Kaspersky has released a forecast for the shadow market and threats from the dark web

[1.735]

Overview of last year's forecasts

1. The number of services offering cryptographers to bypass security software will grow
We regularly monitor underground markets for new cryptors designed to obfuscate code in malware samples. The main task of such tools is to hide malicious code from detection by security solutions. According to our experts, in 2024, there are noticeably more cryptographic ads on the darknet. Developers of this software are actively implementing new ways to bypass security systems and add them to the list of features of their commercial solutions.
Prices for such instruments remained the same: from $ 100. USD per month for regular cryptos available on darknet forums, up to $20,000. USD for private premium subscriptions. At the same time, there is an increase in the popularity of private premium solutions, which are gradually replacing public offers.
Verdict: the forecast came true 

2. Downloader distribution services will continue to develop
As expected, bootloaders were actively distributed in 2024. Loaders with different functionality were presented on the shadow market: from mass and cheap to highly specialized, developed according to individual requirements and sold for thousands of dollars.

Examples of posts about the sale of commercial downloaders
In addition, cybercriminals are increasingly using several programming languages. For example, the client part of the malware can be developed in C++, and the server administrative panel can be developed in Go.
In addition to the variety of downloader offerings, we also noted the demand for specific tools that trigger specific infection chains.



Example of a post about finding a loader taking into account specific requirements
Verdict: the forecast came true ✅

3. The number of services with malware for stealing cryptocurrency assets will increase in the shadow markets
In 2024, we found an increase in the activity of drainers in the shadow markets — malicious tools for stealing crypto assets, such as tokens or NFTs. Throughout the year, new drainers appeared, which were actively advertised on darknet platforms. Separately, it is worth noting that the number of unique threads discussing drainers in underground markets increased from 55 in 2022 to 129 in 2024. Often these posts redirected users to Telegram channels.
Number of unique threads discussing drainers on darknet forums (01-en-ru-es-dark-web-diagrams.png (1600×1086))
In fact, in 2024, Telegram channels have become an important hub for drainer-related activity.



Dark web post directing potential accomplices to Telegram
Drainer developers are increasingly focusing on working with long-term customers, with the bulk of the activity being conducted through invite-only channels.
From a functional point of view, drainers have undergone few changes, mainly support for new types of crypto assets — coins, tokens, and NFTs — has been added. In addition, the first mobile drainer (Wallet Scam: A Case Study in Crypto Drainer Tactics - Check Point Research) appeared in 2024.
Verdict: the forecast came true 

4. Black traffic generation schemes will be very popular
Black traffic generation schemes in underground markets have remained popular in 2024. Black traffic merchants continued to promote malicious pages through ads that misled users. Such services were actively sold in underground markets, and stable demand emphasized the effectiveness of malware distribution through popular advertising platforms. This method remains the preferred way for attackers to reach a wide audience and poses a constant threat to internet users.

Verdict: the forecast came true partially

5. The market for bitcoin mixers and cryptocurrency anonymization services is evolving
In 2024, the number of services advertising solutions for cryptocurrency laundering did not show significant growth. Most popular services continue to operate on the market, while the competitive environment has changed only slightly.

Verdict: the forecast did not come true 

Our predictions for 2025
1. Data leaks through contractors
In trusted relationship attacks between a company and a contractor, attackers first penetrate the provider's systems and then gain access to the target organization's infrastructure or data. Sometimes such attacks lead to serious data breaches, as was the case (Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED) with Ticketmaster. Then the attackers allegedly gained access to their cloud account in Snowflake by hacking into the systems of a third-party contractor. The IntelBroker threat actor also used similar tactics. Together with his accomplices, he reportedly gained access through contractors to data from companies such as Nokia (Hackers Claim Access to Nokia Internal Data, Selling for $20,000), Ford, as well as several Cisco customers, including Microsoft. (Alleged Cisco data breach could affect Microsoft, Barclays, and SAP developer data | CSO Online)



IntelBroker profile on the popular darknet "@Criminal here"
forum We expect contractor attacks that result in data breaches to be more frequent in 2025. Cloud platforms and IT services often store data from multiple organizations, so a hack from one company can threaten the security of many others. It's important to note that a leak doesn't have to involve critical assets to be devastating. Not every report of a data breach on the dark web is related to a major incident. Information about the databases for sale may be unreliable. For example, attackers can pass off compilations of publicly available or previously leaked information as recent leaks. In addition, they may be promoting dubious data from an unknown source as a database of a well-known brand. By creating a stir around old, irrelevant or even non-existent data, attackers can cause public outcry, sow panic and damage the reputation of both suppliers and their customers.


