructure sites and personal information of officials/journalists deemed enemies. It had also urged followers to attack power stations, synagogues, LGBTQ venues, refugee centers – any targets that fit its apocalyptic white supremacist worldview.

In April 2024, the United Kingdom formally proscribed the Terrorgram Collective as a terrorist organization, making it a criminal offense to belong to or support it. British officials warned that the network “spreads vile propaganda” and “aims to radicalize young people to conduct heinous terrorist acts.” This UK ban put Terrorgram in the same category as ISIS or National Action (another neo-Nazi group), signaling how seriously authorities viewed the threat. The group were then also designated by the United States Government in January 2025.  

Police in Canada arrested two Ontario men in December 2023 on terrorism charges for their role in creating Terrorgram propaganda. These individuals, identified in court documents as Matthew Althorpe and Kristoffer Nippak, allegedly helped author the Terrorgram manifestos and produced recruiting videos for Atomwaffen Division. One was charged with multiple counts of participating in and facilitating a terrorist group and even instructing others to carry out terrorism. The other faced a lesser charge of contributing to a terrorist group’s activities.  

In September 2024, federal prosecutors in California unsealed a 15-count indictment against Dallas Erin Humber and Matthew Robert Allison, accused ringleaders of the Terrorgram Collective. According to the Department of Justice, Humber and Allison used Telegram to solicit hate crimes and terrorist attacks against Black, Jewish, LGBTQ, and immigrant communities, and even solicited the murder of specific government officials. These arrests were a significant blow to Terrorgram’s leadership, as Humber and Allison were believed to be key organizers behind the scenes, their Telegram aliases “Ryder_Returns” and “BTC” were well-known in the extremist chats.  

Since the arrest of Telegram’s CEO in 2024, Telegram has changed its terms and conditions and how it operates with law enforcement to respond to claims they allow extremist and other criminal activity to be openly shared on their platform. While Telegram has insisted that “calls to violence have no place” on its service and claims it removed several channels using the “Terrorgram” name in the past, it is clear that these groups were allowed to operate for multiple years with no consequences from the platform, allowing them to incite violence and lead to the murder and plots to murder multiple individuals.   

With its leaders behind bars or on the run and global sanctions in place, the Terrorgram network has been severely disrupted as of 2025. Counterterrorism experts observe that a string of arrests in the U.S., Canada, Europe, and elsewhere over 2023–2024 dismantled the collective’s structure. Many of the most active channels went quiet or into lockdown mode following the crackdowns. 

Terrorgram as an identifiable entity has not openly rebranded under a new name – at least not yet. It is possible that remnants of the community have splintered into smaller cells or migrated to other fringe platforms without the Terrorgram label. Indeed, the ideology of militant accelerationism predated Terrorgram and will persist beyond it, so authorities remain vigilant for copycats. 

Terrorgram’s story—from its genesis in shadowy neo-Nazi forums to its rapid expansion on Telegram, and finally to its undoing by global law enforcement—underscores the evolving landscape of extremist threats. It operated at the volatile intersection of online subculture and real-world violence, proving that internet memes and manifestos can indeed have deadly consequences. While the collective as originally known has been largely torn down, the ideological fuel it spread is still out there. Counterterrorism efforts will need to remain adaptable and collaborative across borders to prevent the next “Terrorgram” from taking root. 


Curious about the darknet? Contact us!

How your Wi-Fi Metadata Could be Leaking Your Location – Executive Protection Awareness

March 13, 2025

How many Wi-Fi networks has your smartphone, laptop, or IoT device connected to over its lifetime? If your device is more than a few months old, the number could be surprisingly high. By default, devices typically store Wi-Fi access points and automatically attempt to rejoin them – even when they are not in range of the access point. As a result, they continuously broadcast a list of the networks they’re trying to connect to. This constant “auto-join” behavior may inadvertently reveal your whereabouts, commonly visited locations, and likely your home. In the wake of the recent assassination of a major healthcare executive, executive protection and security teams need to stay technologically savvy to potential privacy leaks—any technology that can be used to discover an individual’s location becomes a serious concern.

As a result of the Edward Snowden leaks, a Canadian intelligence technique, used by the Communications Security Establishment Canada (CSEC), was exposed to the public with details reported in 2014. Leaked documents from the CSEC confirm that tracking individuals via their Wi-Fi and IP metadata is far from theoretical. By starting with a known “seed” access point (often at airports or hotels), government officials identified devices connected to hotspots and traced these devices forward and backward in time through other networks. This so-called “travel node” approach leverages big-data analytics to build detailed movement profiles, revealing not only routine routes (like daily commutes) but also one-off visits to coffee shops, internet cafés, or conference centers—demonstrating just how valuable Wi-Fi metadata can be for pinpointing a person’s location and habits.

Shielding your privacy from sophisticated nation-state intelligence operations may or may not be your primary concern regarding cyber privacy. However, the technique of tracking, fingerprinting, and identifying individuals based on Wi-Fi metadata isn’t limited to nation-state actors. Open-source tools like AiroDump-ng, AirGraph-ng, and websites such as Wigle.net can also be used by less-sophisticated adversaries to potentially locate persons of interest and their routine habits.

Before we dig in, lets better understand how MAC addresses work and why they are important.

Every device that connects to a network is assigned a unique MAC address if it doesn’t already have a permanent, manufacturer-assigned one. Depending on the device, the MAC address might be completely random, partially random, permanently set once assigned, regularly reset, or permanently assigned from the factory. The important thing to consider is that some manufacturers don’t randomize your MAC address, which makes it much easier to identify you electronically.

A MAC address is typically represented as six segments of hexadecimal values, for example: 44:38:39:FF:EF:57. The first three segments (44:38:39) often represent the Organizationally Unique Identifier (OUI) associated with the device vendor—in this example, Cumulus Networks, Inc. Several MAC address lookup websites can provide further details about the vendor based on the OUI.

This is noteworthy because the MAC address is not hidden and can be captured by anyone within range of your access point, even without connecting to your network.

Below is a screenshot showing an example MAC address and its vendor details obtained by searching the OUI on an online lookup tool.

You can already see how devices that constantly broadcast their presence might leak sensitive information, but let’s take this a step further.

Tools like AiroDump-ng allow even unsophisticated actors to sniff Wi-Fi-enabled devices whether connected or unconnected to a network. Once an actor collects data from an area of interest, it can be visualized using another tool called AirGraph-ng. Both tools are free and come pre-installed in the Kali Linux operating system—a popular OS among cybersecurity professionals, hobbyists and bad actors alike.

Since this blog isn’t a tutorial on how to use AiroDump-ng, let’s focus on the user-friendly output graphs from AirGraph-ng and how they fit into the broader conversation on device fingerprinting and potentially identifying a person’s routine habits. For context, the data we’ll discuss was all collected using AiroDump-ng and visualized with the AirGraph-ng tool.

In the image below, you can see several key details regarding the access points and the clients connected to them. The two green circles represents a Wi-Fi access point, along with its encryption type, the number of connected devices, the MAC address, the OUI, and the ESSID (Wi-Fi name). For each access point, you can view which clients are connected, as well as other related information about the device.

It’s also possible to monitor the access points that clients are attempting to join. As mentioned earlier, Wi-Fi devices are constantly broadcasting a list of networks they’d like to connect to. The image below illustrates this: a cluster of devices probing for connections and networks stored in their settings as “auto-join.” For privacy reasons, non-public access points have been redacted from the image.

It’s also possible to monitor the access points that clients are attempting to join. As mentioned earlier, Wi-Fi devices are constantly broadcasting a list of networks they’d like to connect to. The image below illustrates this: a cluster of devices probing for connections and networks stored in their settings as “auto-join.” For privacy reasons, non-public access points have been redacted from the image.

[wiglet.net]

In the center panel, you can see multiple matches for our query, all indicating that this access point is located on The University of Texas at Austin’s downtown campus. Although we chose a public network for our research, you can imagine the privacy implications if this method were used on private networks to build a fingerprint or track someone’s daily routine across multiple access points.

