Similar to legal online retailers, dark net drug listings feature dozens of reviews, assessing the products for quality, purity and shipping times. “There’s a shift from the old way of the drug trade to more of a modern, technological and digital era of selling drugs.” But like a never-ending game of whack-a-mole, law enforcement agencies around the world employ new tactics to stamp out anonymous markets, only to see new ones pop up. They’re shopping for drugs on the so-called dark net, accessible not through traditional search engines but by way of special browsers and software that conceal IP addresses and make users harder to trace. Others, particularly those based in Russia, focus solely on info stealer hacking tools and brokering stolen data.
It’s known for its strong security features (like a trusted escrow system, PGP two-factor authentication) and anonymity. The dark web market changes all the time, but some dark web marketplaces have made a name for themselves as the biggest and busiest spots. These sites attract thousands of users every day, offering all kinds of illegal goods that keep the underground trade going. Beginning with Silk Road, the first large-scale dark web drug market, in 2011, traffickers and users have been flocking to these sites in part because they offer a degree of anonymity not available on the street. Specialized software, such as the commonly used Tor, routes user data through myriad servers and nodes around the world, disguising IP addresses — and by extension, identities — and making it difficult for law enforcement to track.
Feds Dismantled The Dark-Web Drug Trade—but It’s Already Rebuilding
Only four Russian-language DNMs left the approximately 20-strong ecosystem in 2024. The departure of market leaders such as Solaris Market — which ceased operations in autumn 2024 — is a rare occurrence. Launched in September 2022, Torzon Market operates on the Tor network and features over 11,600 illegal products, including drugs and hacking tools. It enhances buyer transparency by importing vendor feedback with PGP proof. Torzon offers a premium account option for additional benefits and is valued at approximately $15 million, accepting payments in Bitcoin (BTC) and Monero (XMR). The story of dark web marketplaces kicks off with Silk Road, launched in 2011.
Treasury International Capital (TIC) System
Renowned for its extensive inventory of financial data and sophisticated operating methods, Brian’s Club is a key player in the underground economy of financial cybercrime. Before escrow systems became commonplace, Marie once fell prey to a so-called “exit scam.” That’s when a dealer who plans to stop selling on a marketplace continues to take orders that they never plan to fulfill. Luckily, Marie’s order wasn’t very large; she only lost about $30 CAD. “Except for those three times, I never got shorted, and the product ranged from good to excellent quality,” she noted.
- Federal prosecutors have accused the men of operating 10 virtual storefronts on 17 different dark web marketplaces from September 2018 through February, the department said in a statement.
- Freshtools is a unique marketplace in that it does not only provide the stolen data, but it allows criminals to purchase MaaS which can cause further damage to the victims.
- Even if you’ve never visited these markets, your personal and financial data might already be there, having been leaked through a data breach.
- Operation RapTor resulted in the highest number of seizures of any JCODE operation, including more than $200 million in currency and digital assets, over two metric tons of drugs, 144 kilograms of fentanyl or fentanyl-laced narcotics, and over 180 firearms.
- Surveys, death certificate data, and medical reports are the principal sources for studying substance use problems.
- Being able to have your drugs delivered right to your door is so much simpler.
Operations
CACI’s DarkBlue Intelligence Suite is designed to address these exact challenges, offering comprehensive monitoring and analysis of the dark web’s most secure and decentralized spaces. With AI-enhanced threat detection, real-time dark web access through DarkPursuit, and detailed insights into evolving criminal networks, DarkBlue provides the intelligence needed to stay one step ahead in this rapidly changing environment. Vendors today are choosing to establish vendor shops and engage in direct deals through a diverse array of encrypted communication applications and email. These platforms allow vendors to reach customers who are less technologically savvy, whilst also mitigating against market turbulence caused by darknet market exit scams or law enforcement takedowns. In this respect, the use of encrypted communication apps like Telegram and Signal have reduced the barriers to access for drug buyers to purchase products online, whilst also reducing fees that vendors pay to darknet markets for sales.
Why Is It Critical To Monitor Dark Web Marketplaces?
According to his plea agreement, between January 2017 and October 2021, Sabbagh conspired with others to manufacture and sell counterfeit generic alprazolam pills. Sabbagh and his co-conspirators, without authorization, created pills stamped with manufacturer imprints designed to replicate the appearance of actual alprazolam pills. The benzodiazepine-class drugs used by the co-conspirators in the counterfeit pills have no accepted medical use in the United States. Sabbagh and his co-conspirators then sold these counterfeit pills in the Eastern District of Kentucky and throughout the United States via darknet marketplaces, receiving payment for the sales in cryptocurrencies. Sabbagh managed multiple vendor accounts across several darknet marketplaces and was responsible for sales to customers and providing lists of customer orders to co-conspirators who manufactured and shipped the counterfeit alprazolam pills. Over the course of the conspiracy, Sabbagh and his co-conspirators trafficked counterfeit alprazolam valued at more than $25 million.
