Darknet Cybercrime
Threats to Southeast Asia
2020

Copyright © 2020, United Nations Office on Drugs and Crime (UNODC).
This publication may be reproduced in whole or in part and in any form foreducational or non-profit purposes without special permission from the copyrightholder, provided acknowledgement of the source is made. UNODC would
appreciate receiving a copy of any publication that uses this publication as a source.

Disclaimer
This report has not been formally edited.
The contents of this publication do not necessarily reflect the views or policies of
UNODC, Member States, or contributory organizations, and neither do they imply
any endorsement.
The designations employed and the presentation of the material in this publication
do not imply the expression of any opinion whatsoever on the part of UNODC or
the Secretariat of the United Nations concerning the legal status of any country,
territory, city or area or of its authorities, or concerning the delimitation of its
frontiers or boundaries.

Darknet Cybercrime Threats to Southeast Asia

Foreword
The United Nations Office on Drugs andCrime (UNODC) is proud to present thisintroductory analysis of darknet-enabledthreats against Southeast Asian countries,
which has been made possible throughstrong partnerships with global and regionallaw enforcement and justice authorities,
together with private industry and academia.
The report was produced thanks to kindvoluntary funding from the Government ofJapan.
This report assesses the Darkweb from user,
criminal and law enforcement perspectives
with a particular focus on cybercriminality
targeted at Southeast Asian countries.
Darknets (i.e. networks on the Darkweb)
provide the ideal environment for a wide
range of criminal activities. Just as new
threats appear on the Clearnet (i.e. the regularInternet), darknets can facilitate similar
attacks that provide perpetrators with agreater degree of anonymity. This anonymity
makes investigation and prevention morechallenging, but still possible.
There has been a consistent increase indarknet and Darkweb usage, both forlegitimate and illegitimate reasons, whilst
the COVID-19 pandemic also appears tohave given rise to darknet cybercrime,
including by criminals with no previous cyberexperience. Despite this, there is an overall
paucity of darknet criminality data specificto Southeast Asia. There is little prioritisationof darknet criminality in the region, either inpolicy or practice. This creates risk from thecriminality itself, which is compounded by thelimited political, policy and law enforcementi

response. There is an absolute need for aministerial lead on cyber affairs, in eachcountry, to ensure that law enforcers receivenecessary political support to undertake themost challenging operations.
Many criminal activities conducted overdarknets are predictable and preventable.
UNODC and its partners work hard toaddress these challenges by supporting andencouraging policy development, research,training and capacity building support inSoutheast Asia.
Awareness is fundamental for addressing
cybercrime. Given, however, the challenges
posed by darknets, stakeholders must
increase their commitment and cooperation
to developing policy, sharing intelligenceand enhancing international cooperation tocounter darknet crime nationally, regionallyand internationally.
This
UNODC
analysis
willinformpolicymakers in Southeast Asia, including
through the annual Senior Officials Meetingon Transnational Crime (SOMTC), as wellas supporting law enforcement and judicial
cooperation, and providing opportunities fordarknet-focused crime prevention.
Jeremy Douglas
Regional Representative,
Southeast Asia and the Pacific
Neil J. Walsh
Chief, Cybercrime and Anti-Money
Laundering Section

Darknet Cybercrime Threats to Southeast Asiaii

Darknet Cybercrime Threats to Southeast Asia

Contents
Forewordi

Acknowledgementsiv

Abbreviationsv

Executive summary

1

Key findings

3

Recommendations

4

Introduction
Aim
Methodology

555Darknets and the Darkweb
The Darkweb and cybercrime7
12

Darknets in Southeast Asia
Context
Success: a patchwork response?
Triaging the highest risk international offenders: live-streaming
Profit and loss
The impact of COVID-19

14
14
15
16
16
17

Darkweb structure and crime areas: a deeper diveA. Illicit marketplaces
B. Cryptocurrencies
C. Illicit products and services

18
18
20
24

Conclusion

33

Appendices
A1: Darknet use in Southeast Asian countries
A2: Darkweb technical analysis
A3: Technical analysis results

34
34
41
41

Glossary

45

References

52

iii

Darknet Cybercrime Threats to Southeast Asia

Acknowledgements
UNODC thanks the Governments of Southeast Asia – Brunei Darussalam, Cambodia, Indonesia, Lao
People’s Democratic Republic, Malaysia, Myanmar, the Philippines, Singapore, Thailand and Vietnam fortheir support throughout the development of this report. Preparation of this report would not have beenpossible without their assistance.
UNODC gratefully acknowledges the financial contribution of the Government of Japan which enabled
this research.
This study was conducted by the UNODC Global Program on Cybercrime through its regional component
based in the Regional Office for Southeast Asia and the Pacific (ROSEAP).

Supervision
Jeremy Douglas, Regional Representative, Southeast Asia and the Pacific.
Neil J. Walsh, Chief, Cybercrime and Anti-Money Laundering Section.

Core teamAlexandru Caciuloiu (coordination, analysis, review and drafting)
Pawinee (Ann) Parnitudom (data collection)
Mikko Niemelae, Joshua James (analysis and drafting)Juha Nurmi, (research and data)
Praphaphorn Tamarpirat (administrative and logistical support)
This report also benefited from the valuable input of many UNODC staff members and external experts andorganizations who reviewed or contributed to various sections of the report, including, Live Brenna, Kamola
Ibragimova and Himal Ojha.

iv

Darknet Cybercrime Threats to Southeast Asia

Abbreviations
APT

Advanced Persistent Threat

ASEAN

Association of Southeast Asian Nations

ATM

Automated Teller Machine

CaaS

Crime/Cybercrime-as-a-Service

CAPTCHA

Completely Automated Public Turing test totell Computers and Humans Apart

CSE

Child Sexual Exploitation

CSEM

Child Sexual Exploitation Material

DoS

Denial of Service

DDoS

Distributed Denial of Service

FATF

Financial Action Task Force

IP

Internet Protocol

IRC

Internet Relay Chat

MaaS

Malware-as-a-Service

NCMEC

National Center for Missing & ExploitedChildren

OCSE

Online Child Sexual Exploitation

PGP

Pretty Good Privacy

PoS

Point of Sale

RaaS

Ransomware-as-a-Service

SOMTC

Senior Officials Meeting on Transnational
Crime

Tor

The Onion Router

UNODC

United Nations Office on Drugs and Crime

12P

Invisible Internet Projectv

Darknet Cybercrime Threats to Southeast Asia

The Price of Crimeon the Darkweb

Ransomware
Trojans from

DDOS attack
from

$50
a day

$490

Hacking
website from

Stolen credit
card number
from

$150

$9

Password stealing
malware from

Stolen payment
data from

$150

$270

Targeted
attack from

Hacking email
from

$40

$490

Source: Positive Technologies https://www.ptsecurity.com/ww-en/analytics/darkweb-2018/vi

Darknet Cybercrime Threats to Southeast Asia

Executive summary
People from all Southeast Asian countries use
darknets, the most popular being The Onion
Router, more commonly referred to as Tor.
Although it is possible to provide a rough estimateof the number of darknet users in a country, it is
not feasible to precisely identify their reasons forusing darknets. Salient motivating factors appear
to be the protection of privacy and circumventing
online censorship in addition to those who commit
cybercrimes. Cybercriminal use of darknets
and the Darkweb (i.e. all the hosted content on
darknets) varies. For some it is a springboard tolaunch cyberattacks, for others it is a place toaccess illicit products and services, whilst forothers it is a place that provides legitimate privacy
and anonymity from corporations who are tracking
and using their personal data.

which drives a wide range of cyberattacks andcybercrime. It is this leaked data that often leads toattacks such as specific victim targeting, phishing,fake invoicing, credit card theft, impersonation andselling confidential documents.
The number of marketplaces in the Tor network
has increased from one in 2011 to 118 in 2019.
There has also been a large increase in the number
and variety of products for sale. For example,
the number of unique products available on the
popular Darkweb marketplace, Valhalla, increased
from 5,000 in 2015 to 13,000 in 2018.
Products available include drugs (including
cocaine, heroin, and opioids), firearms andammunition, hacking tools and services, and a wide
variety of other products. Some marketplaces also
specialize in the trade of payment card informationand counterfeit documents.

There is little evidence that countering darknetenabled cybercrime is a policy or operational priority
in the region. Consequently, there is an overall lackof consistent, quantitative, and qualitative data
upon which analyses can be drawn. This leads toa self-perpetuating cycle of policy gaps which limit
law enforcement threat-recognition, prioritization
and resource mobilization. Of greater concern, thiscreates opportunities for criminal exploitation withlittle recourse for victims.

The UNODC World Drug Report 2019 1 estimates thatpeople who purchased drugs over the Darkweb
doubled from 4.7 per cent in January 2014 to 10.7
per cent in January 2019. The purchase of drugs
over the Darkweb is still a recent phenomenon
with nearly half of those who reported buying
drugs over the Darkweb in 2019 stating they had
only started using this method of buying in thelast two years. Overall, however, the impact of the
Darkweb on the world drug problem is currently
low.

The Tor network is the largest darknet and contains
most sites. In mid-2020, there were approximately
200,000 onion services worldwide (servers inside
the Tor darknet). Just like servers on the Clearnet,
some of these servers host websites, whilst others
host file-sharing or email services. Some of these
are used for criminal purposes. At the same time,
cryptocurrencies and anonymous communication
applications have boosted the use of both darknets
and the Darkweb in general, whilst contributing to
the trade of illicit products and services.

User interfaces are becoming increasingly vendorfriendly, allowing, for instance, bulk ordering andcombining orders of different products into one
shipment. Vendors are also more aware of potential
takedowns of marketplaces by authorities, which
they counter by operating in multiple markets
simultaneously.
From 2015 to 2019, the amount of child sexual
exploitation material (CSEM) on Tor increased
from 170 unique CSEM websites to 776 websites. 2

Data breaches affecting the private informationof individuals, businesses and organizations havegrown significantly over the past two years. The
data is often sold or leaked on Darkweb sites,

1

Darknet Cybercrime Threats to Southeast Asia

New abuse material is posted constantly, whilst,
at the same time, previously published content isroutinely reposted. This makes it challenging toprovide reliable figures regarding the precise scaleof the threat and makes it exceptionally difficult forlaw enforcement to find and triage priority threats.
The risks posed to children and law enforcement
operational tradecraft from the Darkweb is high.
Abusers constantly discuss how to compromise
law enforcement investigations, how to minimise
their risk of detection and how to gain access to
new child victims to exploit and abuse.

terabytes of abuse material (the equivalent of 80
days’ worth of video or almost 1 million digital photos).
Overall, the volume of content on darknets andthe amount of people using them (especially Tor)is growing continuously. Although not all activities
on darknets are illicit, there is no doubt thatorganized criminals working within the Darkweb
are constantly developing their capabilities,
security mechanisms and business practices.

The Darkweb attracts CSEM websites because it
offers anonymity, as well as being resilient to online
censorship. It is challenging to take down this kindof illicit content as many CSEM sites replicate theircontent elsewhere.