In this blog, we explored how Wi-Fi metadata can reveal a person’s commonly visited locations by first examining the significance of MAC addresses. MAC addresses—whether permanent or randomly generated—provide identifiable details, including the device vendor’s Organizationally Unique Identifier (OUI). Because they’re broadcast openly, anyone in range of a Wi-Fi access point can easily capture them.

Next, we introduced practical tools like AiroDump-ng, which can sniff Wi-Fi data, and AirGraph-ng, which visualizes the relationships between access points and connected clients. Although these tools are commonly used by cybersecurity professionals, they can also be leveraged by less-sophisticated actors to gather detailed information about nearby networks and devices. Notably, devices often broadcast networks they want to join, including non-public or previously connected networks, further underscoring the privacy risks of Wi-Fi metadata.

We then demonstrated how Wigle.net can take these broadcasted ESSIDs (Wi-Fi names) and provide a geographic location of the associated access points. Our example focused on a public network at the University of Texas at Austin’s downtown campus, illustrating how even publicly visible data can reveal specific locations. The implications grow more serious if similar methods are used against private networks to build a profile of someone’s daily movements or routine.

By being aware of how simple it is to collect and analyze Wi-Fi metadata, individuals and organizations can take proactive steps to safeguard their privacy and minimize the risk of being tracked. Ultimately, these insights emphasize the importance of cyber hygiene—a blend of technological practices (like MAC address randomization and cautious network selection) and informed awareness (knowing what data is visible and how it can be used)—to protect both personal and professional security.


Check our blog on Executive Protection and the Dark Web.

Zero-Day Exploits: How They Work and Why They’re So Dangerous 

March 11, 2025

Cybersecurity might as well have its own language. There are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security field or have a keen interest, one may not know. Understanding what these acronyms and terms mean is the first step to developing a thorough understanding of cybersecurity and in turn better protecting yourself, clients, and employees.

In this blog series, we aim to explain and simplify some of the most commonly used terms. Previously, we have covered bullet proof hostingCVEsAPIs, and brute force attacks. In this edition, we dive into Zero-Day exploits.

Zero-day vulnerabilities are software flaws that remain unknown to the vendor and the general IT community. Because the flaws are unknown to the public, there’s no fix available, and they become highly valuable to bad actors and nation states. With these flaws’ cybercriminals, spies, and nation-states have the unfettered opportunity to cause real damage, infiltrate networks, steal data, or cause disruption. Victims of zero-days will remain completely defenseless until the flaw is discovered and remediated.  

Just last November, Microsoft released its November Patch Tuesday updates, detailing 89 security flaws. Among these were four newly revealed zero-day vulnerabilities—two of which attackers were already exploiting in the wild. For instance, one zero-day allowed malicious actors to capture password hashes. CVE-2024-43451 is described by Microsoft as a zero-day which requires very little user interaction to expose a user’s password. Single clicking or right clicking to inspect a file is enough to extract a user’s password hash.

This month’s Patch Tuesday is an example of how frequent, common, and severe zero-days are today. But many go unnoticed for months or years before they are patched and remediated. This leaves bad actors ample time to take advantage of holes within networks, gather sensitive data, and carry out cybercrime. Far from a theoretical concern, zero-days have become a fundamental part of modern cybersecurity warfare, underscoring the need for robust defense strategies, responsible disclosure policies, and a deeper understanding of how to limit our exposure to them. 

The WannaCry ransomware attack in May 2017 highlights the destructive potential of a zero-day exploit falling into the wrong hands. It leveraged “EternalBlue,” a powerful vulnerability initially developed by the NSA. After this zero-day exploit leaked to the public, malicious actors bundled it into WannaCry, creating a worm-like ransomware that spread to defenseless victims. Within a single day, it infected over 200,000 computers across more than 150 countries, disrupting critical operations at major organizations like FedEx and Honda, and paralyzing parts of the UK’s National Health Service. Luckily, a security researcher discovered a “kill switch” in the code that stopped the virus from infecting more victims. Many victims, running outdated and unpatched Windows systems had to decide whether to pay the ransom or suffer a major loss in data and revenue. WannaCry’s success demonstrated how a stolen zero-day exploit can trigger a global cyber crisis.

The WannaCry case raised concerns among cyber security professionals and Microsoft, who pointed out the US government was hoarding and secretly cataloging dangerous zero-day exploits that the company could have patched, had they been informed of the security flaws.  

In late September 2023, Apple issued emergency patches addressing three zero-day vulnerabilities (CVE-2023-41992, CVE-2023-41991, and CVE-2023-41993) in iPhones and iPads. Researchers at Citizen Lab and Google’s Threat Analysis Group say these flaws could allow attackers to bypass signature validation, elevate privileges, and achieve remote code execution. Citizen Lab’s research linked these zero-days to an exploit chain used by Cytrox’s Predator spyware. The spyware was used against at least one high-profile target, a former Egyptian parliament member who had plans to run for president.  

Stuxnet represents one of the most sophisticated uses of zero-day vulnerabilities in a real-world (not just theoretical). Discovered in 2010, this worm targeted Iran’s nuclear enrichment facilities by secretly infiltrating their systems. Once inside, Stuxnet exploited multiple zero-day Windows flaws to gain control of industrial control systems. By manipulating the speed of uranium-enriching centrifuges, the malicious code was able to physically degrade the centrifuges, causing the Iranian nuclear program to suffer constant failure. Its complexity and reliance on unpatched vulnerabilities made it a groundbreaking cyberweapon. Stuxnet’s impact extended far beyond Iran, this watershed moment in cyber security put a spotlight on the capabilities cyber weapons could have in cold and hot wars. 

In today’s cyber-driven economy, a niche market has emerged around zero-day vulnerabilities. Recognizing the value of discovering these previously unknown flaws, many organizations now offer financial incentives to researchers who report them responsibly. These are known as “responsible disclosure” or “Bug Bounty Programs”. The amount of the reward often scales with the seriousness of the vulnerability. By inviting a global network of skilled researchers to examine their websites and infrastructure, companies can more quickly identify and fix security gaps. This approach isn’t limited to private enterprises, either; the U.S. government, including the Department of Defense and various other federal agencies, has also embraced bug bounty programs to bolster their cybersecurity defenses. 

Zero-day brokers also offer substantial payouts for undiscovered security weaknesses, typically far exceeding a bug bounty. These brokers could be legitimate companies, or an underground network of cyber criminals. Either way, they have no interest in reporting the software flaw to the vendor. Instead, brokers profit by selling these unpatched vulnerabilities to well-funded entities, often government agencies, seeking to compromise targets undetected. To maintain secrecy, researchers who find these bugs must sign strict non-disclosure agreements, agreeing not to alert anyone while the broker seeks the highest bidder. In some cases, brokers may merge multiple zero-days into a single, powerful cyber weapon. This approach led Israeli-based Pegasus to dominate the mobile spyware market, as the company packaged a suite of zero-day exploits into spyware advanced enough to attract government entities throughout the world.   

Mitigating zero-day attacks is challenging because these security gaps are unknown until they’re uncovered. Still, companies, organizations, and individual consumers can take measures to reduce their susceptibility. As a consumer, one of the most effective steps you can take is to install software updates as soon as they’re released. While zero-day vulnerabilities are initially unknown, once identified and patched, they no longer pose the same threat. Keeping your software current helps close these security gaps. For example, victims of the WannaCry ransomware had a month to apply Microsoft’s available patch for the EternalBlue zero-day, which would have protected their systems from the attack. 

Organizations also need to be proactive if they want to decrease the likelihood of zero-day exploits affecting their networks and infrastructure. Since it’s impossible to write code that’s entirely immune to hidden vulnerabilities, embracing robust security measures is essential. Regular participation in bug bounty programs, comprehensive penetration testing, thorough code reviews, and responsible disclosure practices can all lower the risk of being compromised by simpler cyber-attacks and code flaws. 


Curious how DarkOwl can help your organization? Contact us!

