Dark web forums are online discussion platforms that operate within the dark web, a part of the internet that requires special software like Tor to access and is not indexed by traditional search engines. These forums serve as hubs for various activities, including discussions on cybersecurity, privacy, hacking, and, in some cases, illicit trade. Unlike surface web forums, dark web forums offer users a higher degree of anonymity, which can attract both ethical hackers and cybercriminals alike.
While some dark web forums focus on legitimate topics such as digital privacy and security research, others are notorious for facilitating cybercrime, including the sale of stolen data, malware, and hacking tools. Law enforcement agencies and cybersecurity researchers monitor these forums to track emerging threats, vulnerabilities, and cybercriminal operations. Due to their hidden nature and encrypted communication, dark web forums present challenges in investigation and regulation, making them a critical area of concern for cybersecurity professionals.
Yes, the dark web hosts numerous forums that cater to various topics, including cybersecurity, privacy, hacking, and, in some cases, illicit trade. These forums operate in a manner similar to surface web forums but provide users with greater anonymity due to the use of encryption and privacy-focused networks like Tor.
Some dark web forums focus on ethical hacking, security research, and digital privacy, serving as hubs for experts to share knowledge and discuss emerging cyber threats. Others, however, are associated with cybercriminal activities, including the sale of stolen data, malware, and other illicit goods and services. Law enforcement agencies and cybersecurity professionals monitor these forums to track cybercriminal operations and identify emerging threats.
Overall, dark web forums play a significant role in the underground cyber ecosystem, influencing trends in both cybersecurity defense and cybercrime.
Discussions of underground forums can evoke imagery of a city’s shadowy back alleys, populated by faceless figures. Speaking in whispered undertones, they meet one another, collaborate in criminal schemes, and transact contraband and prohibited services.
But just how many actors are there altogether on these forums? Do dark web forums grow their membership slowly-but-steadily, or do they expand exponentially, like the hottest new scene? And how active are those forum members - does each actor post more or less the same amount, or is there a major gap between the most and least active actors?
These questions are important for analysts. Understanding a forum’s lifecycle and internal dynamics guides an analyst’s attention to the highest-value sources and actors.
To these ends, we analyzed five extremely popular English and Russian-language underground forums from their inception to the end of 2020. We discovered that they indeed expanded their membership exponentially. One site’s growth did not hinder another’s growth, meaning, in our understanding, that the overall user base of the dark web is growing.
Despite similar trajectories, there was volatility from month-to-month. And some forums grew faster than others--compound monthly growth rates were 1 percent for the slowest-growing forum and 9 percent for the fastest.
But the largest spike in forum membership occurred in March-May, 2020. The user base of these dark web forums rose by 44% from January until their peak in the spring, and at their peak, they included a total of approximately 268,000 unique monthly users. The number of users reverted subsequent to that peak.
The peak in users is aligned with the coronavirus lockdowns. Prior Bitsight reports have noted a tremendous uptick in specific types of cybercrime on the underground during the COVID lockdowns. This includes gaming store accounts, compromised RDP credentials, money laundering services, and narcotics. This research demonstrates that the number of participants in the cyber underground spiked at the time as well.
Why would coronavirus lockdowns lead to a massive increase in users of dark web forums? Some of these users were bored at home and decided to go exploring. Others may have been interested in turning to crime amid the economic shocks from the pandemic and the widely-covered proliferation of cybercrime targeting remote workers, such as ransomware and phishing.
Next, we examined the frequency of posts, determining that a small minority of users was responsible for the vast majority of posts. The top 20 percent of frequent posters generated 73% of posts (which is more or less in line with what’s known as the Pareto Principle). Only 2.1% of users wrote more than 50 posts in half a year.
In our understanding, there are several reasons why so many actors post so infrequently: less experienced actors may come to the forum to learn, so they are mostly observing but not contributing. Or perhaps they wanted to dip their toes but then lost interest. Meanwhile, more experienced actors may create “burner” accounts, posting from a new username each time in order to maintain good operational security
By examining the number of users and activity per user in forums over time, this exercise results in several indicators that could be used to diagnose a forum’s health. Automating the analysis of these indicators can inform threat intelligence analysts which forums are on the rise.
Finally, we must emphasize that this research demonstrated that the overall user base of the underground is expanding. The COVID spike of users, correlated with the rise in cybercrime, proves this well: as the population of the dark web increases, so does broader criminal activity.
People visit dark web forums for a variety of reasons, ranging from ethical to illicit. Cybersecurity researchers and journalists may use these forums to gather intelligence on emerging threats and cybercriminal activities. Privacy advocates and whistleblowers might use these platforms to share information and communicate securely. On the other hand, cybercriminals frequent dark web forums to trade illicit goods, recruit accomplices, and discuss hacking techniques.
Additionally, some users access these forums out of curiosity, particularly during major global events. For example, during the COVID-19 pandemic, there was a significant increase in forum activity, likely due to economic uncertainty and increased cybercrime opportunities. The anonymity provided by the dark web fosters an environment where users can freely exchange knowledge, regardless of their intentions.
Visiting dark web sites is not inherently illegal in most countries. The dark web itself is a part of the internet that requires specialized software, such as Tor, to access. It is used for both legitimate and illicit purposes. Many privacy-conscious individuals, journalists, activists, and researchers use the dark web to communicate securely and access information free from censorship.
However, engaging in illegal activities while on the dark web—such as purchasing stolen data, illicit drugs, or hacking tools—can result in legal consequences. Additionally, some jurisdictions may have laws that restrict access to certain types of content or tools used to browse the dark web. It is advisable to understand the legal framework in your country before accessing dark web sites.
The attack surface is expanding as AI becomes more embedded in enterprise and attacker workflows. Get the full picture on AI exposure, exploit pressure, and the underground trends security teams need to watch.
