Despite the repeated takedowns of darknet markets by law enforcement, they continue to thrive, with 190 “significant” new markets or forums debuting last year alone, according to threat intelligence firm Flashpoint.
These markets are used by Ransomware-as-a-service groups, initial access brokers, malware developers, and data brokers.
They are typically only reachable via anonymizing networks such as Tor or I2P. Following the takedown of major players by law enforcement, new alternatives typically debut quickly.
Experts say that English continues to serve as the lingua franca of the underground, and various types of fraud focus on specific regions, with drug sales, carding, and malware development being localized.
Hydra’s buyers and sellers first regrouped using encrypted chat apps, which can provide a lifeline but do not offer the security of a marketplace.
Buyers and sellers are often drawn back to markets because they offer users multiple protections, including buyer and seller ratings for quality of service, escrow features, and dispute resolution services.
Researchers report that popular darknet market offerings last year included stolen records, malware, phishing kits and services, and vulnerability exploits.
Recorded Future notes that there has been a shift in crime trends, with Russian criminals likely to embrace more payment card fraud as their country faces economic sanctions following the Kremlin’s 2020 invasion of Ukraine.
Despite turnover due to takedowns, shutdowns, and exits, darknet markets remain highly resilient and viable, with the overall illicit economy alive and well, according to Flashpoint.