Telegram’s Crackdown: Why Accounts Are Getting Banned and What You Need to Know

March 05, 2025

The founder and CEO of Telegram, Pavel Durov, was arrested on August 24, 2024, at Paris-Le Bourget Airport. French authorities detained him as part of an investigation into Telegram’s alleged insufficient moderation of illegal activities on its platform, including child exploitation and drug trafficking. Following his arrest, Durov was indicted on multiple charges on August 28, 2024. He was placed under judicial supervision, prohibited from leaving France, and required to post bail of €5 million. As of February 2025, Durov remains under judicial supervision in France, awaiting further legal proceedings where he must appear at a police station twice a week. Should he be found guilty the most serious charge complicity in the administration of an online platform to enable organized crime and illicit transactions carries a maximum penalty of 10 years’ imprisonment, and a €500,000 ($521,000) fine.

In response to their CEO’s arrest Telegram announced plans to enhance its moderation policies and has expressed a willingness to cooperate more closely with law enforcement. They have been seeking to ensure that they are co-operating with authorities while claiming to continue to prioritize users’ privacy.

In this blog, we will explore what changes Telegram have said they have made, what effect DarkOwl analysts are seeing in response to these changes and what impact we expect to see in the future.

In September 2024 Telegram announced, via Durov’s account, that they would be changing their terms of service in order to deter criminals from using the messaging platform. It was reported that Telegram would provide details of IP addresses and phone numbers to law enforcement and government agencies if they were provided with proper legal requests.

Figure 1: Announcement on Durov’s TG channel regarding changes to terms of service

As well as agreeing to comply with valid legal requests to share user information, they also announced that they would be changing how the global search feature works to make it more difficult for users to find certain channels and bots. They claimed that the global search feature had previously made it too easy for illicit channels to be discovered.

Telegram had made some changes in the past, despite claiming to be a platform that respects privacy and freedom of speech above all things, they did remove 78 ISIS channels in response to the Terrorist attack in Paris in 2015. They had also taken some action for the platform to be in reinstated in Brazil after it was banned for lack of cooperation with government agencies. However, these changes appeared to have more impact.

DarkOwl analysts immediately observed reactions to the arrest of Durov, but there have also been reactions to the announcements to the changes in the terms of use and the fact that they have agreed to work with law enforcement.

Figure 2: Source: DarkOwl Vision

Not only were users talking about what had been announced by the platform, they were also appealing to them directly to ask them not to remove (ban) their channel as they were not breaking any of the terms or conditions.

Figure 3: Source: DarkOwl Vision

They were following the rules….

Figure 4: Source: DarkOwl Vision

However, Telegram was not clear about what type of content they considered to be illicit and or contravenes their terms of service.

Some other users and or groups took the decision that they would move away from Telegram and move to other platforms which they believed were more secure or more accepting of their views.

Figure 5: Source: DarkOwl Vision
Figure 6: Source: DarkOwl Vision

Others stated that they would not leave the platform, but they would continue to operate on multiple other platforms, presumably with the hope that any channels which may be removed would not stop them from being able to spread their message.

Figure 7: Source: DarkOwl Vision

While some prepared for when they thought their account would be banned.

Figure 8: Source: Telegram

DarkOwl analysts have observed that, when using the global search fewer results are being returned which related to generic terms which relate to illicit activity. This is different behavior than the global search previously had. However, if you know which specific channel you want to find in most cases it will still appear, but not all.

Figure 9: No results returned from global search

DarkOwl analysts have observed that a number of channels which were used to share illicit material have been removed by Telegram. A variety of reasons have been provided by the platform for which they channels have been removed. They have also provided details of the specific jurisdiction that the channel broke the laws of.

Figure 10: Source: Telegram

They have also removed channels and or messages that they claim have contravened copyright laws, which indicates ha they are not just removing illicit channels but those that are contravening other types of laws.

Figure 11: Source: Telegram

One area in which Telegram have always claimed to take action is in the area of Terrorism, particularly the group ISIS.  As mentioned about, since 2015 Telegram have claimed that they remove content relating to the terrorist group. However, channels continue to “pop up.”

Figure 12: Source: Telegram

Some Telegram users have taken the matter into their own hands, with groups like ISIS Watch reporting how many channels they have identified related to terrorist content and how many of them have been removed.

Figure 13: ISIS Watch Telegram Channel

Reviewing their posts from February 2023 and February 2025, it is clear that the number of channels that have been banned from the platform has increased massively. Although it cannot be confirmed, this does seem to be in correlation with the new terms of service that Telegram introduced in 2024. However, it is also possible the number of channels relating to Terrorism activity has also increased massively in the intervening time as the popularity of Telegram has grown.

Figure 14: ISIS Watch post from February 2023
Figure 15: ISIS Watch post from February 2025

While DarkOwl have observed channels being removed or banned by Telegram and users talking about moving to other platforms we have not observed and actual migration away from the use of Telegram to date.

Telegram is unlike other messaging apps in that it operates more like a social media platform, allowing users to chat with strangers and share views across a wide audience. Many other messaging apps do not allow for this kind of activity, making them less attractive to Telegram users.

While telegram does seem to be making a concerted effort to make it more difficult for user to find illicit channels, if users are already in these communities, they will likely be provided with invite links to new or existing groups. Meaning that the company has only made it more difficult for outsiders to fine this information.

And while channels are being removed, there is nothing that stops users from creating new channels which share the same information. Therefore, the company are inadvertently entering a game of Wack-o-mole which is unlikely to change. It is yet to be seen if their willingness to work with law enforcement will be a deterrent to criminal actors using the site – for those outside of wester jurisdictions it is unlikely.

DarkOwl will continue to monitor this evolving situation.


To keep up with the latest from DarkOwl analysts, follow us on LinkedIn.

Threat Intelligence RoundUp: February

March 03, 2025

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. Dutch Police seizes 127 XHost servers, dismantles bulletproof hoster – Bleeping Computer

In a February 11 press release, the U.K. government—along with the U.S. and Australia—announced the imposition of new sanctions targeting the Russian cyber entity “Zservers.” A day after the announcement of sanctions, Dutch Police dismantled Zservers/XHost and seized 127 associated servers. As noted in the U.K.’s press release, the Russia-based bulletproof hosting (BPH) services provider was a “key component of the Russian cybercrime supply chain” and was responsible for “facilitating crippling ransomware attacks globally.” Zservers notably provided “essential attack infrastructure” for the notorious LockBit ransomware gang. Read full article.

2. Russian military hackers deploy malicious Windows activators in Ukraine – Bleeping Computer

The Russian hacker group Sandworm (also known as “Seashell Blizzard”) has been observed targeting Windows users in Ukraine with malicious Windows activators. The cyber-espionage group—which has been linked to Military Unit 74455 of the GRU—has specifically deployed trojanized Microsoft Key Management Service (KMS) activators, fake Windows updates, and DarkCrystal RAT malware via a BACKORDER loader. It is believed that the attacks began in late 2023 and aim to “collect sensitive information from infected computers and send it to attacker-controlled servers.” Article here.

Meta has confirmed that WhatsApp users have been targeted in a global spyware campaign. The campaign involved the use of spyware developed by the Israeli company Paragon Solutions, which has since received a cease and desist letter from Meta following the incident. Nearly 100 WhatsApp users were impacted by the campaign, most of whom were journalists or  “other members of civil society.” As noted by The Guardian, WhatsApp shared that it had “’high confidence’ that the 90 users in question had been targeted and ‘possibly compromised.” Read more here.

Researchers at the Japanese cybersecurity firm LAC have identified a new cyberespionage campaign dubbed “RevivalStone” targeting Japanese companies. The activity has been tied to the China-linked advanced persistent threat (APT) group Winnti (also known as APT41). The campaign took place in March 2024 and specifically targeted companies in the manufacturing, materials, and energy sectors. According to the researchers, the campaign uses an updated version of Winnti malware with new capabilities. Read here.

5. E.U. Sanctions Three GRU Officers For Cyberattacks Against Estonia – The Hacker News

On January 27, the Council of the European Union announced the sanctioning of three GRU officers for their role in cyberattacks against Estonia’s government in 2020. As noted in the Council’s press release, the three Russian nationals—Nikolay Korchagin, Vitaly Shevchenko, and Yuriy Denisov—gained “unauthorized access to classified information and sensitive data stored within several government ministries […] leading to the theft of thousands of confidential documents.” Learn more.