Governments in Southeast Asia need to startinvesting the resources necessary to analyse andcounter Tor-enabled cybercrime while improving
operational capabilities across different darknets.
At the same time, the response should be carefully
calibrated to ensure the protection of human rights
and legitimate privacy rights.

In November 2019, the number of CSEM sites
probably represented 5 per cent of all Darkweb
websites3 but the COVID-19 lockdown is likely tohave increased the scale of such sites. Furthermore,
the amount of abuse material (mostly images andvideos) available today, represents a significant
amount of the overall data shared on the Darkweb,with some sites claiming they have amassed several

As darknets strengthen their levels of security,
gaining access and having a meaningful impact
has become more complicated and costly,
making it increasingly difficult to achieve progress
at a national level. Instead, working together
internationally and using highly trained experts
equipped with the latest skills and technology, has
proven to be a more effective solution.

Southeast Asia andthe Darkweb
Due to the nature of darknets and the Darkweb,
it is not easy to associate any particularcriminal action with users in Southeast
Asia – the location of criminals often only
becomes clear just prior to the point of arrest.
There is, however, consistent evidence ofSoutheast Asian victims on the Darkweb. It
is vital that Southeast Asian countries scaleup their policy, law enforcement and judicial
capabilities to counter darknet criminality.

2

Darknet Cybercrime Threats to Southeast Asia

Key findings
THERE IS A PAUCITY OF RELIABLE DATA REGARDING DARKNETENABLED CRIME IN SOUTHEAST ASIA
There is little evidence that countering darknet-enabled cybercrime is a policy or operational
priority in the region. Consequently, there is an overall lack of consistent, quantitative andqualitative data upon which analyses can be drawn. This leads to a self-perpetuating cycleof policy gaps which limit law enforcement threat-recognition, prioritization and resource
mobilization. Of greater concern, this creates opportunities for criminal exploitation with little
recourse for victims.

DARKNET CYBERCRIME IS BELIEVED TO BE INCREASING IN
SOUTHEAST ASIA
An increasing number of criminals in Southeast Asia are likely to be using the Tor darknet toengage in the full range of illicit activities available on the Darkweb. This includes the buying andselling of drugs, cybercrime toolkits, fake passports, fake currency, online child sexual exploitationmaterial, stolen credit card details and personally identifiable information from breaches.

SOUTHEAST ASIAN LANGUAGES AND DIALECTS ON THE DARKWEBVARY OVER TIME
English is the primary working language for cybercrime on the Darkweb, although locally originatedcontent in Southeast Asian languages is becoming a variable. There is, therefore, a customer
base. And while this suggests a diversified cybercrime threat, it also creates the opportunity for
proportionate, legal, accountable and necessary law enforcement infiltration and prevention
activities that will require clear and robust legislative and human rights oversight frameworks.

CRYPTOCURRENCIES ARE THE PAYMENT METHOD OF CHOICE
Cryptocurrencies are the leading payment method on darknets. Cryptocurrencies and related
laundering services are evolving as criminals seek to move towards more privacy-preserving
currencies. Bitcoin remains the primary tool to exchange crypto to fiat (currency issued by acountry). This presents policy, legislative and investigative opportunities. States are encouraged
to engage with UNODC, the Financial Action Task Force (FATF) and industry to counter the threat
posed by virtual-asset-based illicit financial flows and money laundering.

MOST LAW ENFORCEMENT DARKWEB OPERATIONS ORIGINATE
INTERNATIONALLY. LOCAL CAPABILITY IS LIMITED
Although there have been law enforcement operations targeting darknet cybercrime in Southeast
Asia, these operations are the result of international investigations initiated outside of the region,
with only a small number of cases originating within the region itself. Cybercriminals are likely
to perceive Southeast Asia as a relatively low-risk/high-gain operational environment as thelikelihood of detection is relatively low. Prevention campaigns can have an impact.

3

Darknet Cybercrime Threats to Southeast Asia

Recommendations
STATES SHOULD INCREASE SPECIALIST DARKNET POLICY AND
OPERATIONAL CAPACITY
Each Southeast Asian country must increase specialist political, policy and operational
knowledge regarding darknet networks, services, cryptocurrency investigations and intelligencegathering. This will increase national security, international cooperation and confidence building
in preventive cyber-diplomacy.

A MINISTERIAL OR AMBASSADORIAL LEAD ON CYBER AFFAIRS,SUPPORTED BY SPECIALIZED LAW ENFORCEMENT CAPACITY, IS
ESSENTIAL
Law enforcement darknet operations require highly trained and specialized officers. These
officers must have a strong understanding of law, the Internet, human rights, privacy,
communication technologies, cryptocurrencies, encryption and anonymizing techniques,
including specialist investigative skills. Beyond the tactical capability, a Ministerial or Cyber
Ambassadorial lead is required on all cyber affairs. This ensures cross-government policy
coherence and the necessary mechanism for law enforcers to seek political oversight, challenge
or support, for new methods of operating.

STATES SHOULD DISRUPT ASSOCIATED ILLICIT PARCEL DELIVERYAND TAKE A PROACTIVE MEDIA APPROACH
Darknet markets result in the sale of physical goods, such as drugs and weapons. Increasing
local capacity and cross-border cooperation for detecting illicit parcels will disrupt the flow ofillegal goods, as well as psychologically undermining the reputation of market sellers.

APPLY CRYPTOCURRENCY (VIRTUAL ASSET) POLICY AND REGULATIONS
The regulation of cryptocurrency users and exchanges, especially employing the FATF virtual assets
risk-based approach guidelines, will significantly assist in reducing the anonymous transfer of funds.

CREATE A REGIONAL COUNTER-DARKNET CYBERCRIME STRATEGY
A plan and a regional strategy should be created for cooperation and response in conjunction
with ASEAN Senior Officials Meeting on Transnational Crime (SOMTC) and other stakeholders.

CONTINUE RESEARCH
Cultivate local capabilities within the public, private and academic sectors to encouragecontinued research on darknet technologies, policies and investigation techniques which areproportionate, legal, accountable and necessary within a broad Human Rights framework.

4

Darknet Cybercrime Threats to Southeast Asia

Introduction
Cybercrime is an evolving form of transnational crime. The complex nature of
the crime, as one that takes place in the borderless realm of cyberspace (whereperpetrators and their victims can be in different regions), is compounded by theincreasing involvement of organized crime groups. The effects of cybercrime canripple through societies around the world, highlighting the need to mount an urgent,
dynamic and international response.
Increasingly, criminals have adopted the use of darknets to help anonymise theiractivities. When illicit content and services are hosted on the Darkweb, it makes
investigations more complicated. Darknets are also used as an anonymizing bridgefrom which traditional cyberattacks can be launched.
There are, of course, legitimate uses for darknets. Many users see aggressive
advertising and data collection practices by public and private organizations
as an invasion of their privacy. In these cases, darknets are used to reduce theprivacy concerns of law-abiding users. As a result, several popular web browsers
now include darknet routing (usually Tor) as a privacy feature. Darknets have also
become a convenient tool to protect the privacy of law enforcement during online
investigations.
Much like the Internet itself, darknets are used for both good and bad. The maindifference between the Clearnet and the Darkweb is that censorship and attribution
is intentionally difficult in the latter.
This report seeks to understand the threat of cybercrime using darknets, and more
specifically, how this is affecting Southeast Asian countries.

Aim
The purpose of this assessment is to evaluate the darknet threats that exist within the
cybercrime landscape of Southeast Asian countries. The findings of this assessment
create avenues for policy change, action, and recommendations. Data collection
occurred in 2019 and early 2020.

Methodology
This analysis included a desk review of Southeast Asian cybersecurity strategies,
plans, policies, frameworks and programs. A survey of state representatives,
conducted during working group sessions on cybercrime, was also conducted.
Detailed technical analysis and criminal forum examples are included in the
appendices of this report.

5

CLEARNET
The publicly-accessible
Internet that is easily
accessed with a normal
Internet connection anda browser.
Examples of content:
Google, Facebook, YouTube,
Wikipedia, Netflix.

DEEP WEB
The publicly-accessible
Internet that is unknown
to search engines, such as
encrypted or unindexedwebsites, private databases,
and other unlinked content.
Examples of content:
Academic databases,
medical records,
financial records, legal
documentation, government
information, library access,bank accounts.

DARKWEB
A collection of websites that exist
on darknets. These are not directly
accessible from the Clearnet and often
require special software to accesssuch websites. Websites use hidden IP
addresses which are hosted on securely
encrypted networks for increased
anonymity.
Examples of content: Tor encryptedwebsites, whistleblowing platforms, ultrasecure email services, darknet markets.

Darknet Cybercrime Threats to Southeast Asia

Darknets and the Darkweb
The Darkweb is the part of the World Wide Web
which cannot be accessed using standard webbrowsers like Internet Explorer, Firefox, Edge or
Chrome. This is because websites on the Darkweb
operate inside specialized encrypted networks toprovide anonymity.

The most popular networks that enable Darkweb
publishing are the Tor and I2P networks.4,5,6 Other
smaller networks (such as Freenet, GNUnet andmany others) have significantly less users.7 As an
indication of how many darknets there are, Wikipedia
lists 22 anonymous file-sharing networks.8 Analysis
in this assessment focuses on Tor as, at the timeof writing, it is currently the most popular darknet
system. Other anonymous networks generate too
little data for a separate analysis.

On the Clearnet (areas of the Internet accessible
to the public without any additional software), it ispossible to identify and track users. The Darkweb,
on the other hand, is designed to prevent tracking.
Access is possible through easily accessible,
free software which connects computers over a
distributed network (a darknet). By routing traffic
between computers on darknets, the user’s
identity is hidden.

The Tor network provides anonymity for Internet
users and online services. “Onion services” areInternet services, such as websites, email andfile sharing, that are only available through the
Tor network. The Tor network conceals the realIP address (and implicitly the location) of theserver. 9,10,11

Once connected to a darknet, a device can “talk”
to other devices that are also connected to thesame darknet. Darknets often host “darknetexclusive” content and it is this hosted content
which makes up what is known as “the Darkweb”.
Like the Clearnet, the Darkweb hosts thousandsof web pages – but they are only accessible whenconnected to a darknet.

Tor started in 1996 when the design of Onion
Routing was published to provide anonymity
for communication systems.12 In 2004, the final
technical implementation of the routing network
was ready. Syverson, Dingledine, and Mathewson
published their article Tor: The Second-Generation
Onion Router, along with the source code of
The Onion Router (Tor).13 From then on, the Tor
network started to provide online anonymity toInternet applications.

Over the last two decades there have been several
popular darknets, which operate as peer-to-peer
networks:• 2000: Freenet: a data storage software forfile-sharing and communication.
• 2001: GNUnet: a software for file-sharing.
• 2002: Tor: a software for anonymous
communication.
• 2003: WASTE: a software for file-sharing
and instant messaging.
• 2003: I2P: a software for anonymous
communication.
• 2004: Onion services: Tor implemented
functionality to publish anonymous
websites.
• 2006: RetroShare: an anonymous chatforum and file-sharing software.
• 2011: The first Darkweb market, Silk Road,
appears in the Tor network.