IntelBroker's message on the dark web about the alleged Tesla data breach, which was later edited and now claims that the leak refers to a third-party company providing electric vehicle
charging services Overall, there has been an increase in the number of announcements about the distribution of corporate databases on the dark web. For example, on one of the popular forums, the number of posts in August-November 2024 increased by 40% compared to the same period last year.
Number of dark web posts about database proliferation; one of the popular forums, August 2023 – November 2024 (02-ru-dark-web-diagrams.png (1600×1086))
This increase can be partly attributed to the republication or merging of old leaks, but attackers are clearly interested in spreading leaked data – both new and old, and sometimes fake. In 2025, we are likely to see not only an increase in the number of hacks and data breaches through contractors, but also an overall increase in the number of breaches.

2. Migration of criminal activity from Telegram to darknet forums
Despite the surge (Cybercriminal Activity on Telegram Surges by 53% in 2024 – Security Review Magazine) in attacker activity on Telegram in 2024, we expect them to gradually return to darknet forums. Administrators of shadow Telegram channels are increasingly reporting that they are being blocked.


Examples of messages from cybercriminals announcing the blocking of their channels and accounts on Telegram
It is expected that the return or influx of attackers to darknet forums will increase competition between platforms. To attract new audiences, forum owners are likely to introduce new features and improve the conditions for data trading. For example, they may offer automated guarantor services, simplified dispute resolution, and enhanced security and anonymity measures.

3. Conducting large-scale and high-profile operations by law enforcement officers against APT groups
2024 has become a key year in the global fight against cybercrime. We have witnessed many successful operations by international task forces, such as Cronos (Law enforcement disrupt world’s biggest ransomware operation | Europol) vs. LockBit, Magnus (Dutch Police Disrupt Major Info Stealers RedLine and MetaStealer in Operation Magnus) vs. RedLine and MetaStealer, and Endgame vs. TrickBot, IcedID, and SmokeLoader. Among other things, we can highlight the seizure of the hacker forum BreachForums and the arrest of the administrators of the WWH-Club. Kaspersky Lab experts also actively assisted law enforcement agencies in the fight against cybercrime. For example, they supported INTERPOL-coordinated efforts to eliminate the Grandoreiro (Kaspersky supports INTERPOL-coordinated action to disrupt Grandoreiro malware operation) malware, participated in cybersecurity during the 2024 Olympics (Kaspersky joins efforts with INTERPOL to counter cybercrime during the 2024 Olympics), and contributed to Operation Synergia II (Kaspersky supports INTERPOL’s Synergia II operation, resulting in the arrest of over 40 individuals), which aims to combat phishing, ransomware, and stealers. In addition, we participated in the joint INTERPOL-Afripol operation (Kaspersky contributes to joint INTERPOL-AFRIPOL operation combating cybercrime across Africa) against cybercrime in Africa. These and other events have become examples of effective cooperation between law enforcement agencies and cybersecurity organizations.

We expect that in 2025 there will be an increase in the number of public arrests and measures to dismantle the infrastructure of malicious actors and shadow forums. At the same time, in response to the successful operations of 2024, attackers are likely to change tactics and start moving into deeper and more anonymous corners of the dark web. We also expect to see an increase in the popularity of private forums and invite-only access models.

