)
Introduction
What happens on the deep and dark web, and why does it matter? For cybercriminals, the dark web—sites that are accessible only through a specific browser (Tor), which scrambles location and hides identity—is a key channel for communicating and collaborating with other threat actors. It is also a place for both buying and selling services and resources, such as tools for cyberattacks and compromised information stolen from past attacks. Most importantly for these criminals, the dark web is a place to do all of these things anonymously.
Accordingly, understanding the dark web is a critical component of a threat intelligence program. Analysts can use it to examine discussions of tactics, techniques, and procedures (TTPs); monitor transactions of tools needed in cyberattacks; and investigate the success of earlier attacks as shown by their winnings (such as compromised credit cards or credentials) being listed for sale.