Tor allows the publishing of anonymous Internet
services. Onion services have onion addresses(*.onion) and these are only accessible fromwithin the Tor network. For example, https://
facebookcorewwwi.onion is a valid onion address
for Facebook and can be accessed using the
Tor Browser.
To enable safe, anonymous web browsing, the
Tor Project developed the Tor Browser, their mainprivacy-aware application, which is available on
the Tor Project website.14 The Tor Browser is aseasy to use as a standard web browser. It is simply
a modified Mozilla Firefox Extended Support
Release (ESR) browser with security best-practicedefault settings and extensions.

7

Darknet Cybercrime Threats to Southeast Asia

Circumventing internet censorshipusing a proxy server
Censorship circumvention: the practice of bypassing Internet censorship techniques to access blocked
information or services.
Access to internet or specificsites blocked or filteredUSER

PROXY SERVER

A proxy server acts as a gateway, usuallymasking the originating IP address

The Tor Browser routes all web traffic through the Tor network,
removing most fingerprinting methods (local privacy-sensitive
data, such as browsing history, cache, and cookies) in the process.
Tor also enables anonymous web publishing for so-called “hidden
services” which can only be accessed using the Tor Browser. Withhidden IP addresses, both users and those publishing websites
have improved anonymity and, to further avoid detection,
many sites only stay online for short periods. This makes bothproactive and reactive law enforcement operations exceptionallychallenging.
The number of known onion websites on the Darkweb has grownfrom a couple of hundred in 2012 to over 100,000 in 2020. During
the first six months of 2020, there were 110,865 onion websites
available.15 One reason for this growth has to do with some sites
dividing their content over thousands of sub-websites, each undera different domain. This is a common practice with websitesthat are sharing video material, with some sites even providing
a unique domain for each video. The reason for this is so thatthe content can be accessed faster by using several parallel Tor
network circuits. Every onion domain has its own Tor network
circuit which is usually what causes traffic bottlenecks. By having
numerous sub-websites and domains, users can increase speedsby spreading out the content. It also makes lawful intercept andtechnical intelligence gathering exceptionally difficult, even for themost capable intelligence agencies.

8

Darknet Cybercrime Threats to Southeast Asia

How Tor works
With the Tor browser, Internet traffic is routed through a series of different volunteer computers (called ‘relays’or ‘nodes’) and each node is only aware of the preceding and following nodes in the network. The data isalso encrypted multiple times (like the layers of an onion) and the route is randomly selected and constantly
changing. This ensures that the original user’s IP address and location stays hidden.

USER

TOR
NODE

TOR
NODE

TOR
NODE

TOR
NODE

TOR
NODE

TOR
NODE

TOR
NODE

TOR
NODE

TOR
NODE

SERVER(ie ‛onion‘ websites)

How Tor hidden services work
Tor can also provide anonymity to websites and other servers. Servers configured to receive inboundconnections only through Tor are called ‘hidden services’. Rather than revealing a server’s IP address(and network location), a hidden service is accessed through its onion address. The Tor network canroute data to and from hidden services while preserving the anonymity of both parties.

USER

TOR
NODE

TOR
NODE

INTRO.
POINT

TOR
NODE

TOR
NODE

INTRO.
POINT

TOR
NODE

INTRO.
POINT

RENDEZVOUSPOINTSERVER(ie ‛onion‘ websites)

An ‘Introduction Point’ sends a message to the server saying that someone wants to connect. The server then creates a circuit (via other
Tor nodes) to a ‘Rendezvous Point’. Communication between the Introduction Point and the Rendezvous Point is end-to-end encrypted(using public and private keys) therefore protecting the anonymity of both parties.

9

Darknet Cybercrime Threats to Southeast Asia

Figure 1. The number of websites available in the Tor network.*
200,000

150,000

100,000

50,0000

2016

Lorem ipsum

2018

2020

The Tor Project - https://metrics.torproject.org/*Many sites stay online for only a short period. Measurement only calculates websites which were reachable in the given time.

Traffic to onion services has also multiplied since 2015 and continues to grow.16 This means that more andmore content is being uploaded and downloaded from onion websites.

Figure 2. Traffic to onion services (Gbit/s).
4 Gbit/s

3 Gbit/s

2 Gbit/s

1 Gbit/s

0 Gbit/s
2016

2018

2020

The Tor Project - https://metrics.torproject.org/

Many users in the Tor network voluntarily install Tor software in “routing mode” which enables their computers
to receive and pass along traffic on the Tor network. These computer servers are commonly called Tor routers,
relays or nodes. In 2019, there were approximately 7,000 Tor relays around the world and 2.5 million Tor users.17
As counter-cybercrime legislation, prosecution and international cooperation often rely upon geographic
jurisdiction, it is clear that counter-darknet cybercrime operations are exceptionally challenging.

10

Darknet Cybercrime Threats to Southeast Asia

Figure 3. The total Tor network bandwidth is 400 Gbit/s.
600 Gbit/s

400 Gbit/s

200 Gbit/s

0 Gbit/s
2009

2011

Advertised bandwidth

2013

2015

2017

Bandwidth history

2019

2021

The Tor Project - https://metrics.torproject.org/

The total bandwidth of the Tor network has increased significantly over the last decade. In 2010, there wasclose to zero Gbit/s traffic in the Tor network, but this had increased to 400 Gbit/s by 201918 (the equivalentof streaming 100 HD Netflix movies per second). This increase in bandwidth demonstrates the increased useof Tor. In Figure 3, the ‘advertised bandwidth’ is the total amount of bandwidth available in the Tor network
between nodes, while ‘the bandwidth history’ is the amount of bandwidth actually used in the Tor network.

Figure 4. Most popular languages used on the Tor network in 2019.

EnglishLess than 1%
1%

72%

2%

Russian
SpanishEstonian

1.5%

GermanFrenchItalianFinnishOther

22%

Although many users of the Tor network have developed communities in their native languages, the mostcommonly used language is English (approximately 70 per cent). One reason given for the use of English(even when it is not the user’s native language) is that it provides an added layer of anonymity. Administratorsof darknet markets or other forums on the Darkweb will often warn users not to use other languages (andrefrain from using localised slang) as a method of anti-surveillance (local dialects may assist law enforcementwith pinpointing the location or origin of the users).

11

Darknet Cybercrime Threats to Southeast Asia

The Darkweb and cybercrime

As criminals increasingly use the Darkweb, it has
rapidly become one of the most discussed topics at
law enforcement and criminal justice conferences.
This unprecedented interest has prompted law
enforcement to create mechanisms and processes
to investigate criminality that occurs on the Darkweb.
There is, however, limited, consistent engagementin Southeast Asia which, consequently, reduces
international cooperation and increases cybercrime
opportunities in the region.

Public interest in the Darkweb has increased
over the years.19 The anonymity ecosystem has
evolved from being a communication channel
for privacy actors to a global marketplace with alarge variety of products and services available
for purchase. 20 The Darkweb also serves as aplatform for a large number of discussion forums
covering a broad range of topics. These forums are
sometimes structured by nationality and language,or to specific crime typologies such as credit card
crime, insider trading, drug trafficking, weaponstrafficking, Crime-as-a-Service (CaaS) and anti or
counter-surveillance of online investigators. 21

An upsurge in the number of Google searches forthe Darkweb illustrates the increased interest in
the topic amongst members of the public.

Figure 5. Number of Google searches about the Darkweb(Jan 2012 to July 2020).*
100

75

50

25

20
12
20 04
12
20 09
13
20 02
13
20 07
13
20 12
14
20 05
14
20 10
15
20 03
15
20 08
16
20 01
16
20 06
16
20 11
17
20 04
17
20 09
18
20 02
18
20 07
18
20 12
19
20 05
19
20 10
20
-0
3

0

*Data from Google Trends service. The numbers represent the search interest relative to the highest point on the chart for Southeast
Asia over time. A value of 100 is the peak popularity of the term, whilst a value of 50 means that the term is half as popular.

The growing trend of Darkweb-related crime has not gone unnoticed by the media. As a result, more frequent
reporting in the news is seen from 2014 onwards.

12

Darknet Cybercrime Threats to Southeast Asia

Figure 6. Number of news articles in Southeast Asia mentioning the Darkweb(Jan 2014 to July 2020).
100

75

50

25

20
12
20 04
12
20 09
13
20 02
13
20 07
13
20 12
14
20 05
14
-1
0
20
15
20 03
15
20 08
16
20 01
16
20 06
16
20 11
17
20 04
17
20 09
18
20 02
18
20 07
18
20 12
19
20 05
19
20 10
20
-0
3

0

The number of published academic articles about the Darkweb has tripled since 2015 (Figure 7). Many
scientific articles analyse the content of the Darkweb and how anonymity tools are used. Academic literaturein 2019/20 included information disclosure and data breaches available on the Darkweb and is likely toaddress the impact of COVID-19 in 2020/21. These publications analyse data from Darkweb markets,
discussion forums, and information-leaking platforms (known as “paste sites”).

Figure 7. Number of published scientific articles about the
Darkweb and darknets.
90

67.5

45

22.5

0

2011

2012

2013

2014

2015

2016

2017

2018

2019

2020

Publications (total)

The popularity of darknets (especially Tor) is increasing worldwide. However, as we will see in the next
section, users in Southeast Asia appear to comprise only a moderate proportion of the overall number.

13

Darknet Cybercrime Threats to Southeast Asia

Darknets in Southeast Asia
Context
In Southeast Asia, the general public have mainly heard about the Darkweb on the news and throughsocial media. It is assessed that only a minority have used it personally (see A1: Darknet use in Southeast
Asian countries in Appendices). Even on the news, the Darkweb is generally not discussed in any great
detail, with most stories relating to the arrest of cybercriminals who have used the Darkweb in some way.
Darkweb-related arrests in Southeast Asia have helped focus attention on how transnational organizedcrime groups and syndicates operate in the region. Illegal transactions are typically cross-border,emphasizing the need for international cooperation, interoperability, and a mutual understanding of
the threat. To help detect, investigate, prosecute and prevent this type of cybercrime, capacity building
in law enforcement is vital.
Criminals seek to remain anonymous by hiding their operations and identity using technical methods
such as encryption, and non-technical means such as communicating in English instead of their native
tongue. Based on their communication alone, it is challenging to identify the whereabouts of specificperpetrators as many of the largest Darkweb marketplaces offer services and products worldwide. As
illustrated in Figure 8, the use of some Southeast Asian languages is becoming less common. There arecases when sites target more specific markets (see Figure 9 showing a Vietnamese forum on the Tor
darknet) but this appears to be rare.

Encryption
Encryption: the process of encoding information into an alternative form that can only be ‛decrypted‘ byauthorised individuals that possess the decryption key.

PLAIN

ENCRYPTEDSENDER

PLAIN
RECIPIENT

Different keys are used to encryptand decrypt messages.

14

Darknet Cybercrime Threats to Southeast Asia

Figure 8. Indonesian, Thai, Tagalog and Vietnamese languages found on
Darkweb sites (2016-2019).
14000
12000
10000
8000
6000
4000
2000
0

2016

Lorem ipsum
2017Indonesian

Tagalog

Figure 9. Vietnamese Darknet forum.

