A lot of time and effort is spent trying to monitor and track some of the Darknet’s ‘key vendors’ – and for good reason. Top players on the underground constitute the most established, popular, reputable and highest-earning actors across a range of different marketplaces and forums. A plethora of different services and products are offered by these cybercriminals.
Assessing and monitoring the Darknet’s most prominent vendors is certainly of high importance, but such a high calibre of vendor is relatively few and far between. What of all the low-level vendors, quietly slipping under the radar? Take, for example, the vendor drunkdragon, who has been active on Wall Street Market since its inception in March 2017:
Financially, this vendor’s offers are low-value – rarely exceeding $2.99 – and technologically they appear unexciting, comprising keyloggers, crypters, databases, cracking software, brute checkers, phishing pages, config files, as well as a vast line-up of guides and tutorials which cover most topics imaginable.
Almost all of his offers are old, having been sold previously by other vendors, and are available across countless other markets, yet they continue to sell. As shown in the profile screenshot above, drunkdragon has made 2,930 sales (at the time of publishing), with a further 79 orders not yet completed. Feedback suggests that buyers are mostly happy with the products and that a continual stream of purchases appear to be taking place: drunkdragon has received more than 20 pieces of feedback within the past five days.
Further to this, it should be noted that he has active accounts on other markets as well:
As shown above, drunkdragon is also active on Empire Market (he was last online today – 10 October), and appears to have completed 2,240 sales on the site, the majority of which received positive feedback from buyers.
There are numerous similar vendors offering basic products at rock-bottom prices.
These are the vendors providing the foundations for attacks by more nefarious actors. The basic tools and services for maintaining anonymity, the software packages for cracking databases, the phishing pages allowing users to harvest credentials, the tutorials to explain and guide actors on how to carry out their attacks: all these services are readily available at extremely low cost.
As the Darknet’s low-level vendors continue to operate, the scope of their services increases, the number of sales expands, and prices are driven ever lower to compete for market share. All of this makes it ever easier for unskilled actors to get hold of the basic tools allowing them to learn and develop their skills.
Top vendors on the Darknet are undoubtedly a concern and will often pose an immediate threat to organisations. It is the low-level vendors, however, who perpetuate the cycle of Darknet activity, and provide the foundations for cybercrime.