VPN Alternatives For Securing Remote Network Access
Diagrams and pictures were created using Python’s Matplotlib and Seaborn libraries 29 to illustrate the patterns and trends across different regions and for other drug types. We also use different external services like Google Webfonts, Google Maps, and external Video providers. Since these providers may collect personal data like your IP address we allow you to block them here.
- Genesis Market and BidenCash, two top dark web marketplaces, were also shut down in 2023 and 2025, respectively.
- STYX MarketSTYX Market, launched in 2023, is all about financial crime.
- Cybercrime investigators in Calgary, who, Lalande says, are “always working dark web files,” face many obstacles.
- It should force us to think about where harm is really happening online and whether current strategies are looking in the wrong direction.
- When a new seller comes along, he’ll look at reviews online, both on the dark and open web.
- Its content is intentionally hidden and requires special browsers to access.
As large platforms face disruption from law enforcement action, dark web infighting, and an influx of users from Telegram, there’s a growing shift toward smaller, more specialized marketplaces. These new niche sites are focused on specific illicit goods, offering enhanced security and a more targeted environment for buyers and sellers. Nemesis was established in 2021 and operated as a criminal marketplace on the darknet, an encrypted network within the Internet that can only be accessed with special anonymity-enhancing browsers. Drug traffickers active on Nemesis sold fentanyl around the world, both on its own and surreptitiously laced into other drugs.
Recognize & Report Crime
As Telegram has end-to-end encryption and anonymous profiles, it makes it an ideal choice for threat actors and hackers to take advantage of. But these efforts of law enforcement don’t go in vain; hackers and criminals lose trust if a website or marketplace goes down. It became the blueprint for other dark web marketplaces that tried to take its place. BidenCash was launched in 2022, and since it became a hot spot for cybercriminals to sell and buy illegal things, including stolen card information and personal data.
In all, Empire lists over 18,000 narcotic offerings, including hundreds for oxycodone alone. The number of arrests and amount of money seized were the most for any international Justice Department-led drug trafficking operation, he said. Background research tasks included learning from past drug lords, researching legal matters, studying law enforcement agency tactics and obtaining legal representation. Patterns recommended to avoid include hiring hitmen like Dread Pirate Roberts, and sharing handles for software questions on sites like Stack Exchange. We observed the same listings posted in different marketplaces and illustrate the dependency of the same opioid listings among different marketplaces. Note that we determined if 2 listings are identical by matching the same elements (ie, listing’s title and description information and the vendor’s name) in 2 listings.
Some of those suppliers’ IDs (ie, A1CRACK and DiazNL) are neither common words nor have special meaning. Those suppliers kept using the same IDs for years to gain reputation and familiarity from buyers. To better understand the potential bundling relationship of opioid suppliers across different marketplaces, we calculated the Jaccard similarity coefficient between the suppliers in different marketplaces (Figure 6). We found that 182 opioid supplier IDs appeared in both the marketplaces Evolution and Agora from January 2014 to July 2015. In particular, we observed that 84 opioid supplier IDs synchronized similar product listings in both marketplaces at the same time. This might be because the suppliers tend to promote their products across various marketplaces and to increase sales.
Data Availability
The opioid buyer (client) will also access the anonymous online market and create an account in each anonymous marketplace before they can find the listings of opioids (step 4). After perusing the items available on the anonymous online market (step 5), the buyer will add opioids to their shopping cart (step 6). When the buyer wants to check out and make a purchase using cryptocurrency (eg, Bitcoin), if the trader accepts payment through an anonymous online marketplace as an escrow, the buyer will place the listed amount of cryptocurrency in escrow (step 7). Otherwise, the buyer will pay the trader directly using cryptocurrency or any other payment method accepted by the trader (step 9) 7. Note that the escrow mechanism is widely deployed in the anonymous online market because it helps to build trust and resolve disputes between sellers and buyers.
Known for its publicity stunt releasing millions of stolen card details for free, BidenCash specializes in credit card fraud and identity theft. Apart from the dark web markets that are operating online today, some raided platforms influenced many markets. Active for a decade since 2014, it is a widely used credit card shop used to source stolen credit card information such as dumps, CVVs, Wholesale Accounts. Security researchers have been monitoring forums within the cybercriminal underworld to investigate the leading markets operating in 2024. Believe it or not, some dark web marketplaces have pretty advanced systems for building trust. Sellers often need to pay a deposit to prove they’re serious, and they build their reputation through positive reviews.