2018
Vietnamese

2019
Thai

This requires, in the first instance, a policy
decision, across government, to counter Darkweb
cybercrime (irrespective of the state of readinessfor online operations in the country).
It is technically challenging to associate
the Darkweb with specific jurisdictions andgeographical boundaries. It sometimes takes theinvestigation and prosecution of specific cases to
identify which countries the criminals are operatingfrom. An example of this in Southeast Asia, involved
the arrest of a Canadian citizen residing in Thailand
who was running a marketplace called AlphaBay,
which was the largest market on the Darkweb in2017.

Success: a patchwork
response?

The international operation to seize AlphaBay’s
infrastructure involved cooperation by law
enforcement authorities in Thailand, the UnitedStates, Netherlands, Lithuania, Canada, the United
Kingdom and France, as well as the European
law enforcement agency, Europol. 22 Another casehighlights the nature of cross-border transactions.
Cross-border transactions involve global supply
chains such as one that originated in India, where
criminals manufactured illegal drugs for shipping
via a criminal associate in Singapore. From there,
the parcels continued their journey to the US
and UK. 23 Both of these cases demonstrate theabsolute need for skilled, empowered criminal
justice officers and a swift, intuitive international
cooperation system.

Although criminals on the Darkweb try theirbest to obfuscate their actions, successful
law enforcement targeting has occurred. This
success is due to joint efforts from multiple
law enforcement agencies around the world.
As investigative capabilities improve, so will
successful operational outcomes. Identifying
individual actors or marketplaces is made possible
by analysing information from multiple sources.
It is therefore vital that Southeast Asian nations
continue to cooperate with their internationalcounterparts to build actionable intelligence, plan
coordinated actions, and seek to achieve strategic
outcomes against the highest-risk cybercriminals.

15

Darknet Cybercrime Threats to Southeast Asia

Triaging the highest riskinternational offenders: livestreaming

These offences, and offenders, reveal the clearand-present danger from live-stream child sex
offenders. This is why it is essential for all countries
to have a ministerial policy lead on cyber affairs
who can command the resources necessary tokeep the most vulnerable in society safe.

Streaming technologies further complicate
matters. Darkweb live-streaming allows thetransmission of video, audio and other media toallow cybercriminals to reach markets far fromtheir home-location in real-time. For example,
Australian citizen Peter Gerard Scully, was runninga live-streaming service from the Philippines
marketed at European and US child sex abusers.
Scully was arrested in the Philippines in 2015
after sexually abusing several children, including
an 18-month-old infant. 24 The investigation led
to the identification of an international childsexual exploitation group which reportedly raped,
tortured, murdered and broadcast the abuse of
their child victims on the Darkweb to customers
around the world for up to US$10,000 per view. 25
UNODC has mentored similar investigations in
multiple jurisdictions and acknowledges that thescale and quantity of the offences makes them
exceptionally difficult to prosecute.

Profit and loss
Cybercriminals, like traditional criminals, areprincipally motivated by profit. Cybercriminals
trade both personally identifiable and financial
information stolen from individuals and businesses
on Darkweb forums and marketplaces. Criminals
use stolen credentials (such as usernames andpasswords) to access online services and thenexploit the victim’s personal information for fraud.
As credentials are often reused unwittingly, one
compromised password may lead to criminals
gaining access to other more impactive services
like PayPal (PayPal accounts are often for sale on
the Darkweb – see Figure 10).

Figure 10. Stolen PayPal accountcredentials on the Darkweb.*

Similarly, in 2018, law enforcement officers arrested
nine people in Thailand, Australia and the US.
The operation safe-guarded 50 children afterinvestigators took down a subscription-based CSEM
Darkweb website with 63,000 worldwide users.26
It is clear that international cooperation isabsolutely vital to saving victims, identifying
offenders and preventing further harm.
Despite strong cooperation bilaterally andmultilaterally, especially through INTERPOL
channels, some criminals can conceal theiroffences and identities for extended periods oftime. From 2006 to 2014, Richard Huckle abused
up to 200 Malaysian children and shared imagesof his crimes on the Darkweb. 27 The UK’s National
Crime Agency arrested Huckle after receiving
intelligence from Queensland Police’s Task Force
Argos child protection unit. He was convicted on
71 counts of offences against children between theages of six months and 12 years and received 22
life sentences. 28*The cybercriminals selling these stolen credentials to PayPal
accounts are not stealing the funds from the account. Instead,they sell the access to other criminals, i.e. a “Cybercrime-asa-Service”.

A Russian national was arrested in Thailand in
2018 for operating a Darkweb marketplace, theInfraud Organization, selling stolen credit card
information and hardware for compromising ATMs.
The market had 11,000 members who traded more

16

Darknet Cybercrime Threats to Southeast Asia

Many criminal activities continued at paceduring global lockdowns. Personal information
continued to be leaked and sold on the Darkweb.
In 2020, 230,000 Indonesian COVID-19 patient
records were exposed.32 Other cyberattacks haveincreased, especially ransomware attacks, as moreorganizations are working remotely. Data collectedfrom victims has been found posted on Russian andEnglish-speaking Darkweb forums.33 Online fraud,credit card theft and phishing attacks continue.
Some cases, such as phishing, have increased andadopted COVID-19 themes. For example, Microsoft
identified COVID-19 themed emails containing
a malicious Excel spreadsheet. When opened,
these spreadsheets would download softwarethat would give an attacker remote access to a
victim’s computer.34 This can facilitate traditional
criminality, advanced persistent threat attacks andhostile state behaviour.

than 4.3 million credit cards, debit cards and bankaccounts worldwide. This resulted in the loss ofmore than US$530 million for legitimate users andbusinesses. 29 The impact of a half-billion dollar loss
is clear at the best of times, but during the greatest
global economic recession in 50 years, the impact
from such crime on economic prosperity, on
recovery and on lives is truly phenomenal.
These examples show that criminals are operatingon the Darkweb in SEA and against Southeast
Asian targets. A coherent, international law
enforcement response, supported by routine
public awareness, under ministerial control in eachcountry, is essential.

The impact of COVID-19
COVID-19 has had an impact on both criminal
activity and Internet usage in general. Whilst thedata collection for this report concluded before thecrisis, it is salient to note that, in Southeast Asia,
Tor usage increased by approximately 20,000
users from February 2020. 30 The motivation for thisis unclear.

Online Child Sexual Exploitation (OCSE) also rose
during the pandemic with law enforcement inThailand calling for more resources and training
in investigating Darkweb and cryptocurrencyfacilitated OCSE. 35 Furthermore, the U.S.
National Center for Missing & Exploited Children(NCMEC) recorded a 106% increase in reportsof suspected Clearnet child sexual exploitationmaterial – rising from 983,734 reports in March
2019 to 2,027,520 in May 2020. 36 Much of theabuse content that is generated ends up being
traded and sold on the Darkweb.

Criminal behaviour on the Darkweb alsochanged. Darkweb forums normally dedicated tonarcotics have begun offering COVID-19-related
merchandise. These include fraudulent COVID-19
vaccines, hydroxychloroquine, and personal
protective equipment (see Figure 11). The AustralianInstitute of Criminology further assesses that 60%
of Darkweb markets listed at least one COVID-19
related product.31

Despite this, some organized cybercrime groups arebeing negatively affected by lockdown. According
to Chainalysis, a blockchain analysis company,
there has been a 33% decline in the volume of
cryptocurrency scams since the commencementof lockdown.37

Figure 11. Website selling COVID-19related merchandise.

It is clear that COVID-related criminality, on the
Darkweb and beyond, has only just begun. States,
especially in Southeast Asia, must heed the callto plan and prepare, under a ministerial lead forcyber affairs, for an increase in darknet criminality.
Now is not the time to de-invest in complex crime
investigation, but to increase resources, operational
posture and international cooperation. That iswhat the public demands and requires.

17

Darknet Cybercrime Threats to Southeast Asia

Darkweb structure and crime areas:a deeper diveThis section of the report provides detail andexamples of specific darknet markets and how theassociated cybercrime works.

The number of active marketplaces on the Darkweb
has grown from one (Silk Road) in 2011 to 118 in
2019. These markets are competing against eachother, and the majority of users will only use themost popular market since a popular market is lesslikely to be a scam. With the dominance of theselarge marketplaces, many of the smaller markets
are not gaining new customers.

A. Illicit marketplaces
As a consequence of the increasing use ofanonymization
technology,
illicitdarknetmarketplaces have become more accessible andpopular. 38 After Bitcoin was introduced in 2009,it was quickly adopted as a payment method in
dark markets. Most notably, in 2011, the Silk Road
market, an onion website providing a platform forbuying and selling illegal products (mostly drugs),
began to operate inside the Tor network using
Bitcoin as its primary payment method (although
today the use of privacy coins, such as Moneroand Ethereum is increasing39). Silk Road was thefirst time these technologies were combined toenable an online market for illegal products togrow significantly.

Figure 12. Empire Market – one of
the largest online markets for illegal
products & services.

These marketplaces have not invented newtechnologies but rather combined various
innovations that drive new benefits for both sellers
and buyers. Cryptocurrencies, due to their broad
anonymity, have become the means for financing
cybercrime on the Darkweb.

Figure 13. The number of active illicit markets on the Darkweb.
160
140
120
100
80
60
40
20
0

2015

2016

2017

18

2018

2019

Darknet Cybercrime Threats to Southeast Asia

Illicit markets are anonymous, but the trade itself isoften visible. There are few access restrictions andtherefore, in theory, anyone can access these onion
sites and browse the products. As a result, law
enforcement personnel monitor illegal activities
using web crawling (the automated process ofvisiting websites and saving the content) anddata scraping technologies (extracting relevant
information from the content for data analysis).
Silk Road was an ideal place to start this morein-depth research on how online communication
technologies transform crime.40 By web crawling it
is possible to monitor some of the criminal online
activity in real-time. As a result, several academic
scholars have published research regarding
different aspects of the illegal drug trade.41,42,43

Marketplaces, in general, have feedback andreputation systems to distinguish between
allegedly reputable sellers and buyers basedon feedback from previous transactions. With
both buying and selling, however, it is difficult
to determine the veracity of the feedback as
all parties are essentially anonymous.46 This,
however, allows investigators to track sellers
over time, across markets, as they need tomaintain their username and reputation acrossall platforms. Law enforcement is getting betterat taking down darknet markets, but that does
not necessarily translate into fewer users/sellers.
When a market is taken down, sellers and buyers
usually transition to the next largest market.
Sellers have even been observed operating
under the same username as they move to othermarketplaces; for example, starting on Silk Road,
then moving to AlphaBay, and then onto more
recent iterations. This shows that disruption does
not necessarily solve the problem.

These marketplaces operate like normal
e-commerce websites except that it is usuallyillicit goods and services that are being bought
and sold.44,45

How darknet markets work
Buyer exchanges
currency for Bitcoin (orany other cryptocurrency
accepted by market)

Vendor exchanges
Bitcoin for
currency

EXCHANGEREXCHANGER

Vendor moves
Bitcoin frommarket’s account

Buyer transfers Bitcoin
to market’s accountVendor is paid

Buyer makes purchase
BUYER

Note: Crypto-mixers(or ‘tumblers’) are often used intransactions for added anonymity
and PGP (encryption program) tosecure communications between
buyers and vendors.

