Increased activity surrounding stolen data on the dark web

Dark web activity the value of stolen data and cybercriminal behaviors, have dramatically evolved in recent years, according to a Bitglass research.

Stolen data has a wider reach and moves more quickly

• Breach data received over 13,200 views in 2021 vs. 1,100 views in 2015 — a 1,100% increase.
• In 2015, it took 12 days to reach 1,100 link views — in 2021, it took less than 24 hours to surpass that milestone.
• Breach data was downloaded from entities across 5 different continents.

“We expect that the increasing volume of data breaches as well as more avenues for cybercriminals to monetize exfiltrated data has led to this increased interest and activity surrounding stolen data on the dark web,” said Mike Schuricht, leader of the Bitglass Threat Research Group.

Dark web activity has become darker

• The number of anonymous viewers on the dark web in 2021 (93%) outnumber those in 2015 (67%).
• This year’s experiment indicates particular interest in retail and government data from anonymous viewers; 36% and 31%, respectively.

“Given increased efforts by law enforcement to track and prosecute cybercriminals, we expect malicious actors to continue to use anonymous VPNs and proxies when accessing breached data in attempts to evade law enforcement,” said Schuricht.

Cybercriminals are particularly interested in retail and U.S. government data

Of all of the types of data researchers seeded on the dark web, data to access retail and U.S. government networks received the most clicks, 37% and 32%, respectively.

“Gaining access to large retailers’ networks remains a top priority for many cybercriminals wishing to deploy ransomware and extort payouts from large and profitable organizations,” said Schuricht.

“Similarly, interest in the U.S. government information is likely either from state-sponsored hackers or independent hackers looking to sell this information to nation-states.”

Cybercriminals are closer than you think

Cybercriminals may be more of a “homegrown” threat than many believe, with downloads of the stolen data originating from the United States as the second-most frequent location. The top three were: Kenya, United States, and Romania.

“In comparing the results of this latest experiment to that of 2015, it is clear that data on the dark web is spreading farther, faster,” said Schuricht. “Not only that, but cybercriminals are getting better at covering their tracks and taking steps to evade law enforcement efforts to prosecute cybercrime.

“Unfortunately, organizations’ cybersecurity efforts to protect data have not kept pace, as evident by the continuous onslaught of headlines reporting on the latest data breaches. As we advised organizations six years ago, it is vital they use best practices and new technologies to protect their data.”