The Ultimate Guide of Deep and Dark Web Research

How to Boost Your Cybersecurity by Uncovering Relevant, Timely, and Actionable Insights


What happens on the deep and dark web, and why does it matter? For cybercriminals, the dark web—sites that are accessible only through a specific browser (Tor), which scrambles location and hides identity—is a key channel for communicating and collaborating with other threat actors. It is also a place for both buying and selling services and resources, such as tools for cyberattacks and compromised information stolen from past attacks. Most importantly for these criminals, the dark web is a place to do all of these things anonymously.

Accordingly, understanding the dark web is a critical component of a threat intelligence program. Analysts can use it to examine discussions of tactics, techniques, and procedures (TTPs); monitor transactions of tools needed in cyberattacks; and investigate the success of earlier attacks as shown by their winnings (such as compromised credit cards or credentials) being listed for sale.