6. Spain arrests suspected hacker of US and Spanish military agencies – Bleeping Computer

Spain’s Guardia Civil and Policía Nacional have arrested “Natohub,” a notorious 18-year-old hacker in Alicante who allegedly conducted more than 40 cyberattacks against Spanish and international organizations, “including the Guardia Civil, the Ministry of Defense, NATO, the US Army, and various universities.” According to the Policía Nacional’s official press release, the suspect utilized three different pseudonyms while targeting international government organizations and accessed databases containing personal information belonging to employees and clients, as well as internal documents. Read full article.

7. North Korean Hackers Exploit PowerShell Trick to Hijack Devices in New Cyberattack – The Hacker News

The North Korean hacker group Kimusky (also known as Velvet Chollima and Emerald Sleet) has been observed using a new tactic which involves tricking its targets into “running PowerShell as an administrator and then pasting and running code provided by the threat actor.” As noted by the Microsoft Threat Intelligence team, the threat actor masquerades as a South Korean government official and attempts to build rapport with the victim before ultimately sending a spear phishing email. Read full article.

8. CISA and FBI: Ghost ransomware breached orgs in 70 countries – Bleeping Computer

On February 19, the Cybersecurity & Infrastructure Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint advisory detailing indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with Ghost (Cring) Ransomware. Since 2021, threat actors utilizing Ghost ransomware have targeted organizations in more than 70 countries. Victims have included organizations in a variety of sectors, including critical infrastructure, education, and healthcare. Learn more.


Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.

DarkOwl Reinforced as the Go-To Dark Web Vendor in MENA  

February 28, 2025

DarkOwl participated in ISS World Middle East & Africa in Dubai, UAE earlier this February. ISS World Middle East & Africa is a conference where cybersecurity technology providers exhibit to the global law enforcement and intelligence community. ISS describes itself as “the world’s largest gathering of Regional Law Enforcement, Intelligence and Homeland Security Analysts, Telecoms as well as Financial Crime Investigators responsible for Cyber Crime Investigation, Electronic Surveillance and Intelligence Gathering.”  

DarkOwl has attended ISS for the last 10 years as it is an effective medium to help reinforce and grow our international presence.

ISS World takes pride in focusing on education and training covering the areas of law enforcement, public safety, and government and private sector intelligence communities. The first full day of ISS events are dedicated to training and in-depth sessions. Talks throughout the event cover topics ranging from geolocation, exploiting and circumnavigating masking tech, advanced techniques in tracing suspects, open-source tools, artificial intelligence, and more. 

ISS conferences are held in various cities across the world every year like Dubai, Kuala Lumpur, Prague, Singapore, and more. ISS Dubai has consistently provided valuable opportunities to engage with law enforcement, government agencies, and commercial partners across the GCC and MENA regions. 

Key Takeaways: 

Industry Presence: Noticeably smaller than other ISS events, but this conference is closed to the public in part because of the strong representation from regional government agencies usually affiliated with law enforcement and intelligence. 
Market Trends: We noted 12+ sessions devoted to the subject of OSINT and/or Darknet on the first day of the conference, alone. OSINT vendors more generally had a strong presence, from Epieos and OSINT Industries, to Cyabra and Cognyte. 
Strategic Partnerships: Productive discussions with potential OEM partners for whom Darknet data has become essential for end user investigators, globally. Alongside existing data partners like TRG Solutions, Maltego, Innefu and IPS, there was strong interest from key regional system integrators and government AI innovators.  
Speaking Session Success: Our session drew a large audience that asked several questions. The crowd was nearly 50% Emirati, but also representation from other regional agencies like the Kingdom of Jordan.  

In addition to networking and promoting DarkOwl at the booth, Lindsay Whyte was able to give a live presentation to attendees demonstrating DarkOwl Vision: Darknet Intelligence Discovery and Collection. Vision UI is the industry leading platform for analysts to simply, safely, and comprehensively search the largest commercially available source of darknet data. The goal of this session was to further educate the international intelligence community on how threat actors on the darknet are evolving in their use of new tools and methodologies.  

Due to the layer of anonymity it provides, the darknet is often a hub for illegal activity. However, investigating crime on the darknet and deep web poses technical challenges, including the fact that darknet sites are continually coming on and offline with pages vanishing from one minute to the next.  

The technology DarkOwl leverages to scrape and index hidden digital undergrounds are key to the mission of obtaining proactive situational awareness for protection of the nation’s security initiatives. 

DarkOwl Vision provides a user-friendly interface with powerful querying capabilities to search, monitor, and create alerts for critical information. DarkOwl Vision has been used to support local and federal police investigations, as well as work done in intelligence/fusion centers and federal agencies to uncover human trafficking, opioid selling, terrorism, security issues, and other illegal activity, making it the perfect tool for this audience. 

After 10 years of participating in ISS Dubai, DarkOwl will continue to attend since these events reinforce our position as the “go-to” darknet search & monitoring solution in the MENA region.  


Meet with us in person! See where we will be next.

Notable Cyber Arrests: 2024

February 26, 2025

In 2024 threat actors continued to be extremely active. Major cyber-attacks occurred across multiple industries and ransomware attacks increased year over year. These attacks had huge financial and reputational implications for all those targeted. However internationally, law enforcement continued to fight back against cyber actors making several high profile and important arrests.  

In this blog we explore some of the more notable law enforcement activities and arrests.  

Led by the UK’s National Crime Agency (NCA), this international operation targeted the LockBit ransomware cartel. The operation dismantled key infrastructure and exposed the identity of the group’s leader, Dmitry Yuryevich Khoroshev, undermining the gang’s operations. The groups’ Dark Web site was taken offline for a period of time. Highlighting a new technique by law enforcement the NCA “hijacked” the leak site in order to update on the actions of Op CRONOS. 

Figure 1: LockBit leak site taken by NCA 

In May 2024, Rui-Siang Lin was arrested at JFK Airport for operating “Incognito Market,” a dark web narcotics marketplace that facilitated over $100 million in illegal drug sales worldwide. The Taiwanese national went by the alias “Pharoah” on the dark web drug site.  According to the indictment as “the leader of Incognito market — Lin supervised all of its operations, including its employees, vendors, and customers, and had ultimate decision-making authority over every aspect of the multimillion-dollar operation.”

In a strange twist to the story, it emerged that LIN had actually trained law enforcement officers in St Lucia on cybercrime and cryptocurrency on the dark web which had been organized by the Taiwanese embassy.

In June 2024 at least 100 Snowflake customers were affected by a Cyber-attack. Threat actors used exposed credentials to log in to Snowflake portals and target their customers for data exfiltration. They then sold this information on the dark web for financial gain. High profile targets included Ticketmaster, AT&T and Santander.

In November 2024 Canadian authorities arrested Alexander Connor Moucka accused of compromising multiple Snowflake cloud storage accounts and the behest of US law enforcement. Additionally, the U.S. charged John Binns in connection with these breaches, highlighting the international collaboration in combating cyber threats.

Figure 3: Ticketmaster data advertised on the DW 

In May 2024, Tenzin Orgil was sentenced to 168 months in federal prison for participating in a drug trafficking enterprise that included the sale of methamphetamine and fentanyl on the dark web, as well as the manufacture of ecstasy and methamphetamine in clandestine laboratories. Orgil had operated on several dark web markets under several aliases selling the drugs he produced in underground laboratories. The Orange County resident pled guilty to the charges in 2023.

Figure 4: Source: DarkOwl Vision

A prominent figure in the ransomware community, Mikail Pavlovich Matveev was arrested in Russia for his involvement in cybercrimes against Russian entities. This arrest signaled a potential shift in Russia’s stance toward domestic cybercriminals.  

According to the FBI MATVEEV is linked to several ransomware variants, including LockBit, Hive and Babuk. He had previously been charged by the US government for computer crimes in 2022 but remained in Russia.  

He has allegedly conducted significant attacks against both United States and worldwide businesses, including critical infrastructure.  Matveev was identified as one of the alleged developers/administrators behind the Babuk ransomware variant.  Matveev has been charged with multiple LockBit attacks which included a police department located within New Jersey.  He has also been charged with multiple Babuk attacks including the attack against the Washington D.C. Metropolitan Police Department.  In addition, Matveev has been charged with Hive-related counts of conspiracy and intentional damage to a protected computer, including an attack against a New Jersey-based company.

