Cybersixgill Releases Annual State of the Underground Report, Revealing Dark Web Threat Actor Activities and Behaviors in 2023

Cybersixgill, cyber threat intelligence data provider, announced recently its newest report, State of the Underground 2024, which analyzes the company’s collected intelligence from the clear, deep, and dark web in 2023. The report features insights from the company’s threat intelligence experts into underground cybercriminal discourse, tactics, and behaviors, comparing them with trends and data from previous years and revealing the current state of threat actors’ activities and targets.

State of the Underground delves into several key topics, including:

Compromised credit card trends
Physical products on the underground
Messaging platforms and underground forums
Vulnerabilities and exploits
Initial access trends
Malware and ransomware trends

“Our expert threat analysts collect and analyze 10 million intelligence items daily from the deep and dark web,” said Dov Lerner, Security Research Lead at Cybersixgill. “With the breadth and depth of our intelligence and Cybersixgill’s powerful AI and machine learning capabilities, we can continually monitor the cybercriminal underground and analyze evolving trends.

“While advances in threat intelligence and cybersecurity, more stringent regulation, and stepped-up law enforcement activities are putting a dent in cybercriminals’ efforts, malicious actors are focusing their efforts on tactics and targets that generate the greatest return,” he continued. “Organizations that combine broad visibility into hard-to-reach sources with automated analysis gain an important advantage in the ongoing battle to protect their people and assets.”

Significant Findings: A Mix of Good News and Bad News

Credit Card Fraud: A Slight Increase in 2023, But Still on the Decline

Over the past five years, underground markets for compromised credit cards have declined due to improved fraud prevention. However, there was a 25% rebound in 2023, reaching 12,022,455 cards (still far fewer than the more than 140 million compromised cards detected for sale in 2019). This slight increase notably occurred in the last two months of the year, so it remains to be seen if it will continue into 2024. Organizations must remain vigilant despite overall trends and evolving threat landscapes.

Less Chatter on Messaging Platforms and Underground Forums

Threat actors have recently shifted from underground forums to messaging platforms like Telegram. Still, in 2023, both areas saw significant declines, which could be tied to a 50% drop in right-wing extremist forum activity. The top 10 forums experienced a 50.3% decrease in participating threat actors as law enforcement’s disbandment of major forums like RaidForums and BreachForums had an impact.

Fewer New Vulnerabilities, But Still a Significant Threat

In 2023, despite a small rise in the number of new vulnerabilities added to the National Vulnerability Database (NVD), the pace has slowed compared to previous years. Between 2022-2023, there were 5.4% more new vulnerabilities added to the NVD, compared to 36.1% between the period 2021-2022. However, while there was a decrease in the number, the impact and number of attacks were not less substantial than in previous years.

Stealer Malware: Newer Types Outperformed by the Oldtimers

Over the past few years, stealers, a type of malware that gathers valuable data like credentials from infected systems, have increased in popularity. Market listings track which stealers compromise systems, revealing trends. In 2023, threat actors used four new types of stealer malware in large numbers - Stealc, Risepro, Lumma, and Silencer. Nevertheless, incumbents like Raccoon and Vidar remained popular, highlighting the resilience and effectiveness of established stealers against new competitors.

Initial Access Trends: Compromised Access and Domains on the Rise

Last year, the wholesale trading of remote desktop protocol (RDP) ports ceased entirely due to the closure of some prominent underground markets. However, the listings of compromised endpoints – a crucial entry for threat actors to gain a foothold in an organization’s systems to launch ransomware and other attacks – rose by a massive 88%. Compromised domains also rose by 17% compared to 2022, continuing a trend of steady increases in domain compromise.

Ransomware: Fewer Attacks Generate Bigger Payouts

In 2023, Cybersixgill reported a 9.2% decrease in ransomware attacks, with the top five groups responsible for 65% of incidents. Despite the decline, attacks have grown more targeted and sophisticated, with average payouts soaring in the millions of dollars. While the ransomware group LockBit dominated, other groups continued consolidating, with a 30% reduction in active groups. At the same time, there was a continued rise in ransomware-as-a-service offerings, lowering the entry barriers for less sophisticated threat actors. The U.S. and UK remained prime targets, highlighting the global ransomware threat.


  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West 2024: Post-Show Recap

    ISC West 2024 is complete. And from start to finish, the entire conference was a huge success with almost 30,000 people in attendance. Read Now

    • Industry Events
    • ISC West
  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity


New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3