A total of 150 people – including 24 Britons – alleged to be involved in buying or selling illicit products or services on the dark web (also known as the darknet) have been arrested following a major international police operation.
The arrests, coordinated through European agencies Europol and Eurojust in an operation dubbed Dark HunTOR, come nine months after the disruption of the illicit DarkMarket forum in January 2021.
At its peak, DarkMarket had almost 500,000 users, more than 2,000 sellers, and had overseen the equivalent of about £120m worth of cryptocurrency transfers for goods and services including drugs, counterfeit currency, stolen or fake credit card details, mobile SIM cards and malware.
Europol said the arrests gave investigators a “trove of evidence”, and that since then, its European Cybercrime Centre (EC3) has been compiling a dossier of intelligence packages to identify further key targets, many of whom are in custody as a result, and include some of the agency’s highest-profile targets.
The latest sting took place in Australia, Bulgaria, France, Germany, Italy, the Netherlands, Switzerland, the United Kingdom and the United States. It saw the seizure of €26.7m (£22.5m or $31m) in cash and virtual currencies, 234kg of drugs including amphetamines, opioids and ecstasy pills, and 45 firearms.
At the same time, the Italian authorities have moved against two other dark web markets, DeepSea and Berlusconi, and arrested four people alleged to be involved in their administration.
“The point of operations such as the one today is to put criminals operating on the dark web on notice: the law enforcement community has the means and global partnerships to unmask them and hold them accountable for their illegal activities, even in areas of the dark web,” said Jean-Philippe Lecouffe, Europol deputy executive director of operations.
Law enforcement becoming more adept
Europol said that despite its name, the dark web was not quite as dark as many cyber criminals would like it to be, as law enforcement becomes more adept at operating within its confines.
The agency also pointed out that buying on the dark web also carries a certain amount of risk, such as acquiring adulterated drugs, exposing your devices to malware and risking prosecution.
Nevertheless, the dark web continues to experience a surge in popularity in certain quarters, with a recent study conducted by BitGlass revealing some insight into the medium’s growth over the past few years.
Among other things, Bitglass’s researchers found that breach data – frequently offered for sale or published by ransomware crews on dark web sites – received more than 13,200 views in 2021, versus 1,100 views in 2015, and while it took 12 days for a dark web link to reach 1,100 views six years ago, that now takes less than 24 hours.
“We expect that the increasing volume of data breaches as well as more avenues for cyber criminals to monetise exfiltrated data has led to this increased interest and activity surrounding stolen data on the dark web,” said Mike Schuricht, leader of the Bitglass Threat Research Group.
“In comparing the results of this latest experiment with that of 2015, it is clear that data on the dark web is spreading farther, faster,” said Schuricht. “Not only that, cyber criminals are getting better at covering their tracks and taking steps to evade law enforcement efforts to prosecute cyber crime.”
Cybereason’s Sam Curry said: “Darknet criminals have been using the world for decades simply as the cash cow that needs milking. The global darknet includes many different criminal organisations operating with close to zero risk, no accountability, motivated by greed and with no scruples. While today’s bust is encouraging, this sting will barely put a dent in the broader illegal ecosystem.
“Today’s bust also reminds us all that BlackMatter, Conti and other ransomware gangs aren’t the only malicious actors on the internet,” he said. “Cyber terrorism, cyber stalking and money laundering activities go from incubation to delivery stages in a variety of darknet channels daily.
“Illegal markets are not unique to any country and arise when there is illicit or contraband material available or when commerce is too impeded,” said Curry. “It’s certainly no more acceptable to engage in darknet activities in relative anonymity than it would be to buy drugs or guns in the parking lot of the neighbourhood supermarket or shopping mall.”