Scattered Spider Group 

Following high-profile attacks on companies like Okta, MGM, and Caesars by a group known as Scattered Spider, authorities arrested several members of the group.  

The individuals, including Ahmed Hossam Eldin Elbadawy, Noah Michael Urban, Evans Onyeaka Osiebo, Joel Martin Evans, and Tyler Robert Buchanan, faced charges related to wire fraud and identity theft. Officials said the suspects’ illegal activity spanned from September 2021 and April 2023. 

Scattered Spider are a loosely affiliated group of young individuals assessed to be based in the US and UK who have conducted multiple cyber and ransomware attacks. They are known to conduct sophisticated phishing attacks and social engineering attacks on call centers in order to gain access. They are also affiliated to several ransomware groups. According to security researchers, “The group has been blamed for unusually aggressive cybercrime sprees, targeting major multinational companies as well as individual cryptocurrency investors.”

Europol coordinated an extensive operation against botnets, leading to multiple arrests and the seizure of hundreds of servers. The crackdown targeted platforms facilitating ransomware deployment, significantly disrupting the cybercrime ecosystem.  

According to Europol, between 27 and 29 May 2024 Operation Endgame targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. The agency focused on arresting high value individuals, taking down infrastructure and tracking and seizing cryptocurrency payments. The operation consisted of input from several different countries as well as private companies highlighting the need for coordinated efforts to stop these cyber activities which have no borders. 

Although law enforcement has been very successful in targeting a number of high-profile threat actor and criminal groups in 2024, many groups continue to operate in slightly different forms.  The nature of criminal cyber operations means that they are very difficult to combat. Actors are spread throughout the globe, usually in countries which will not cooperate with US and European law enforcement agencies. However, it is important that law enforcement continue to send a message that these activities can be combatted and there are consequences to these actions.  

As we move into 2025, we expect law enforcement activities to continue to combat the increase in ransomware attacks and disrupt markets and other areas where criminals operate. However, the pardon of Silk Road owner Ross Ulbricht by President Trump appears to send a message that leniency will be shown to some of those who profit from criminal activities.


Keep up with all DarkOwl research. Sign up for email.

[Webinar Transcription] Executive Protection and Security in a Dangerous World

February 19, 2025

Or, watch on YouTube

Executives are increasingly targeted by activists of all types, posing significant threats to them personally and risks to their organizations. Many of these attacks can be detected or even predicted by monitoring exposure of the executives in the darknet, including leaked and stolen PII, credentials, chatter around the executives, and in some cases direct threats.

Despite utilizing various security tools, many organizations lack a dedicated executive protection service to monitor and alert on potential threats or negative chatter targeting executives. Addressing this challenge might seem complex, but the stakes have never been higher.

In this webinar, attendees learned how to effectively baseline, monitor, and alert on organizational and executive threats using Dark Owl’s Vision platform. Discover practical steps to safeguard your executives and your organization against these evolving threats.

NOTE: Some content has been edited for length and clarity.


Kathy: Today’s webinar will be held as a fireside chat with Mark Turnage, DarkOwl’s CEO as our moderator. Before we begin, we’d like to give each company a moment to introduce themselves.

Brandon, would you like to tell us a little about Ascent Solutions?

Brandon: Absolutely. So, if you’ve never heard of us before, we are Ascent Solutions. We’re an award-winning Microsoft Solutions partner that specializes in the Microsoft security stack. We offer a wide range of cybersecurity services to include advisory, professional services, as well as managed services, including Cyber Threat Intelligence, Security Operations Center, and Threat and Vulnerability Management as a service, just to name a few.

Kathy: Mark, would you like to tell us about DarkOwl and then start our chat?

Mark: I’d love to. My name is Mark Turnage. I’m the CEO of DarkOwl and Co-founder of DarkOwl. DarkOwl is a company that was established for the sole purpose of monitoring the darknet and what we call darknet adjacent networks for criminal activity and underground activity on behalf of our clients. We monitor over tens of thousands of sites a day and they include everything from the traditional TOR network all the way to Telegram channels where threat actors are now, are now active. Our product is, our data is available via a number of different ways, UI, APIs, data transfers, and we number many of the world’s largest cybersecurity companies as our customers.

It’s a pleasure to be here today with Brandon, and I’m going to just let Erin introduce herself really quickly, and let’s start with questions.

Erin: Hi, everybody, I’m Erin. I’m the Director of Intelligence and Collections at DarkOwl, so responsible for the data that we collect as well as doing investigations on behalf of our customers.

Mark: Great, let me go ahead and start. I’m going to direct this question first at Brandon and then at Erin. Can you give us the basics of executive protection? What is it and why is it important?

Brandon: Well at Ascent Solutions we offer what we call digital executive protection monitoring and alerting services that succinctly tie in with our team’s approach to continuous threat exposure management. Our approach to executive protection is actually rather simple. We provide enhanced monitoring of the dark web that specifically focuses on key executives and organizational leadership, so alerts that we recognize that alerts specifically pertaining to these individuals and key personnel could require a more tailored and of course timely approach with additional requirements actions activities and engagement beyond just the regular security team.

Mark: Great. Thank you. And Erin. Why is it important to monitor specifically, executives’ data online?

Erin: Executives tend to be the most visible people in any company. So, their information is out there, they’re doing things like webinars, they’re putting press releases out, et cetera. And so that makes them more of a target to individuals. And I think historically we’ve thought about physical threats and that’s still a concern obviously in terms of people being targeted, but more and more we’re seeing with cyber threat actors is that they’re using the information that they can obtain in the digital realm in order to target those quite visible people. And they can do this in a number of ways and this is why it’s important to monitor digital activities from different perspectives because there’s information that can be leaked about executives which can lead to information that threat actors can use and they can get their credentials and get access things that way. But there’s also a social engineering aspect to this, you know, if people are putting a lot of information out there on social media about their movements, about their hobbies, about how they operate, that makes it a lot easier for threat actors to impersonate them or use them to target members of the company. And we see that a lot with phishing attacks. So, I think it’s really important to understand, especially for executives, but probably for all employees and individuals, you know, what information is out there about you and what steps can you take to protect your digital footprint.

Mark: And I’m gonna go off script here, so I’m gonna cause our hostess Kathy to have a heart attack.

You know, I have heard through the years and have seen it, we’ve seen a little bit of it ourselves that oftentimes not only are executives the most visible members of a company, but also, they’re the least cautious. It’s the C -suite. Have you guys found that to be the case in some cases? I don’t want you to bad mouth your clients or our clients, but do you find that to be the case?

Brandon: I’d say it depends on the executive when it comes to that, but I’d say that there’s some consistency with that, Mark.

Erin: Yeah, I would say anecdotally, that does seem to happen. But I feel like maybe it makes bigger splash when it’s the C -suite that’s messed up. But you know, people, I think as well, like it could be, you know, a generational thing as well. C -suite tend to be older. They tend to be less tech savvy. They tend to not think about social engineering attacks or how the information that they’re providing could be used. But then in the same vein, younger people put way too much information on social media, in my opinion, so it’s a balance.

Mark: Sure. I mean, I’ve been subject to phishing attacks myself. Some of them quite sophisticated. And all of them, all of the most sophisticated ones tried to take advantage of the fact that I was the CEO. They had a message or a sender that I would pay attention to. They were quite sophisticated.

Brandon: Yeah, I would love to add to this one too big time. Multiple vendors throughout 2024 identified that threat actors are increasingly targeting executives basically to get a foothold into their organization causing reputational damage or just picking an insidious activity. This is also actually quite consistent with what we’ve mentioned about what we’ve seen in our SOC and we have to keep in mind that executives often have access to the organization’s most critical business functions that threat actors can have used to gain the foothold. We don’t exactly, to Erin’s point, make it very hard either. We feature our executives, in some cases, we feature the contact information, direct contact information for these folks and stuff out there as well. So, putting it all together, we basically roll out a red carpet for these folks to attack our most senior folks.

Erin: I think it’s what you have to think about the senior folks being impersonated as well. So, you know, employees are much more likely to respond to a phishing email if they think that it’s coming directly from an executive. And, you know, with things like AI now, you can generate an executive’s voice. If an executive is out there doing a lot of press webinars, their voices on the internet, you can impersonate that and use that against their employees. So there’s aspects of it as well.