4. Stealer and drainer distribution services will become even more popular on the darknet
Cryptocurrencies have been one of the main targets of attackers for many years. Under various pretexts, they lure cryptocurrency owners to fraudulent sites (Фишинговые схемы с горячими и холодными криптокошельками | Securelist) and Telegram bots (Мошенничество с криптовалютой Toncoin в Telegram | Блог Касперского), as well as introduce cryptocurrency theft functionality into infostealers (Разбираем атаки стилеров: Kral, AMOS, Vidar и ACR | Securelist) and banking Trojans (Grandoreiro banking trojan: overview of recent versions and new tricks | Securelist). As the bitcoin rate continues to (Bitcoin at record highs, sets sights on $100,000 | Reuters) set records (Bitcoin surges to record high near $95,000 | Reuters), the popularity of drainers designed to steal tokens from cryptocurrency wallets is likely to remain high next year.

Interest in cryptocurrencies will also be affected by infostealers — malware that steals confidential information from users' devices, including private keys of cryptocurrency wallets, passwords, cookies, and autofill form data. In recent years, we have seen (Data-stealing malware infections increased sevenfold since 2020, Kaspersky experts say) a sharp increase in credential leaks through this malware, and we expect this trend to continue and possibly intensify. Most likely, we will see the emergence of new stealer families along with an increase in the activity of existing ones.

Both stealers and drainers are likely to be increasingly offered on the dark web as services. Malware-as-a-Service (Data-stealing malware infections increased sevenfold since 2020, Kaspersky experts say) (MaaS), or subscription, is a business model on the dark web that allows you to rent software to carry out cyberattacks. Usually, customers of such services are provided with a personal account for managing the attack and technical support. This reduces the level of technical knowledge that a potential attacker must have.


In
addition to advertising stealers and drainers, you can also find ads on the dark web looking for traffickers — people who help attackers distribute and promote stealers, drainers, scams, and phishing pages.


Examples of searching for traffic for drainers

Example of searching for traffic for cryptocurrency scams (not drainers)

5. Fragmentation of ransomware groups
We expect that in the coming year, groups of ransomware operators will continue to split into smaller, independent teams, which will make them more difficult to track, increase their level of flexibility and stealth. According to Kaspersky Digital Footprint Intelligence (DFI), in 2024, the number of sites with exfiltrated data (DLS) increased by 1.5 times compared to 2023. Despite this growth, the average number of unique posts per month remained at last year's (Прогнозы по теневому рынку и угрозам из даркнета на 2024 год | Securelist) level.

Ransomware operators are likely to continue to use (Key Group использует слитые билдеры шифровальщиков и вайперов | Securelist) (Leaked Lockbit ransomware builder analysis | Securelist) leaked source codes and malware collectors to create their own versions. This approach significantly reduces the barrier to entry for new teams, allowing them to avoid developing tools from scratch. The same applies to DLS portals: unskilled attackers can use the leaked source code of blogs of well-known groups to create almost exact copies, which can already be observed on the darknet.


DLS Portal LockBit

DLS Portal DarkVault is almost an exact copy of the LockBit portal

6. Escalating Cyber Threats in the Middle East: The Rise of Hacktivism and Extortion
According to Kaspersky Digital Footprint Intelligence (DFI), in the first half of 2024, hacktivist activity has become one of the most significant (Kaspersky Digital Footprint Intelligence) darknet-related cybersecurity threats in the Middle East. The region has seen an increase in hacktivist activity due to the current geopolitical situation, and if tensions do not subside, the situation is likely to worsen.

Kaspersky DFI researchers have documented more than 11 hacktivist movements and groups across the region. Amid the current geopolitical instability, hacktivists are moving from DDoS attacks and website deface attacks to more serious attacks aimed at stealing data and compromising organizations.

Another threat that is likely to remain relevant in the region is ransomware. Over the past two years, the number of victims of ransomware attacks in the Middle East has increased significantly (Kaspersky Digital Footprint Intelligence), from an average of 28 in the first half of the year in 2022-2023 to 45 in the first half of 2024, according to DLS portals. This trend is likely to continue in 2025.

[47]

hey dont expose me ! that is a secret !!!

[36]

interesting read

[1.735]

hey dont expose me ! that is a secret !!!