Bitcoin held in market’s
escrow account until
order finalized

VENDOR

Market takes
commission

Source: Adapted from evidence entered into the record of Ross Ulbricht‘s federal
trial in the U.S. Southern District Court of New York, depicting a flowchart of Silk
Road‘s payment system, as envisioned by the U.S. Government.

19

Darknet Cybercrime Threats to Southeast Asia

Essential elements of darknet
markets

The feedback given regarding the transaction isimportant to the seller as future buyers are more
likely to select trusted sellers that have received
positive feedback. Vendors who build a good
reputation, for providing a high-quality service
are able to make a name for themselves andthen operate within different markets using thesame name.

An anonymous marketplace or darknet market
needs four components to operate:
1. An anonymous, censor-resistant platform tooperate from, e.g. an onion website.
2. An online (semi-) anonymous monetarysystem, i.e. Bitcoin.
3. An escrow payment system (internal escrowaccounting).
4. Reputation and feedback (transparent
reputation metric).

B. Cryptocurrencies

With features like escrow payment systems andreputation/feedback metrics, the likelihood thatbuyers will receive the products they purchased(and valid product information) has increased.
Many sellers attempt to provide accurate productinformation, and the accumulating feedback
verifies the seller’s claims.48,49

After Bitcoin (the first cryptocurrency) was
introduced in 2009, it was quickly adopted as apayment method in the dark markets. Regardlessof how anonymous people believe Bitcoin tobe, transactions do leave a trail in the Bitcoin
blockchain. A blockchain is a public transaction
record which shows all the transactions between
Bitcoin wallets. Most online Bitcoin exchanges
have begun to require proof of identity before
one can purchase bitcoins, meaning the identityof the purchaser and where the bitcoins are sent
is traceable by default. As a result, there are now
services available to hide any digital trail involving
illegal transactions. These are commonly called
crypto-mixers, tumblers or laundry services.

Once the transaction has taken place online, avendor can ship worldwide through any number ofmailing services. When it comes to buying drugs,
online trade is considered safer than buying on
the street where there is the risk of violence androbbery.50,51 No physical contact with the seller
is needed, and it is easier to obtain accurate
information about the substance.52,53

These services work by mixing incoming bitcoins
into a pool with other random bitcoins held inreserve and then outputting other bitcoins whichhave no connection to the incoming bitcoins. This
mixing breaks the link between the initial purchaseof the bitcoins and the payment destination thus
making it harder to bring an offender to justice by“following the money”.

The buyer will usually purchase some virtual
currency (often Bitcoin), create an account withthe marketplace, transfer the bitcoins to the walletof their account, and then select a product to buy.
If the selected item is a physical product, such asa fake passport or an illegal drug, then the buyer
provides shipment information to the seller. The
escrow system locks the sum of the payment
from the buyer’s wallet. Next, the seller sends the
product, and the buyer gives the public (positiveor negative) feedback to the seller. Following that
action, the escrow system transfers the payment
to the seller.

Additional anonymity is provided by using a socalled “double mixer”. This two-stage mixing
process, executed within a web browser, adds
another level of anonymity because neither mixer
knows both the source and the destination of yourbitcoins. The site facilitates the mixing process but
does not learn the used addresses. However, if
one of the mixers is insecure or hacked, there is achance that anonymity may be lost. A further risk isthat the mixers used in the process can potentiallysteal the bitcoins.

When these four technologies are combined andused concurrently, the darknet market can operate
efficiently. Without one of these components, themarket will cease to operate.47

20

Darknet Cybercrime Threats to Southeast Asia

Cryptocurrencies•

Cryptocurrencies face criticism for a numberof reasons, i.e. their use for illegal activities,
exchange rate volatility, and vulnerabilitiesof the infrastructure underlying them.
However, they are also praised for theirportability, divisibility, inflation resistance,
and transparency.

•

The first blockchain-based cryptocurrency
was Bitcoin which still remains the mostpopular and most valuable. As of November
2019, there were over 18 million bitcoins
in circulation with a total market value ofaround US$146 billion.

•

Today, the aggregate value of all thecryptocurrencies in existence is around
US$214 billion—Bitcoin currently represents
more than 68% of the total value.

Fast facts•••

A cryptocurrency is a form of virtual asset
based on a network that is distributed
across a large number of computers. This
decentralised structure allows them to exist
outside the control of governments andcentral authorities.
Some of the cryptography used in
cryptocurrency today was originallydeveloped for military applications. At one
point, governments wanted to put controls
on cryptography, but the right for civilians to
use it was secured on grounds of freedom ofspeech.
‘Blockchains’(organizational
methods
for ensuring the integrity of transactionaldata) are an essential component of many
cryptocurrencies. Many experts believethat blockchain and related technology
will disrupt many industries in the future,including finance and law.

Source: www.investopedia.com (Cryptocurrency)

Crypto-mixers
Crypto-mixers: services that take in identifiable cryptocurrency tokens from one wallet and output
unidentifiable ‛clean’ tokens to a different wallet (or wallets). Crypto-mixing is similar to money laundering.
However, due to the distributed nature of cryptocurrencies, creating unidentifiable tokens is almost impossible.

END
RECIPIENT

SOURCE

Cryptocurrency from different
sources is sent to the mixer.

CRYPTOMIXER

21

After charging a fee (1-10%), the mixing service
sends the ‘mixed’ cryptocurrency to wherever itis required. The link to the source is now broken.

Darknet Cybercrime Threats to Southeast Asia

These mixer services are not registered ascompanies. They operate without licenses tohandle financial transactions and may break antimoney laundering, counter financing of terrorism
and UN Security Council sanctions. Licensed
Bitcoin exchange services may try to avoid directtransfers to the known wallet addresses of mixer
services.

access the full transaction information. Monero
also implements mixing automatically and makes
it difficult to trace transactions on their blockchain.

Figure 15. Payment advice to siteusers on Cannazon marketplace.*

Figure 14. DoubleMixer website on
Tor network.

*The site recommends using Monero over Bitcoin as Monero
offers greater transaction anonymity. When using Bitcoin, they
recommend the use of a mixer service (‘tumbling your coins’).

First introduced as a payment method by
AlphaBay and Oasis marketplaces, Monero has
been accepted by major Darkweb marketplaces
since 2016. Despite this, Bitcoin still dominates
illegal trade, and most of the markets only use
Bitcoin as a payment method. This is illustrated inTable 1 overleaf which shows the payment options
accepted by 40 widely known marketplaces on the
Darkweb. It is anticipated that privacy coins will,with time, become the primary payment method
for illicit commodities.

Bitcoin is not the only payment method available.
There are other cryptocurrencies, called privacy
coins, which are used in illegal trade such as Monero,
Litecoin, Bitcoin Cash, Ethereum and Dash.
Monero has attracted cybercriminals because
it offers a greater degree of anonymity fortransactions. Monero creates unique addresses
for every transaction, and only the receiver can22Darknet Cybercrime Threats to Southeast Asia

Table 1. Payment options on 40 Darkweb marketplaces as of December 2019.
Marketplace nameBitcoinMoneroLitecoin

Empire Market

BitcoinMoneroLitecoin

Hydramarket

Bitcoin

Apollon Market

BitcoinMoneroLitecoin

Genesis Market

Bitcoin

BitMarket

Bitcoin

Brians Club Market

BitcoinCannazon market

BitcoinAlpha Omega Market

BitcoinAli Marketplace

Bitcoin

Sipulimarket

Bitcoin

Icarus Market

Bitcoin

DeepSea Market

BitcoinElite Market

Bitcoin

Grey Market

BitcoinMoneroSamara Market

BitcoinMoneroBerlusconi Market

BitcoinMoneroDarkMarket

BitcoinMoneroWhite House Market

Bitcoin Cash

EthereumDash

Bitcoin Cash

Litecoin
MoneroMoneroBitcoin Cash
Litecoin

MoneroLuna Market

BitcoinSilk Road 4

BitcoinMidland City

Bitcoin

Point Market

BitcoinDr. Bob

Bitcoin

CanonZone

Bitcoin

The French Connection

Bitcoin

Dutch Drugs

BitcoinCharlieUK

BitcoinCannabis Grower

BitcoinGlass Werkz

Bitcoin

ElHerbolario’s Shop

BitcoinCocaine Market

Bitcoin

Dutch Magic

BitcoinPushing Taboo

Bitcoin

Global Dreams

Bitcoin

Evil Shop

BitcoinYakuza Market

Bitcoin

Weedstore

BitcoinRsclub Market

Bitcoin

Hidden Marketplace

Bitcoin

HookShop

BitcoinMoneroLitecoin

Ethereum
Bitcoin Cash

Ethereum

MoneroMoneroMonero23

Litecoin

Ethereum

DashDarknet Cybercrime Threats to Southeast Asia

C. Illicit products and services

As shown in Table 1, almost every marketplaceis using Bitcoin as a payment method – the only
exception being the White House Market which
only accepts Monero. Monero is available as apayment method in one-third of these popularmarketplaces and is often recommended becauseof the anonymity it provides without a separate
mixer service. Litecoin is available in 17.5 per centof the markets. Other payment methods supported
are Bitcoin Cash (different to Bitcoin), Ethereumand Dash, but only by a few marketplaces.

There are a wide range of illicit products andservices available on the Darkweb. This section
reviews the illicit products and services available
on the Tor network.
Combined data from four Darkweb marketplaces(Empire Market, Apollo Market, Silk Road 3.1, Elite
Market) shows that drugs are the most prevalent
category of illicit products available from thesemarketplaces (68 per cent). Next are digitalproducts (12 per cent) which include games,
pirated software and associated license keys;
then fraudulent items (7 per cent) which includes
payment card information, personal informationand stolen credentials; followed by counterfeit
items (5 per cent) which include money, electronics,
passports and driver licenses.

As the most widely accepted currency in Darkweb
marketplaces, Bitcoin can be accessed easily andquickly through exchanges, and transactions are
not easily traced if mixer services are used.
Monero is also available to buy through someexchanges, but not all, i.e. the large cryptocurrency
exchange,
Coinbase,
does
notsupportMonero. In 2020, Coinbase offered 30 different
cryptocurrencies to trade but this did not include
Monero. However, Monero is expected to gain
more popularity in Darkweb marketplaces because
it provides anonymity by default.

Copyrighted material is shared on the Darkweb aswell. So-called BitTorrent sites (torrents) in the Tor
network contain torrent files that enable users to
download movies, music, and games illegally.

Figure 16. Percentage of products and services available on Darkweb
marketplaces as of December 2019.*

Drugs
Gold and silver

7%

Hosting services

Less than 1%
1%

68%

Malware and hacking tools
Services
Digital products
Forgery and counterfeit

11%

Tutorials
Fraud

5%
5%

*Combined data from four popular marketplaces (Empire Market, Apollo Market, Silk Road 3.1, Elite Market) showing that drugs are
by far the most prevalent category of product available from these marketplaces as of Dec. 2019.

