{"id":84948,"date":"2023-06-29T11:00:27","date_gmt":"2023-06-29T09:00:27","guid":{"rendered":"https:\/\/eiposgrados.com\/?p=84948"},"modified":"2023-07-25T09:27:16","modified_gmt":"2023-07-25T07:27:16","slug":"deep-and-dark-web","status":"publish","type":"post","link":"https:\/\/eiposgrados.com\/eng\/blog-ciberseguridad\/deep-y-dark-web\/","title":{"rendered":"Deep and Dark Web"},"content":{"rendered":"

The Deep and Dark web<\/strong><\/h2>\n\n\n\n

They are two concepts that are quite related for most people. You automatically think of (cyber)crime, drugs, weapons and a long list of criminal elements. People who have that in mind are simply wrong. The reality is that both concepts do not necessarily have anything to do with each other. It could be said that they are only united by the fact of being part of the immense and infinite cyberspace.<\/p>\n\n\n\n

On the one hand, the Deep Web<\/strong> It is that part of the Internet that you enter using any conventional browser<\/strong> and after passing some kind of<\/strong> authentication<\/strong>For example, the personal bank account, the Amazon account, Telegram, WhatsApp... What's criminal there?<\/p>\n\n\n\n

On the other hand, we have the Dark Web<\/strong>, that part of the internet is not as easily accessible as the previous one. In this case, a special browser<\/strong>For example, the well-known Tor Browser<\/strong>. In this Dark Web we have many resources and they are all common to those that we can find in both the Surface and Deep Web, the only difference would be that the browsing is anonymous<\/strong>.<\/p>\n\n\n\n

As with everything, if someone wants, they can take advantage of it to do evil. But this happens on the street, as well as on the internet, whether Surface, Deep or Dark Web. The fact is that, since someone wants to use the Internet to commit a criminal act, they will try to hide as much as possible. And how do you get that? Making use of the darknets<\/a> available, such as the Tor network.<\/p>\n\n\n\n

On the Dark Web you can find everything humanly imaginable.<\/strong> starting with the best known as they can be drugs<\/strong> and weapons<\/strong>, passing through services of hackers<\/strong> malicious<\/strong> and purchase of money<\/strong> fake<\/strong> and ending with the purchase of organs<\/strong> for transplants, hiring hitmen<\/strong>, kidnappings<\/strong>, And a long etcetera.<\/p>\n\n\n\n

The cradle of cybercrime<\/strong><\/h2>\n\n\n\n

In this article we focus on the threat actors who take advantage of this anonymous network to create their own cybercrime niches.<\/p>\n\n\n\n

A threat actor is a real individual, group or organization that operates with malicious intentions and different motivations such as political, economic or protest, among others.<\/p>\n\n\n\n

Markets<\/u><\/strong><\/h2>\n\n\n\n

These threat actors operate regularly and openly on the Dark Web. One of the most common platforms in this type of darknets are Markets<\/strong> of access credentials obtained by botnet-type malware. There are countless of them, however, one of the best known is Genesis Market<\/strong>. The prices of this Market range between approximately five and 150 dollars per set of credentials and offer the possibility of searching by website or by type of platform. For example, doing a search for Amazon credentials obtained in Spain.<\/p>\n\n\n

\n
\"Deep<\/figure>\n<\/div>\n\n\n

Once the credentials pack is accessed, all kinds of useful information appears, including:<\/p>\n\n\n\n

    \n
  1. He country<\/strong> of origin of the affected system<\/li>\n\n\n\n
  2. The first two octets of the IP adress<\/strong><\/li>\n\n\n\n
  3. He OS<\/strong> of the affected device<\/li>\n\n\n\n
  4. All the domains<\/strong> for which malware has stolen credentials<\/strong><\/li>\n<\/ol>\n\n\n
    \n
    \"Deep<\/figure>\n<\/div>\n\n\n

    In this example above, all credentials would be sold for $33.<\/p>\n\n\n\n

    Forums Underground<\/em><\/u><\/strong><\/h2>\n\n\n\n

    On the other hand, there are the famous forums underground<\/em><\/strong> where you can also find everything, however, the most difficult thing is the sales of RDP type accesses<\/strong> (Remote Desktop Protocol), VPN<\/strong> (Virtual Private Network), accounts Domain Controllers<\/strong>, of Active Directory<\/strong>, etc.<\/p>\n\n\n\n

    Many threat actors gain this type of access and use it to enter companies' infrastructure and carry out attacks, usually ransomware. Other threat actors only obtain them and then offer them for sale for amounts of money that range from one hundred dollars and can sometimes reach up to two hundred thousand dollars. Of course, access to a network from a large company is not the same as access to a much smaller one since the gain in case of success will also be proportional.<\/p>\n\n\n

    \n
    \"Deep<\/figure>\n<\/div>\n\n
    \n
    \"Deep<\/figure>\n<\/div>\n\n
    \n
    \"Deep<\/figure>\n<\/div>\n\n
    \n
    \"Deep<\/figure>\n<\/div>\n\n
    \n
    \"Deep<\/figure>\n<\/div>\n\n\n

    All are examples of access sales in Deep and Dark Web forums. As you can see, the threads are updated regularly, even indicating what has already been sold at a given time and is no longer available.<\/p>\n\n\n\n

    Ransomware groups<\/u><\/strong><\/h2>\n\n\n\n

    Something that has resonated a lot since the pandemic in 2020 are ransomware groups and their walls of shame or \u201cHall of shame\u201d. Ransomware groups use these platforms to openly publish the information of victims of threat actor groups who have hijacked and\/or encrypted their information.<\/p>\n\n\n\n

    Among the most common ransomware groups we have Lockbit 3.0, BlackBasta and Play Ransomware. Each and every one of them offers their exfiltration website so that whoever wishes can access and view the data stolen from their victims.<\/p>\n\n\n

    \n
    \"Deep<\/figure>\n<\/div>\n\n\n

    Illustration 1. Lockbit Wall of Shame.<\/p>\n\n\n

    \n
    \"Deep<\/figure>\n<\/div>\n\n\n

    Illustration 2. BlackBasta Wall of Shame<\/p>\n\n\n

    \n
    \"Deep<\/figure>\n<\/div>\n\n\n

    Illustration 3. Play Ransomware wall of shame.<\/p>","protected":false},"excerpt":{"rendered":"

    The Deep and Dark web are two concepts that are quite related for most people. You automatically think of (cyber)crime, drugs, weapons and\u2026 Read more<\/a><\/p>","protected":false},"author":1147,"featured_media":73409,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[332],"tags":[],"class_list":["post-84948","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-ciberseguridad"],"acf":[],"_links":{"self":[{"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/posts\/84948","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/users\/1147"}],"replies":[{"embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/comments?post=84948"}],"version-history":[{"count":0,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/posts\/84948\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/media\/73409"}],"wp:attachment":[{"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/media?parent=84948"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/categories?post=84948"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/tags?post=84948"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}