Mark: We’re gonna come onto that. And the question I had for you, Brandon, was what is it about now? What’s different about now that makes monitoring this type of data more important than ever?

Brandon: Well, I think threat actors are getting more creative every day. And we’re seeing them attack and exploit things that are often on the periphery, especially since throughout 2024, we watched a lot of different vendors, third party vendors and stuff that have access into different environments get hit and whatnot. So, I do think that most of the time, when we get dark web monitoring and learning services, it’s specifically monitoring your email domain. But we need to open up the aperture on that, in my opinion, we need to be monitoring the organizational and any mentions of the organization, obviously email domains and credentials. But specifically with executives, sometimes a lot of these executives’ link some of their non-business email addresses or contact information to their business email contact information as well. So, with that, we got to be mindful of threat actors exploiting these fringe and these periphery things and stuff to get access. Their goal remains the same, causes much damage, get access, sell access, etc. We’ve got to be cognizant of that.

Mark: And Erin, what’s different about the dark web as opposed to more social media sites? Give us some sense of that difference.

Erin: Yeah, I think people on the dark web have a bit more of a sense of they can do whatever they want. So, you know, we see things like doxing, where threat actors will just provide information about individuals, and it will basically be a dossier of that individual, all the information that they can find about them. We don’t tend to see that shared as much on things like social media. And also, just the sheer breadth of kind of leak and stolen data and Stealer Logs is something that we’re seeing, a huge surge in and the dark web is where they buy and sell that information.

And I think everyone needs to be cognizant of this. You can be as careful as you want about your digital data and your footprint, but you don’t have any control over the third parties that you’re putting your information into. And if they get breached, your information is out there. So you can be pretty savvy, you can have limited social media profiles, you can have all the privacy settings, etc. But if you have my fitness power, my fitness power gets leaked, your information is out there. So that’s on the dark web. So, I think it’s very important to be aware of that.

And then kind of moving to some of the dark web adjacent sites that we monitor as well, things like Telegram and Discord. We see a lot of individuals talking about targeting or talking about accessing particular companies or just geopolitical events that their lives and you know are hitting on organizations and companies so I think just monitoring that rhetoric as well, stepping slightly away from specific executive protection but just kind of general organizational protection and reputational risk there are a lot of individuals out there that you know making anti-Semitic comments making violent comments you know making threats against executives and against organizations. And I will say social media has probably changed slightly in the last year or so where some people feel that they can do that on that open web as much as they can on the dark web, but it’s certainly something we’ve seen in the dark web, you know, over the last few years increasing.

Mark: And Brandon, give us some examples of some of the threats and risks that you guys have found and maybe talk about a unique case that you’ve you’ve come across.

Brandon: I think most commonly we see stolen credentials, data breaches ransomware posts, threat actors discussing sharing proofs of concepts or just the sale of weaponized exploit code targeting specifically vulnerabilities amongst many other different nefarious things. So, we got a couple of I think the most consistent one that we see, I would say more than often is, you know, we, our customers ask us, well, why, why are my executives, my leadership the most phished? Well, it’s like, well, look at your website, man, you got the contact information right up there. And, or, it’s something as like, your boss keeps signing up for all these random newsletters that continue to get hit, you know, with his business email, which is why he’s on X amount of different data of different data breaches. That’s the most common, the most consistent. But I think the most bizarre case that we ever had to respond to, we had a customer that had just moved organizations and went to an organization that recently got hit by a threat actor. And he had called us in to give him a hand and some assistance. Specifically, my part was to monitor the dark web, kind of get a good idea of what their presence really looked like on the dark web as well, which was very important for him, obviously. So built a couple of different cases, a couple of different cases, specifically watching for organizational mentions, email domains, or just anything and all things related to the victim company. And sure enough, the threat actor wanted to gloat about his ill -begotten gains, and he threw up a post detailing exactly what he had stolen from the company at that point took that handed it over to the team that was investigating the situation and it kind of gave them a better idea of where this threat actor could have been. So, continuing to monitor updating as needed you know especially the posts and stuff as the thread grew on there and I guess the threat actor made some enemies of his own kind, and they decided to dox him.

Mark: Oh my god.

Brandon: After they doxed him, they basically put it out there like this is who he is, thisis where he lives, this is his home address, this is where his parents work, here’s all his socials, these are all his data repositories, this is where he stores his data. And they basically stripped this threat actor, all this anonymity and then immediately I turn that over to the team and I would like to believe they finally adjudicated him. I haven’t seen a post from him since. So, it could be that, well, let’s hope.

Mark: That’s very, very interesting. Erin, give us a sense of what trends you’re seeing in terms of threats in the current environment.

Erin: Yeah, I just want to jump onto what Brandon was saying there. I always find it really interesting, like I think we focus very much on, “let’s protect our executives and our organizations,” or it’s absolutely we should be doing but I love the fact that the data that we have in leaks and from doxing and stealer logs helps us to attribute who is actually doing this so we can kind of use what they’re using against us back against them and it really helps to know kind of why someone’s doing something and what their motivation is because it allows you to assess the threat you know a lot better you know there’s a difference between armchair trolls that are just making threats because they’ve got nothing better to do and someone that is going to follow through on that threat. So, I think it’s really interesting to have that motivation.

In terms of trends, we’re just seeing a huge mass of data, it’s just growing and growing. We’re not seeing that diminishing in any way in terms of data leaks. I think stealer logs, they’re not new, but they definitely seem more prominent in this sector in terms of people being able to use those, the amount of credentials that are stolen and how people can use that to access things. I think we’ve definitely as well seen a lot more sophisticated social engineering, I think particularly some threat actor groups in terms of targeting call centers and targeting help desks of organizations as well as the executives and CEOs, and being pretty convincing based on the information that they’re able to find on both the dark web and the surface web to put that out there. Brandon’s already mentioned phishing as well, you know, not a new trend, but phishing is not going anywhere. I think as long as your email address is out there, it’s a technique that works. I mean, you look at things like colonial pipeline that was, you know, really basic phishing and lead to credential attack that, you know, led to the shutdown of the colonial pipeline. So, I think those are the things that we continue to see and that we have to continue to mitigate against.

And then I guess the other thing that I’ve kind of already touched on that we see in terms of threats being made against executives or organizations, I feel like anecdotally, people are less concerned about the threats that they’re making there. They’re not trying to obfuscate who they are as much as they used to. I think people feel a little bit braver about what they can and can’t say. And you know, part of that’s people on the internet, they’re sitting behind a screen, you know, they think they’re untouchable. But also, I think it’s just kind of the way things are developing geopolitically, people have a sense that they can do things and take action. And I think, you know, we’d be remiss in an executive protection webinar not to talk about the United Health Care assassination. You know, that individual, as far as we know from reports, obviously, I wasn’t involved in that investigation in any way, didn’t have a huge amount of rhetoric online, you know, thinking about doing that. But I think it really just highlights, you know, when people have pain points, and they’re talking about those pain points, you need to kind of pay attention to them. And that the digital world and the digital things that people are talking about and the exposure that people have, you know, he had to know that that executive was going to that hotel at that time, and that was probably from his digital footprint. And so there can be real world, you know, real world impacts outside of, you know, hacking and, you know, network things that I think it’s important to be aware of as well.

Mark: And can I ask you both a question when you’re monitoring an executive take me as an example you’re monitoring Mark Turnage. How often do you pay attention to Mark Turnage’s is spouse or partner and family. Have you seen that as an attack vector by threat actors?

Erin: I would say it’s definitely an attack vector. Again, executives will get education through their security, through their SOC, whoever telling them what they shouldn’t do and they can improve that. Whereas kids might post where they’re going on holiday and things like that, and it can make them more vulnerable. What I would say about that, though, is that it’s really up to the organization and the executive whether they want to extend the monitoring that wide. A lot of people for very legitimate reasons don’t want to share the more personal side of their information, their family, their personal emails, etc. I would caution against that because, you know, you need to look at things in the whole when it’s looking at this. But yeah, that does tend to be an issue is the privacy concerns around that.