24

Darknet Cybercrime Threats to Southeast Asia

1. Drugs
The most widely traded category of products on the Tor darknet is drugs. The combined total numberof items on sale on the four targeted marketplaces in December 2019 is 138,405 and, of these, 94,389
were drug items. The types of drugs include MDMA, amphetamine, methamphetamine, cannabis in all
forms, cocaine, opioids in all forms, LSD, psychedelic mushrooms, ketamine and prescription drugs (mostly
benzodiazepines).

Figure 17. Percentage of drug types available on four popular marketplacesin December 2019.*
9%30%

Cannabis
Dissociatives

18%

Ecstasy
Opioids
Prescription
Steroids

3%
5%
12%
8%

Stimulants
Psychedelics

15%* Combined data from four popular marketplaces (Empire Market, Apollo Market, Silk Road 3.1, Elite Market) as of Dec. 2019.

Figure 18. Example of website selling
drugs on the Darkweb.*

Figure 19. Example of illegal drugtrade on the Darkweb.**Shows vendor sending drugs from Singapore to anywhere in
the world.

*Shows a vendor sending products from the Philippines to theUnited States.

25

Darknet Cybercrime Threats to Southeast Asia

2. Payment card fraud

Figure 21. Malaysian credit card
information on sale on the Darkweb.

The trade of compromised financial informationon the Darkweb is one example of cybercrime-asa-service (CaaS). Payment card fraud means theacquisition and unauthorized use of payment card
data, such as the card number, billing address,
security code and expiry date, to purchaseproducts.54 In most cases, the victims are unawareof the unauthorized use of their cards.
Social engineering attacks, for example, trick
the victim into revealing their card and personal
details. Victims may give their information without
ever knowing that the website or customer service
agent was actually a fraudster. This type of illegal
activity has grown steadily with card information
stolen using data breaches, social engineering
attacks (malicious activities accomplished throughhuman interaction), data-stealing malware andphishing tools (a lot of which are now readily
available on forums, marketplaces and automatedcard shops).55 Cases where criminals hack into
companies and steal large credit card information
databases (often compromising millions ofaccounts in the process) are becoming morecommon.

Web skimming is another method of card fraud. A
payment page on a website is compromised whena criminal installs malware on the page, thereby
stealing the victim’s payment information.
On the Darkweb, there are tutorials and tools forsale on how to hack card payment devices andsystems. This often occurs at the point of sale
(PoS), where people make payment transactions.
A PoS system consists of a device that reads card
information and PoS software in a computer that
sends the payment data to the payment service
provider. Malware tools are sold on the Darkweb
that can be installed on the PoS system, allowing
the attacker to collect card data during payment
processing.

Figure 20. Vendor offering acounterfeit card service aimed at theSoutheast Asia region.

The collected credit card information can beused for fraudulent payments or sold forward.
On Darkweb marketplaces, there are extensive
collections of credit card information on sale
which criminals can buy to get cash out or makefraudulent purchases. The risks to economic
stability and prosperity are abundantly clear.

26

Darknet Cybercrime Threats to Southeast Asia

3. Malware-as-a-service

to highly complex, intrusive attack vectors, which
they are sometimes incapable of controlling after
deployment. Even highly proficient actors face
this challenge – as seen in the 2017 WannaCryand NotPetya scenarios. The risks posed froman uncontrolled cyber-attack extend far beyond
traditional cybercriminal impact. Conflict, andeven warfare, is a potential result. It is therefore
essential that States have a ministerial lead on
cyber affairs, who can engage at the highest levelsof preventive cyber diplomacy in ASEAN, the UN
General Assembly and the UN Security Council.

Highly skilled programmers are able to build
computer programs and networks capable oflaunching cyberattacks against organizations. It
is this kind of software, developed into toolkits
and robotic networks (botnets) that are soldas a service on the Darkweb. This is known as“malware-as-a-service” (MaaS). MaaS enables
non-cyber specialists to buy software andthen use it to infect systems with malware andcontrol those systems for illegal use. In effect,
the criminals purchasing these tools gain accessHow cyberattackers attack
Cyberattack: the deliberate exploitation of computer systems and networks to take over orcause damage to a victim.

1

ReconnaissanceResearch, identification, andselection of targets

Weaponization

Pairing remote access malware with
exploit into a deliverable payload (e.g.
Adobe PDF, Microsoft Office files, etc.)

2
Delivery3

Transmission of weapon to target(e.g. via email attachments,
websites, or USB drives)

5

The weapon installs a backdoor
on a target’s system allowing
persistent access

7

The attacker works to achieve theobjective of the intrusion, which can
include exfiltration, destruction of dataor other actions leading to possible
financial loss, brand harm, etc.

Exploitation

Once delivered, the weapon’s codeis triggered exploiting vulnerable
applications or systems

4
Installation

Command & Control

Outside server communicates with theweapons providing “hands-on keyboard
access” inside the target’s network

6
Actions on Objectives

Source: Adapted from The Cyber Kill Chain® developed by Lockheed Martin.

27

Darknet Cybercrime Threats to Southeast Asia

Anatomy of a ransomware attack

1. Attacker sends
a phishing email

8. Files are decrypted.*

Note: There is no guaranteethat the attacker will follow
through with decryption even if
ransom paid. UNODC does NOT
recommend paying a ransom andrecommends preventive measures
to reduce the risk of compromise in
the first instance.

2. User receives alink and clicks

7. When ransom ispaid, attacker may
deliver ‘the private(decryption) key’

3. Malware unpacks
and executes

4. Attacker gains
control of ‘the public
key’ required toencrypt files

6. Attacker demands
ransom from user(e.g. Bitcoin)

5. Files get encrypted
and user getsransomware
screenRansomware-as-a-Service (RaaS): the practice of providing ransomware and it’s control systems tocustomers for criminal use. All aspects of ransomware creation and control may be provided as a service forpurchase. Customers can choose the services they need in an ala carte fashion.
Source: Adapted from Centrify Corporations

4. Ransomware
Ransomware is a type of malware that takes data
as a hostage. The criminal uses the ransomware toprevent a target victim from accessing their data,
and then threatens to publish the victim’s data or
exploit them in some other way unless a ransom
is paid.
Sometimes the victims of ransomware attacks are
instructed to pay the ransom through a Darkweb
site, often in cryptocurrency, thereby making it
more difficult to track the destination of the funds.
Darkweb vendors also sell ransomware tools anddistribution networks which only exacerbates the
problem and proliferation of ransomware.

28

Darknet Cybercrime Threats to Southeast Asia

Distributed denial-of-service (DDoS) attack
DDoS: a cyberattack that uses a distributed network of computers to overwhelm a target system‘s resources
to the point that the target cannot continue functioning properly.

BOTNET CONSISTING OF HUNDREDS OR
THOUSANDS OF INFECTED HOSTSCYBERCRIMINAL

COMMAND &CONTROL CENTRE

1. Attacker sends “launch”
commands to a botnet
from a command &control server.

VICTIM’S SERVER

2. Bots send attack
traffic to victim’sserver.

3. Attack traffic overwhelms
the server, making it
unable to respond tolegitimate requests.

Source: Adapted from F5 Labs (Application Threat Intelligence)

5. Denial-of-service
A denial-of-service (DoS) is an attack on a service that disrupts its
normal function and prevents others from accessing it. This is usuallyan attack on an online service like a website, although attacks canalso be launched against whole networks. Criminals sell DoS attacks
as a service on the Darkweb. This often involves infecting a large
number of computers with their malware, and then using this botnet
to launch DoS attacks. It is the owners of these botnets that sell
their DoS capabilities through Darkweb marketplaces. Buyers canalso rent the capacity of the botnets to take down a particular online
service. The buyer supplies the details of the targeted service to thevendor and then pays per hour for the vendor to carry out the DoS
attack. A distributed denial-of-service (DDoS) attack is one in which
the botnets overwhelm the target service with more traffic than theserver or network can accommodate, causing them to crash.

29

Darknet Cybercrime Threats to Southeast Asia

6. Forgery

7. Scamming websites

Forgery is another popular service offered on the
Darkweb and this is often closely related to identity
theft. On the Darkweb, criminals trade counterfeit
passports, driver’s licences, and money. Accessto personal information that will assist with theforgery of identity documents is also on sale.
Counterfeit documents and forgery services are
popular on the Darkweb, accounting for 5% of all
trade in the most popular marketplaces. Of course,
these forged documents are usually purchased
to conceal the criminals’ real identities as they
commit other crimes.

Not surprisingly, the anonymous Darkweb is home
to many scammers. One scam includes websites
and forums who request Bitcoin payments upfront
for their products and services. There is no
guarantee that the product or service is going to
be delivered and little chance of recompense if thebuyer is not satisfied with their purchase. In mid2020, many Darkweb sites claimed to be selling
vaccines or medicine to fight the coronavirus
during the COVID-19 pandemic. These sites
asked for substantial upfront payments and neverdelivered what they promised.

Figure 22. Vendor selling a range ofcounterfeit and stolen documents.*

Another type of scam that occurs on the Darkweb
is an “exit scam”. This occurs when a marketplacesuddenly closes without warning, taking with it
all the bitcoins currently saved to the wallets ofthe site users. Vendors can also stop delivering
their products or services and escape with all the
bitcoins paid for unshipped orders.

8. Hacking forums
Hacker forums are asynchronous forums created
and operated primarily to discuss topics related
to hacking. Topics of interest in these forums
range from general computer security news andtutorials to the distribution of malware and leaked
information. These forums also discuss and shareanonymity tips, server hacking tools and password
cracking techniques.

*As well as a wide range of counterfeit documents this vendor
is selling “real” passports, ID cards and driver’s licenses
from Thailand.

Figure 23. Vendor selling fakecurrency.*

Figure 24. A vendor offering a varietyof hacking services.

30

Darknet Cybercrime Threats to Southeast Asia

Discussion forums and channels are frequently
used on the Darkweb to coordinate attacks, shareattack tools, and for general communication on
topics related to illicit activities.

Underground Darkweb forums are regularly usedby hackers to announce data breaches, before
sharing or trading information. Analysing andidentifying the discussion threads on these forums
can help compromised victims respond to theincidents in time.

9. Personally identifiable and nonidentifiable information disclosure

10. Selling access to organizations

A popular activity among cybercriminals is to sharebreached data such as passwords, confidential
documents, databases, and financial information.
This data is routinely exploited by criminals who
conduct cyberattacks that take place outside theDarkweb.

Hackers sometimes secretly retain access tocompromised servers without the knowledge ofthe targeted organization. This access is highly
valuable. Some groups specialize in gaining
unauthorized access to servers and then sellthis information to other groups who specialize
in carrying out operations within the target
organizations. Transnational cybercrime groups
that specialize in gaining access to high-valuetarget organizations will sell remote accesscredentials on the Darkweb. After receiving
payment, they provide instructions to the buyer on
how to access the target organization remotely.

Unauthorized data leakage does not necessarilymean that an organization is the victim of malicious
hacking. In fact, the majority of data leakage
incidents claim to be accidental. For example, an
employee may unintentionally send an email to
the wrong person or mistakenly give an outsider
access to the company system. Irrespective ofmotive, unintentional data leakage can be just as
damaging as intentional breaches.

