DarkOwl analysts monitored prominent dark web forums for alleged leaks and sales of sensitive military, government, and intelligence data tied to the Iran-Israel-U.S. conflict, highlighting how cyber threat actors exploit geopolitical tensions.
Darknet marketplaces do not simply operate — they evolve, and that evolution leaves measurable traces in the data they generate. How category-based fingerprints reveal vendor behavior, specialization, and cross-market activity.
This report examines the Islamic State’s (IS) evolving digital propaganda strategy, tracing its shift from centralized social media campaigns to a decentralized, multi-platform ecosystem spanning encrypted messaging apps and darknet infrastructure. Drawing on data from DarkOwl Vision and other intelligence sources, the report outlines how IS has adapted to deplatforming by leveraging Telegram, Rocket.Chat, Matrix, and Tor-based onion sites to distribute propaganda, recruit operatives, and maintain ideological influence. It highlights IS’s increasing use of multilingual content, operational security (OPSEC) training, and emerging technologies such as generative AI to sustain its global reach. The findings underscore the importance of persistent darknet monitoring and cross-platform intelligence to counter the group’s resilient digital footprint.
In a September 04 press release, the U.S. Department of Justice (DOJ) announced it had seized 32 domains used in Russia’s ongoing foreign influence operations. In addition to efforts to reduce international support for Ukraine and amplify pro-Russian propaganda, the campaign also aimed to influence voters in the upcoming U.S. 2024 presidential election. Since its alleged targeting of the 2016 election, Russia has continued to bolster its disinformation operations in an effort to secure its “preferred outcome in the election.” Russia is not alone, however, in its endeavors; Iran and China, too, appear to have ramped up influence operations against the U.S.
In this report, DarkOwl analysts explore the election disinformation landscape on the dark web. What emerges is a complex, multifaceted online space characterized by a variety of actors, ranging from nation states to American citizens and U.S.-based conspiratorial political movements. All of the above play key roles in both creating and amplifying mis- and disinformation which has seeped from the deep and dark web onto the surface web, and vice versa. As a number of prominent social media platforms maintain policies of limited disinformation regulation, conspiracy theories previously concentrated on the dark web and alternative social media platforms have become mainstream, thereby gaining traction and reaching greater audiences. Combined, these factors reflect a complex environment in the lead up to the election, and highlight the importance of identifying and combatting mis- and disinformation.
Since the dawn of the internet thirty years ago, its underpinning technology and networks have been adopted and used by billions of people worldwide. This includes academic and medical institutions sharing cutting-edge research at lightning speed, social platforms meant to engage communities and share photos, memories, and culture, as well as its use by our governments, commerce, and work environments – the internet enters every part of our lives.
However, along with all the good the internet has brought, there are unfortunately a multitude of malicious actors who operate on the internet and in the cyber realm. They conduct espionage, steal data, attempt to infiltrate, and shut down systems critical to everyday life: water and power supplies, financial infrastructure, the medical sector, and more. As of late, the medical sector has been a prominent target, facing attacks from actors trying to disrupt treatment and hospital systems crucial for patient care.
Since the start of notable cyber operations and programs circa the early 2000s, the United States and its Western allies consistently identify four primary nation-state adversaries in cyber: Iran, China, Russia, and North Korea, or “The Big 4.”
Each country covered in this paper has military and civilian intelligence services that conduct cyber operations. Their specific strengths and skills vary, but they all have a common goal: to establish a new digital and physical world order in which they are the global leader.
DarkOwl is the darknet expert and our customizable service options allow customers to leverage our in-house expertise to save time, keep their employees safe, and fulfill the need for actionable threat intelligence. This infographic outlines several aspects of DarkOwl’s dark web investigations.
In just under two decades, the Taliban has evolved from insurgents to a hardline ruling group who use social media and technology to suppress the population of Afghanistan. The conservative Muslim group who once banned the internet in 2001 has now harnessed it, prolifically using apps and social media platforms to recruit new members, spread its politics, threaten those speaking out against it, and spy on its own citizens. Highlights in this report from the DarkOwl analyst team include:
Using DarkOwl’s leading darknet data product, Vision UI, DarkOwl analysts were able to search across the darknet and darknet adjacent sites to uncover and examine the darknet exposure of five top supply chain vendors. Supply chain attacks, also referred to as value-chain or third-party attacks, are industry-agnostic cybersecurity attacks that cause damage and destruction to an organization when an outside partner or provider compromises less secure elements in the organization’s supply chain. Vision UI provides the largest commercially available source of darknet data, allowing for powerful querying capabilities to search, monitor and create alerts for critical infrastructure. Outlined in this report are the findings of this research.