Brandon: Yeah, I grouped that with the periphery as well.

Mark: We’ve seen one or two cases where the social, as Erin said, the social media posts of children were a primary attack vector because they could follow an executive’s family around. And as Erin said, it’s a choice for the executives and the organization to make.

Give me a sense, Brandon, what practical steps can be taken to baseline an organization and then monitor it? And how have you used DarkOwl to monitor and alert to these threats?

Brandon: Yeah, absolutely. Well, one thing I learned after 20 years in the Marine Corp., is collection planning is key for any different type of operation. So, what we do for Digital Executive Protection Monitoring and Learning Services, we have a whole menu of different things that we offer our different customers and stuff who wish to subscribe to this. So, it’s up to them. From there, we pump that stuff into DarkOwl to specifically monitor for those different things. And the great thing about DarkOwl is you’re able to build a case and stuff where it’s gonna go out and fetch whatever frequency that you want it to. This is the information that you ask it to go look for on various different things. If I wanna specifically look in extremist forums or just other threat actor-based forums, I can have it look specifically for these different things and stuff there. Or if I just wanna focus on email domains or email addresses or all that in these different forums, like – Yeah, absolutely, I’m gonna go do that. Most consistently, as far as our basic package goes, what we do is we monitor the organization, organizational email domain, and the names and the business email addresses, and in some cases, personal email addresses that are joined to the network environment of the different executives, and we build a case around that. So anytime something does pop up, it’s I get a notification and then we handle it accordingly.

Mark: So great. And and those can be in relatively real time, you know, within a minute of a post being posted.

Brandon: Yup.

Mark: Erin, give me a sense of what mitigations companies can take to protect their executives. I mean, it sounds like there’s this Wild West world where data is being spilled out there or doxed out there, you know, what kind of company or an organization really do to mitigate the risk to their executives and to the organization itself?

Erin: Yeah, so I think one is doing this kind of monitoring and being able to baseline what is already out there because there’s no way that there isn’t something out there to begin with. So, you want to have that and you want to be able to see for any changes. But basic steps that organizations can take is giving people cybersecurity training on phishing attempts and what to look out for, giving people advice on what they shouldn’t share on social media and how they should set their privacy settings, etc. I think having a really strong password policy leaks are going to happen, but if you’re not using the same password on every account, it really reduces the risk that it has to your overall footprint. I think using things like password managers can really help with that.

And then I think being cognizant of what data is out there, you know, there are ways to remove some of that data, not on the dark web, unfortunately. So if your data is on the dark web, your data is out there. But there are a lot of kind of data brokers and other organizations that will hoover information up from public records and from social media and you can legally ask for that information to be removed. So that’s something that you should probably look at doing as well.

And I think just being generally vigilant, making sure that your employees are trained and know what to look out for, but also know what they should and shouldn’t do. Like, don’t post too much information on social media. Don’t mix your personal and your business email addresses on accounts like don’t use your business account for your hotel bookings and things like that because that’s the way that threat actors can you know piece together your life and do those kind of doxes that Brandon was talking about. So, I think it’s just having good cyber hygiene and having good education to try and mitigate and reduce the risks as much as possible. I think everyone needs to be aware that you can’t remove the risk. You know, there’s steps you can take. We can do this monitoring. We can be looking out for that. We can be as vigilant as possible. That we can’t protect all third parties where we’ve put our data. And so, you just need to be very vigilant for these types of attacks.

Mark: And you must get this question all the time, Brandon. What do we do about this? Can I take darknet data off the darknet? Can I take my data?

Brandon: No.

Mark: You must get this asked this all the time by your clients.

Brandon: All the time. Adding to what Erin said, I think enacting a continuous monitoring of your executives on the dark web and integrate custom alerting into your SIM to identify and respond to potential security threats. I think that’s awesome, which is why we bring that into our continuous threat exposure management, modest operandi here at Ascent Solutions. We bring this all in together. And I think it’s important having the sufficient processes in place and stuff to monitor for these specific things. DarkOwl enables a lot of that. And there’s a lot of science that goes after that when these things happen, which is why I’m just very graceful to have such an awesome SOC team that I’m a part of.

Mark: And we haven’t talked about this. Let me ask this question. How deep in an organization is it? Have you monitored for executive protection below the C-suite level, senior management as well, or do you tend to focus on just the C-suite?

Brandon: I think it depends on the organization and where they have determined their most critical business functions are. So, although this person is a mid-level part of the organization, this person is in charge of all these different industrial control system equipment here, and they have a public-facing presence that interfaces with the OT environment and the IOT environment. So yeah, that’s definitely a high-valued individual. It depends on the organization to answer your question, but yes.

Mark: Yeah, I was thinking about system administrators, for example, they’re not as sweet, but they’re very, very important people and in organization.

Erin: Yeah, I think it can depend on the role. Again, it depends on the organization, their size and their appetite for this kind of thing. But there are certain roles that you definitely need to kind of be aware of. But I think it’s also, I think to Brandon’s point, what public exposure those individuals have, the bigger footprint that they have out there, the more likely they are to become a target. So, you might be someone that has a really important role, but you’re very discreet and kept quite quiet and not publicly listed on the website or anything like that. And that’s not to say you shouldn’t want to say for them, but it’s probably less risky.

Brandon: Correct.

Mark: I’ve never heard of a company like ours or yours doing this, Brandon, but you might want to do a social media audit of all the employees to see who has the most social media exposure. Because I mean…

Erin: There’s a direct correlation with that, right? Like, so Mark, you were talking earlier about how you get phished all the time. And I know other people in our company have received those phishing emails. I never get them. And my hypothesis is, because I’m not on LinkedIn. So, you know, you can make yourself less of a target by protecting your digital footprint in certain ways. I know anecdotally of a case going back to what you were saying of family members and like checking social media and things. They had an executive who was pretty careful and pretty secure, but their wife had uploaded a review that included locational information. So, you know, it’s what people put out there.

Mark: Yeah. I have seen CISOs, system administrators, and other cybersecurity professionals very active on social media, which is an interesting tension given their roles. We’ve talked a little bit about use cases, but if you guys could both finish with sort of – one of the most unique cases that you’ve seen using the tool, that’d be, I think it’d be informative for our listeners here.

Brandon: I think the one that we specifically talked about with the other company with the threat actor getting doxed, like that was the absolute most unique case that I’ve ever seen. You know, and that’s definitely in the Hall of Fame for as far as DarkOwl for the win moments for our company.

Erin: I’m trying to think I don’t know that I can think of something that’s particularly unique. But I mean, we definitely see impersonations of executives on telegram and other areas, threats being made, a lot of memes being used for that kind of activity. And then I just think that the doxing thing is such an interesting area of data set that we collect from. I’ve seen everything from executives to FBI agents having their information released. And once that information is out there, there’s very little that you can do about that, but you need to know that it’s out there. So having that monitoring capability to know what of your information is out there and how you can be vulnerable. But as I said, I think turning that back, the threat actors do this themselves to each other. And so, it’s very helpful. I mean, there’s a lot of threat actors out there that are involved in things like swatting, they’ll swat executives and other famous people’s homes or schools or universities. And they make a kind of a game out of that. But because they’re interacting with each other, they, you know, they anger each other and that causes their information to be doxed, which helps us as an investigator to find out who is doing this. And as I said, that important part of motivation, which I think some security people, they just wanna stop an incident, they just wanna stop data being stolen. But I think it’s always really important to look at that motivation piece as well.

Mark: And Brandon and Erin, do you see any trends and threats to executives that are sort of based on geopolitical events. Something happens geopolitically or politically here in the US or something like this shooting, this tragic shooting of the United Health Care CEO. Do you see risks go up or chatter go up or does it tend to be fairly flat line throughout?

Brandon: From a geopolitical perspective, absolutely. We got to go back in time for this one a bit. But when Russia was getting sanctioned a lot by a lot of different commercial vendors and stuff, that kind of set off a red flag for a lot of the Russian-based e-crime actors and stuff to start going after and specifically targeting these companies because of the Russia-Ukrainian war and stuff. So that really prompted a lot of these folks and stuff to start going after them. So yeah, it really depends. It really depends on the situation, you know, and what the and what the atmospherics are surrounding that situation as well.