11. Child sexual exploitation material
Darkweb forums (and their users) have beenarchiving, sharing, trading and selling child sexual
exploitation material (CSEM) for many years.
Cumulatively, the amount of CSEM increases overtime as new content is added and old material
is archived.

Intentional information leakage happens when an
attacker (either from within the target company
or an outsider) gains access to the organization’sdata. Cybercriminals often use malware to target
employees and their computers with a high successrate, but less-technically proficient methods canalso be very effective, i.e. cybercriminals can easily
fake a legitimate business email account andrequest any number of employees to send them thecompany’s sensitive information or trade secrets.

It is difficult to remove this content permanently.
CSEM sites often replicate the content from othersites, meaning when one website gets taken down,
the data remains online on other sites. With newsites being set up and new material being added
constantly, there is a continuation of services.

Typically, criminals copy and paste compromised
data onto an information-leaking platform site andpublish it under a unique username. Cybercriminals
share this username with other criminals who arethen able to access the illicit content. The content
sometimes only exists for a short period on thepaste site thus limiting overall exposure. Othersites, however, retain the data indefinitely.

Some websites even state that they are gathering
an archive of CSEM material to distribute andadvertise having terabytes of content available.
There are also sites which sell access to CSEM –including pay-per-view live-streaming abuse, with
Bitcoin typically the currency of choice for payment.

31

Darknet Cybercrime Threats to Southeast Asia

Figure 25. Number of published unique CSEM websites on the Darkweb (2015-2019).
900
800
700
600
500
400
300
200
100
0

2015

2016

2017

32

2018

2019

Darknet Cybercrime Threats to Southeast Asia

Figure 26. Illegal wildlife trade takes place inDarkweb marketplaces.*

As illustrated in Figure 25, the amount of CSEM
content on the Darkweb is growing rapidly. In
fact, an analysis using text content comparison
in 2019 found there were 776 unique websites
sharing CSEM (approximately 5 per cent of the
15,353 active onion websites).56 Although a lot ofthese websites are operating under different onion
domain names, the content on many of themappeared to be identical.

12. Wildlife trade
With the expansion of trade, follows the appearanceof illegal wildlife products on darknet markets.
Figure 26 shows rhino horn trade in 2019.

1400*Four different vendors selling rhino horns on the Agartha
marketplace.

Figure 27. Number of times “rhino horn” mentioned on
the Darkweb (2018-2019).

1200
1000
600
600
400
200

20
18
20 01
18
20 02
18
20 03
18
20 04
18
20 05
18
20 06
18
20 07
18
-0
8
20
18
-0
9
20
18
-1
0
20
18
-1
1
20
18
20 12
19
20 01
19
-0
2
20
19
-0
3
20
19
20 04
19
20 05
19
20 06
19
-0
7
20
19
20 08
19
-0
9
20
19
20 10
19
20 11
19
-1
2

0

Conclusion
While there is a paucity of data regarding Darkweb
criminality targeting, and originating from,Southeast Asia, available information reveals
that it does exist and is likely to grow in breadthand depth in the near-term. At the same time,
COVID-19 has clearly confirmed that criminals
will evolve their business models at pace in order
to continue to make the greatest possible profit.
States too must be enabled to rapidly assess,analyse and redirect operational resources to
respond to evolving cyber threats.

It is essential that Southeast Asian countries takeindividual responsibility to address the overall
political and policy issues raised in counteringdarknet cybercrime, but that they also invest
rapidly in upskilling their criminal justice agencies.
Darknet cybercrime is no longer an “unknown
unknown” and requires dedication, expertise,
specialist mentoring and financial resources
to build the capabilities which will counter the
threat. UNODC remains committed to supporting
Southeast Asia with this vital work.

33

Darknet Cybercrime Threats to Southeast Asia

Appendices
A1: Darknet use in Southeast Asian countries
By using metrics provided by two of the darknets (Tor and I2P), it is possible to get an approximation of thenumber of users in each Southeast Asian country. These metrics provide a better understanding of user
behaviour over time. It is important to note that criminality cannot be inferred from these metrics – they
simply serve to paint a picture of darknet use.
Tor provides two useful metrics: relay users and bridge users. Relay users are any users in a particularcountry that are relaying Tor traffic. Bridge users are end-users that are blocked (for whatever reason) fromaccessing the Tor network directly. Bridge users do not act as relays.
I2P provides router information by country. Similar to Tor, users connect to the I2P network via a local
software router. Routers receive and forward I2P traffic from other nodes on the I2P network. I2P retains thenumber of active routers per country for a maximum of one year.
There are also other methods for users to connect to darknets which makes it difficult to attribute precise
numbers of users to particular countries. For example, a user in country A could use a VPN or similar service
to connect to country B. While appearing to be in country B, the user connects to the Tor network. Tor would
register the user as connecting from country B. We must therefore infer that the number of users indicatedin these network metrics may underrepresent the actual user numbers.
Below we give an overview of darknet users by country for Tor and I2P networks. In most graphs there isa huge spike in users in 2013 and 2018. Both of these spikes are likely caused by malware that connected
infected systems to the Tor network.57

1. Brunei Darussalam
Brunei has a population of approximately 440,000.58 Tor metrics (Figure A1) show that usage of Tor has
dropped from around an average of 500 people per day connected over the last few years to an average of
250 people connected in 2020. Like many other countries, we see an increase in users in early 2020.

Figure A1. Tor users directly connected from Brunei (January 2012 to July 2020).
1400

1,050

700

350

0

2013

2017

2015

2019

The Tor Project - https://metrics.torproject.org/

34

Darknet Cybercrime Threats to Southeast Asia

Tor bridge users also average around 10 connected users per day. Note that these could be the same users
connecting and disconnecting from the network, or different users. 250 relay users and 10 bridge users
should be considered the minimum possible total users.
There was no reported activity from Brunei on the I2P darknet from January 2019 to July 2020. This means
I2P was not used directly.

2. Cambodia
Cambodia has a population of approximately 16.7 million. 59 Tor metrics (Figure A2) show that usage of Tor
increased from an average of around 500 users per day in 2018 to an average of 2,500 users by the end of
2019. In early 2020, we see a drop back to a 500-user average. Such a fluctuation could be due to increaseduser awareness, or to do with a malware campaign or censorship event in the country.60

Figure A2. Tor users directly connected from Cambodia(January 2012 to July 2020).

3,000

2,000

1,000

0

2013

2017

2015

2019
The Tor Project - https://metrics.torproject.org/

In early 2018, we see a large increase in Tor bridge users from around a 10-user average to around a 700user average. Since then, bridge users have steadily decreased, with around a 50-user average in 2020.
There was no reported activity from Cambodia on the I2P darknet from January 2019 to July 2020. Thismeans I2P was not used directly.

3. Indonesia
Indonesia has a population of approximately 274 million.61 Tor metrics (Figure A3) show that usage of Tor
increased from an average of around 10,000 users per day in late 2017 to an average of 125,000 users by theend of 2019. In early 2020, we see a drop back to a 75,000-user average.
In early 2018, we see a large increase in Tor bridge users from around a 100-user average to around a
12,500-user average. Bridge users have steadily decreased to an average of around 600 users in 2020.
Indonesia had approximately 150 I2P users in early 2019. That number dropped to around 25 users in early
2020, and then increased to a 50-user average between January and July 2020.

35

Darknet Cybercrime Threats to Southeast Asia

Figure A3. Tor users directly connected from Indonesia(January 2012 to July 2020).
160,000

120,000

80,00040,000

0

2013

2017

2015

2019

The Tor Project - https://metrics.torproject.org/

4. Lao PDR
Laos has a population of approximately 7.2 million.62 Tor metrics (Figure A4) show that usage of Tor haslargely remained steady from 2015 to 2020 at approximately a 250-user average, with a slight increase to a
500-user average since early 2020.

Figure A4. Tor users directly connected from Lao PDR(January 2012 to July 2020).

4,000

3,000

2,000

1,000

0

2013

2017

2015

2019

The Tor Project - https://metrics.torproject.org/

36

Darknet Cybercrime Threats to Southeast Asia

Similar to other countries, late 2018 saw a large increase in Tor bridge users. More recently, there has beena decline from a 400-user average to a 25-user average.
There was no reported activity from Laos on the I2P darknet from January 2019 to July 2020.

5. Malaysia
Malaysia has a population of approximately 32.4 million.63 Tor metrics (Figure A5) show a sharp increase inusers in 2013. The average number of users declined from 2013 to 2017, and then averaged around 5,000
users per day from 2017 to 2020.

Figure A5. Tor users directly connected from Malaysia(January 2012 to July 2020).
60,00045,00030,00015,000

0

2013

2017

2015

2019

The Tor Project - https://metrics.torproject.org/

While Tor direct connections decreased, there was an increase in Tor bridge connections. Bridge connections
peaked at around 800 users per day in mid-2018. From 2019 to 2020 average bridge users remained steadyat around a 150-user average.
Malaysia maintained an average of around 85 users per day on the I2P network from January 2019 to July 2020.
The number of users appears to have almost doubled since January 2020 from around 60 to around 100 users.

6. Myanmar
Myanmar has a population of approximately 54.5 million.64 Tor metrics (Figure A6) show a sharp increasein users in mid-2013, gradually decreasing until mid-2017. From 2017 there has been a slight increase inaverage users, from around 200 per day to around 400 in 2020.
Like other countries, there was a large increase in Tor bridge users from mid-2018. Since then, Tor bridge
users have declined from a 500-user average to a 15-user average.
There is no reported activity from Myanmar on the I2P darknet from January 2019 to July 2020.

37

Darknet Cybercrime Threats to Southeast Asia

Figure A6. Tor users directly connected from Myanmar(January 2012 to July 2020).
1000

750

500

250

0

2013

2017

2015

2019

The Tor Project - https://metrics.torproject.org/

7. Philippines
The Philippines has a population of approximately 109.9 million.65 Tor metrics (Figure A7) show a sharp
increase in users in mid-2013 and then a decrease until 2017. From 2017 we see an increase in users from
5,000 to around 10,000 average users.
Similar to other countries, mid-2018 saw a large increase in Tor bridge users. Since then, Tor bridge users
have declined from a 3,500-user average to a 250-user average.
From 2019 to July 2020, the Philippines had an average of 60 I2P users with a range from 30 to 90 users inthat time.

Figure A7. Tor users directly connected from the Philippines(January 2012 to July 2020).
70,00052,50035,00017,500

0

2013

2017

2015

38

2019

The Tor Project - https://metrics.torproject.org/

Darknet Cybercrime Threats to Southeast Asia

8. Singapore
Singapore has a population of approximately 5.8 million.66 Tor metrics (Figure A8) show a fairly consistentincrease in average Tor users from 2013, with average users increasing from 5,000 to 15,000 in July 2020.

Figure A8. Tor users directly connected from Singapore(January 2012 to July 2020).
30,00022,50015,000

7,500

0

2013

2017

2015

2019

The Tor Project - https://metrics.torproject.org/

Similar to directly connected users, there has been a steady increase in Tor bridge users from 2014 to 2020,
with an average of approximately 200 Tor bridge users in July 2020.
From 2019 to July 2020, Singapore had an increase of I2P users from 80 per day to 140. One increase
happened in November 2019, and there has been another steady increase since January 2020.

