Threat Intelligence From The Dark Web

Threat Intelligence From The Dark Web

The reputation of the “Dark Web” perhaps exceeds its reality

The reputation of the “Dark Web” perhaps exceeds its reality.  Many think of it as a place for criminals to operate.  If used by security teams, however, the “Dark Web” can be ripe with threat intelligence for the picking. 

Note: In this article “Dark Web” refers to any collection of computers that create an internet which requires specific software, configuration, or authorization to access.  For example: Tor, Riffle, FreeNet, anoNet, and ZeroNet.

The Opportunity

The “Dark Web” has many purposes, but it is indeed a place for criminals to buy, sell, and trade goods and services.  This is what makes it valuable to security researchers.  By exploring the “Dark Web”, security teams have the potential to collect actionable intelligence.  This includes malware capabilities, new tactics, compromised technology, and the direction of future attacks. 

Recently, The Security Stronghold’s team of researchers ventured into the “Dark Web” for over four months to survey ransomware capabilities for our clients.  This allowed us to look at how ransomware is targeting different verticals and with what tactics.  Much of what we found is already known, but some intelligence collected helped us to clearly see current capabilities and gave insight into the future direction of ransomware aimed at certain clients.

When looking at threat intelligence from a hunting perspective there are a few specific items to look for. We are going to look at features of malware and underlying tactics.  Keep in mind that scouring the “Dark Web” will give you insight to much more than merely malware.

Ransomware Intelligence Gathering

For this survey we visited a variety of marketplaces and forums ranging from public to private.  By interacting with developers we were able to gain insight into what the underground economy is demanding as well as capabilities of malware. 

The first phase was investigating marketplaces.  Our team wanted to see if there were any obvious disparities between what was being sold and what the security industry was planning to defend against.  Activities in this phase of the survey included identifying marketplaces unknown to the public, creating accounts or procuring access, and interacting with sellers.  Communicating with ransomware developers and sellers was essential because our team needed to ensure that the capabilities and features were legitimate.

The second phase was interacting with developers in forums.  Here our team was able to interact with a developing-centered community and discover the direction of future work.  Many of the developers had experience with all types of malware but it is clear that ransomware is providing the largest return on investment for these criminals at this time. 

The final phase was breaking down all of the information we had gathered. We tested proof of concept, ease of use, availability, looked at how certain variations and families of ransomware would affect different industries, and much more.  With this survey we were able to advise multiple clients about threats that would have not been realized had we not taken the time to threat hunt on the “Dark Web”.

Keep This In Mind

First of all, keep in mind that spending time and money by sending your security team to gather threat intelligence from the “Dark Web” is not smart if your organization does not have the resources, risk, or need to deal with complex threats. 

Focus on the big wins when gathering intelligence.  In the beginning much of what The Security Stronghold team spent their time on did not result in actionable intelligence.  Soon, however, we realized that we should focus on the big wins.  These “wins” are discoveries that will result in actionable intelligence for your organization.  This intelligence will be different for every organization.

The former point brings us to our next one, only collect actionable intelligence.  If you really wanted to, you could spend forever obsessing over every little find.  It is only practical if you collect the intelligence which will lead to real world action.  Plenty of researchers have already gathered the basic information.

Your Turn

Gathering intelligence from the “Dark Web” once to explore is something entirely different than incorporating into security events at your organization.  In order to fully develop threat intelligence capabilities within your security team, you should consider the following:

  • Do you have a threat hunting program in place already?
  • Is there a need for one?
  • Would it be best to outsource?
  • Do you have the resources to effectively hunt for threats in this manner?

Going Forward

The “Dark Web” can allow your organization to gain valuable insight into threats you face, however, the most effective use of your resources may merely be to have your incident response team stay up to date with others who conduct this type of research.  This type of hunting is a can be a great experience and something that properly equipped security leaders may want to consider.  It allows you a look inside the mind of the attacker.

Featured

  • Freedom of Choice

    In today's security landscape, we are witnessing a fundamental transformation in how organizations manage digital evidence. Law enforcement agencies, campus security teams, and large facility operators face increasingly complex challenges with expanding video data, tightening budget constraints and inflexible systems that limit innovation. Read Now

  • Accelerating a Pathway

    There is a new trend touting the transformational qualities of AI’s ability to deliver actionable data and predictive analysis that in many instances, seems to be a bit of an overpromise. The reality is that very few solutions in the cyber-physical security (CPS) space live up to this high expectation with the one exception being the new generation of Physical Identity and Access Management (PIAM) software – herein recategorized as PIAM+. Read Now

  • Protecting Your Zones

    It is game day. You can feel the crowd’s energy. In the parking lot. At the gate. In the stadium. On the concourse. Fans are eager to party. Food and merchandise vendors ready themselves for the rush. Read Now

  • Street Smarts

    The ongoing acceptance of AI and advanced data analytics has allowed surveillance camera technology to shift from being a tactical tool to a strategic business solution. Combining traditional surveillance technology with AI-based data-driven insights can streamline transportation systems, enhance traffic management, improve situational awareness, optimize resource allocation and streamline emergency response procedures. Read Now

  • The Progress of Biometrics

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.