Erin: Yeah, I mean, we’ve definitely seen, I think the most recent one off the top of my head that I can think of is the Israel Hamas conflict. That definitely caused a lot of individuals that were Jewish to be targeted, and Palestinians to be targeted, so you definitely see those trends in relation to big geopolitical events, and I think that’s something that executives and organizations need to be aware of as well as posturing around these types of events. I would say with the main trend I’ve seen with the United Health Care incident was executives are more concerned. they’re taking more of a proactive approach to maybe looking at their footprint. And I think a lot of people were very surprised by the response to that from a lot of individuals on social media, on things like Telegram, where there wasn’t a lot of disgust at what the alleged assassin had done, and more concern about, you know, we don’t like these executives. There was one individual on social media who produced a deck of cards with different CEOs’ faces on them as targets. So there’s definitely that kind of rhetoric, whether that leads to actual threats or it’s just people talking. You know, it’s hard to say, and that’s again why that motivation point is important. But yeah, I think there’s definitely trends and activities that happen that have an impact on all of this kind of thing.

Brandon: It’s never a dull day in the life of a threat intelligence manager in a cyber security.


Check our blog on Executive Protection and the Darknet. Read Here

Valentine’s Day: A Celebration of Love or a Trap for the Vulnerable?

February 14, 2025

Valentine’s Day is a great time to celebrate love whether you are in a relationship or single. However, there can be a darker side to Valentine’s Day – while many celebrate romance, others target those wanting to feel loved or special by someone. 

The FBI defined romance scams (pig butchering) as when a “criminal uses a fake online identity to gain a victim’s affection and trust. The scammer then uses the illusion of a romantic or close relationship to manipulate and/or steal from the victim.”  

The FTC (Federal Trade Commission) explained that romance “scammers create fake profiles on dating sites and apps or contact you through popular social media sites like Instagram or Facebook. The scammers strike up a relationship with you to build up trust, sometimes talking or chatting several times a day. Then, they make up a story and ask for money.” 

Romance scammers are no different than other scammers – they quickly gain rapport with their targets before taking full advantage of them. It is not uncommon for romance scammers to be well versed in other types of fraud like check fraud. According to the FTC, there are specific tactics these scammers employee to quickly gain rapport with their targets. It is key for the scammer to manipulate their target by giving the victim the impression they have a genuine connection.  

In this blog, we will examine not only how romance scams and pig butchering are often mentioned across the darknet, but we will also look at various types of data scammers look for to identify their targets. 

Adult Website SEO Traffic 

One method romance scammers use to identify victims is targeting adult website Search Engine Optimization (SEO) traffic leads and databases. The following popular XSS thread was originally published in 2020 but was still receiving replies as recent as January 2025. The thread highlights how romance scammers utilize adult website SEO traffic to find potential targets when the user claimed, “there is over 3000+ people in my network that are active and above the age of 20.”: 

OnlyFans is allegedly another effective site to target for identifying new potential victims. The following user on the popular hacking forum, Black Hat World, advised other scammers to connect with other fraudsters on sites like SEOClerk and Juicy Ads where users sell access to OnlyFans traffic.  

While the above examples demonstrate fraudsters exchanging information with each other, it is also common to see tutorials for sale on darknet marketplaces. The below screenshot shows a listing of a tutorial of how to monetize adult website SEO traffic. This was listed on TorZon Marketplace on January 20, 2025: 

Scammers will also sell services related to targeting adult SEO traffic. The following post from the now defunct Cracked.io shows a user advertising their SEO traffic service for $300 USD a day. The users provided an explanation of one methodology of how to monetize adult website SEO traffic for romance scams alleging that Reddit is a good place to start your scam:  

Romance scams are commonly discussed on popular hacking forums like XSS, BreachForums, and Exploit. An  XSS post, from January 8, 2025, posted in both Russian and English displays a user looking to collaborate with other cyber criminals who are experienced with Romance Scams, stating “I am currently seeking reliable and experienced individuals who are actively working in this field [romance scams]. I have access to several clients and opportunities that could be mutually beneficial for collaboration.”: 

A user on the popular hacking forum, CryptBB, alleged an effective way to become a fraudsters is pig butchering scams because it involves methods like crypto swifting. Crypto-swifting generally refers to the use of cryptocurrencies for cross-border money transfers, inspired by the SWIFT (Society for Worldwide Interbank Financial Telecommunication) system, which is widely used by traditional banks to send secure international financial transactions. The idea is to use cryptocurrencies and blockchain to enable real-time, low-cost, and secure global transactions without relying on central banks or legacy systems. 

Romance Scams are often advertised as one of several fraud services by cybercriminals on Telegram channels. The following screenshot was taken from a popular Telegram Fraud Marketplace.

Another example that highlights romance scams services came from a credit card fraud Telegram market. This user also advertised various services, including PII associated with various dating sites that social engineers can leverage for Romance Scams: 

According to a recent University of Cambridge study, “eWhoring is the term used by offenders to refer to a social engineering technique where they imitate partners in virtual sexual encounters, asking victims for money in exchange for pictures, videos or even sexual-related conversations (also known as sexting). Packs of multiple images and videos of the people being imitated are traded on underground forums. This material is used as the bait to entice victims into paying for online encounters. Underground forums serve as a place for the interchange of knowledge and new techniques to improve the benefits obtained from this illicit business” 

Cyber criminals take great pride in proving themselves by sharing their knowledge, tips and tricks with others to build up their reputation and standing out within the threat actor community. DarkOwl analysts observed many sharing, some for free and some for sale, guides and ebooks covering how to get involved in e-whoring and romance scams. 

DarkOwl analyst discovered recent comments on a post on the popular hacking forum, BreachForums, where a user advertised a large e-whore database allegedly containing over 637 GB. 

E-whoring packs are also commonly sold across darknet markets, forums, and cybercrime related Telegram channels and Discord servers. The following post from the notable carding fraud forum, Craxpro, advertised a leaked database for an OnlyFans model:  

E-whoring packs and databases are the most common, however, we also discovered an e-whoring bot being sold on Craxpro for 10,000 USD per month: 

We also identified Telegram users selling access to e-whoring mentorship services. The below user advertised e-whoring mentorship service for 350 USD and accepts LTC, BTC, ETH, PPl, and Wise. 

Romance scams, how they identify their targets, and e-whoring a will remain popular topics across the darknet as long as this form of fraud remains profitable, effective, and efficient form. One of the examples claimed that romance scams are the gateway to becoming an experienced fraudster that dabbles in its various forms. We also observed a large supply of users selling this fraud knowledge and a large demand of eager “newb” fraudsters willing to pay for this knowledge.  

Darknet actors will continue to innovate as long as it remains profitable. As with conducting any activity on the internet, it is always important to remain vigilant to scams, whether that be romance scams or not.  

DarkOwl wanted to share a few steps recommended by the FBI in order to protect yourself again romance scams. 

Protect Yourself  

  • Be careful what you post and make public online. Scammers can use details shared on social media and dating sites to better understand and target you. 
  • Research the person’s photo and profile using online searches to see if the image, name, or details have been used elsewhere. 
  • Go slowly and ask lots of questions. 
  • Beware if the individual seems too perfect or quickly asks you to leave a dating service or social media site to communicate directly. 
  • Beware if the individual attempts to isolate you from friends and family or requests inappropriate photos or financial information that could later be used to extort you. 
  • Beware if the individual promises to meet in person but then always comes up with an excuse because he or she can’t. If you haven’t met the person after a few months, for whatever reason, you have good reason to be suspicious. 
  • Never send money to anyone you have only communicated with online or by phone. 

We wish all our readers a very happy and safe Valentine’s Day! 


Don’t miss anything from the DarkOwl analyst team! Subscribe to email.

Copyright © 2024 DarkOwl, LLC All rights reserved.
Privacy Policy
DarkOwl is a Denver-based company that provides the world’s largest index of darknet content and the tools to efficiently find leaked or otherwise compromised sensitive data. We shorten the timeframe to detection of compromised data on the darknet, empowering organizations to swiftly detect security gaps and mitigate damage prior to misuse of their data.