9. Thailand
Figure A9. Tor users directly connected from Thailand(January 2012 to July 2020).
120,000

90,00060,00030,000

0

2013

2017

2015

2019

The Tor Project - https://metrics.torproject.org/

39

Darknet Cybercrime Threats to Southeast Asia

Thailand has a population of approximately 69.8 million.67 Tor metrics (Figure A9) show a sharp increase inusers in mid-2013 that steadily declines until late 2017. In 2018, we see an increase of users to about 25,000that continues to increase slightly into 2020.
Tor bridge users peak in mid-2018 at around an average of 4,000 users per day. Bridge users decline until
reaching an average of around 250 users in mid-2020.
From 2019 to July 2020, Thailand had an average of 65 I2P users. Users range from around 30 to 100 withthe average number of I2P users increasing since early 2020.

10. Vietnam
Vietnam has a population of approximately 97.5 million.68 Tor metrics (Figure A10) show a sharp increase inusers in mid-2013 and then a decline until 2017. The average number of users increased from approximately
6,000 in 2017 to around 12,000 in mid-2020.

Figure A10. Tor users directly connected from Vietnam(January 2012 to July 2020).
140,000

105,000

70,00035,000

0

2013

2017

2015

2019

The Tor Project - https://metrics.torproject.org/

Tor bridge users peaked in mid-2018 at an average of around 15,000 users per day. Bridge users thendeclined until reaching an average of around 250 users in mid-2020.
From 2019 to July 2020, I2P users declined from an average of around 200 users to an average ofapproximately 30 users in mid-2020.

40

Darknet Cybercrime Threats to Southeast Asia

A2: Darkweb technical analysis

A3: Technical analysis results

Darkweb data, including data from 2015–2020 was
analysed for this report. This produced some 200
million pages of Darkweb data covering websites,
information-leaking platforms, marketplaces,
discussion forums, interest groups and publisheddata breaches. Data was collected using crawlers
that followed links and stored all the information
they observed. Darkweb websites, especiallymarketplaces and discussion forums, require
bypassing various obstacles, such as CAPTCHA’s,
paywalls, scripted behaviour detection andvouching.

After web crawling to extract and transform
unstructured data from the Darkweb, thisstructured data was stored on a database.70 In thisstep, connections and behaviour were studied.71,72
Data mining identifies information that could be
attached or linked to a specific country or to anorganization that resides in that particular country.
There are two sets of identifiers: country-specificidentifiers and organization-specific identifiers.
Country-specific identifiers:
1. IP addresses
2. Domain names
3. Most common names per country
4. Phone numbers with country code
5. Social security numbers
6. Languages
7. GPS-coordinates from image metadata

The data collection process involves crawlingonion websites inside the Tor and I2P networks.
A Darkweb harvesting system requires:69
1. onion link acquisition from the deep andDarkweb,
2. a proxy system where several Tor clients areconnected to the Tor network,
3. crawlers and spiders which access the HTTP
web content available on Tor,
4. logic to bypass authentication and robot
detections,
5. duplicate information detection,
6. text information extraction from the documents,
7. text data saving to the index.

Organization-specific identifiers:
1. Disclosure of sensitive information
2. Discussions
3. Marketplace activity
4. Financial information
5. Exposed credentials (passwords)
6. Personally identifiable information
7. Hacker group targeting
8. Attacks and previous compromises.

The data collection system automatically performs
link acquisition from the content it finds and thecontinuous crawling process follows new links.
Furthermore, there is a cycle to re-check crawled
URL addresses in case there is new content
available.

Figure A11. Mapped IP addresses
mentioned in the Tor network fromSoutheast Asia.

The proxy system is a collection of Tor software
clients and HTTP load-balancing proxy which
selects a Tor client for each onion domain name.
Some content is only available behind a login
and robot detection (CAPTCHA). If this content
is gathered, a separate bypass system is needed,which can log in and solve robot detection puzzles.

41

Darknet Cybercrime Threats to Southeast Asia

Figure A12. Countries mentioned in discussion forums on the Darkweb.
30000
25000
20000
15000
10000
5000
0

2016

2017

Brunei

MyanmarCambodia
Vietnam2018

Indonesia

Thailand

Like IP addresses, phone numbers located on the
Darkweb are in many cases linked to victims ofcriminal activity. These phone numbers most likely
belong to the victims of data breaches and areoften used by criminals for illicit purposes.

Laos

Singapore

2019

Malaysia

Philippines

Indonesia had the most national ID numbers
leaked on forums. Assuming that these are real,
it suggests that there are many victims of data
breaches in the country. Such information could
be used to scam, defraud or attack the victims,
their families or associated organizations. Thisdata could, however, be used by the Indonesian
Government to create an incident response andrisk mitigation strategy.

Overall, languages, phone numbers, national
ID numbers and much more can provide some
information about a location. The Darkweb was
searched for any country-specific identifiers.
These country-specific identifiers often show up
in forum discussions, database leaks, and otherinformation posted on the Darkweb. As such, muchof the location-specific data is leaked victim datafrom specific countries. Table A1 shows a numberof related identifiers found on the Darkweb listed
by country. While this type of assessment does
not allow premises, inferences or assumptions to
be made about Darkweb-related crime/victims, it
is potentially useful as a general indicator of theamount of Darkweb-related activity that a country
is facing.

Some of the images shared on the Darkweb
contain image metadata with GPS locations (i.e.
the location where the photograph was taken).
Typically, users and web services remove thisinformation. However, some images still contained
this location information and Figure A13 showswhere these images were taken in Southeast
Asia. This potentially reveals locations related toassociated criminal activity.

42

Darknet Cybercrime Threats to Southeast Asia

Table A1. Quantities of sensitive data identifiers found on the Darkweb
listed by country.
Cambodia Indonesia Vietnam Thailand Philippines Malaysia Singapore Laos
LanguagePhone
numbers

18391

National
ID
numbers

11685

21439

7945

15714

7480

8022

907

16073

581

582

47

571

4

Brunei

Myanmar

1060

Marketitems withcountry
mentioned

2198600

223277981494322227292213301

2215632

2224558

784133 2189850

1444910IPv4
addresses

5832

94390

43657

55458

21143

50481

135631

3526

1586

4062

Domains

4339

128202

44681

86079

98837

11312075261

2181731723

4870

Country
mentionedin CSE
context

16506

417

661

5139

968

167

19281

125

4

105

Country
mentioned
in forums

32382

59669

32199

59311

60812

44790

47929

3934

11323

25396

The Tor network is a volunteer overlay network(a network layered on top of another), consistingof more than 7,000 relays. A Tor relay operator is
not necessarily responsible for the traffic passing
through the relay. In most of the world, it isperfectly legal to install a voluntary Tor network
relay. Anyone can operate a node by installing Tor
software in the router mode and starting to route
Tor traffic through a server.

As shown in Figure A14, there are a total of 106
Tor relays in Southeast Asian countries (9 inIndonesia, 12 in Malaysia, 1 in the Philippines, 69
in Singapore, 6 in Thailand, and 9 in Vietnam).
The data illustrates that Singapore is an attractive
location to operate these relays. This is probably
because cheap virtual machines to operate relays
are easily accessible, and Internet infrastructure iswell developed.

Figure A13. Locations where images stillcontaining metadata were taken.

Figure A14. Tor relays in Southeast
Asian countries.

43

Darknet Cybercrime Threats to Southeast Asia

Figure A15 shows an overall increase in the popularity of the Tor network in Southeast Asian countries since2017, although the reasons for this are unclear.

Figure A15. Southeast Asian users connected to the Tor network(May 2012-June 2020).
500,000

375,000

250,000

125,000

20
12-0
20 5-2
7
12
-1
0
20
13 21
-0
20 3-1
7
13-0
20 8-1
1
14
-0
1
20
14 05
-0
20 6-01
14-1
20 0-2
6
15-0
20 3-2
2
15
-0
8
20
16 16
-0
20 1-10
16-0
20 6-05
16-1
20 0-3
1
17
-0
3
20
17 27
-0
20 8-21
18-0
20 1-1
5
18-0
20 6-1
1
18
-1
1
20
19 05
-0
20 4-01
19-0
20 8-2
6
20
-0
120

0

44

Darknet Cybercrime Threats to Southeast Asia

Glossary
TermDefinition

Anonymous filesharing networks

Networks that allow sharing files and other data between network users.
They are designed to make it difficult to track the origin of both thesender and receiver. They are often Peer to Peer (P2P) networks withanonymity functions. Still, centralised sharing functions are possible withthe assistance of additional anonymity overlay networks, such as Tor.

Anonymous web
browsing

Anonymous web browsing allows a user to visit websites without
allowing anyone to gather information about which sites the user
visited. Anonymizing tools attempt to prevent browser fingerprinting
and hide the visitor’s IP address. These services typically use a proxy
server to process each HTTP request. When the user requests a web
page by clicking a hyperlink or typing a URL into their browser, theservice retrieves and displays the information using a server it controls.
The remote server (where the requested web page resides) receives
information about the anonymous web surfing service in place of theuser’s information.
Source:https://www.lawweb.in/2012/10/use-of-annonymizer-for-better-privacy.
html

APT

Advanced
PersistentThreatAs the name ‘advanced’ suggests, an advanced persistent attack (APT)
uses continuous, clandestine, and sophisticated hacking techniques togain and keep access to a system for a prolonged period, with potentiallydestructive consequences.
Because of the level of effort needed to carry out such an attack, APTs
are usually levelled at high-value targets, such as nation-states and large
corporations, with the ultimate goal of stealing information over a long
period, rather than merely ‘dipping in’ and leaving quickly, as many black
hat hackers do during lower-level cyber assaults.
Source:https://www.kaspersky.com/resource-center/definitions/advancedpersistent-threats

Asynchronousforum

An Internet-based electronic communication environment, which
permits users to post messages for some or all the members to view.
Messages remain posted until a forum moderator removes them.
Asynchronous refers to the static nature of the environment. Postings aredone one at a time, anonymously or not, and offer a written electronic
record of the communications conducted.
Source:https://www.igi-global.com/dictionary/peer-learning-social-interactionsasynchronous/1688

Bandwidth

Bandwidth is the quantity of data transmission (Rate) from one device toanother device on the network (including the Internet).
Source:https://www.lifewire.com/what-is-bandwidth-2625809

45

Darknet Cybercrime Threats to Southeast Asia

Term

Definition

Botnet‘Botnets’ (a term derived from the words ‘robot’ and ‘network’) consistof a network of interconnected, remote-controlled computers generally
infected with malicious software that turns the infected systems into socalled ‘bots’, ‘robots’, or ‘zombies’.
Source:https://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_
EG.4_2013/CYBERCRIME_STUDY_210213.pdf

CaaS

Crime-asa-service
model

The Crime-as-a-Service (CaaS) business model is used when a criminalgroup offers some or all parts of criminal actions as a service to othercriminal groups. This allows criminal groups to specialize in particular
aspects of crime while still gaining benefit from the overall crime (oftenwith less risk).
CaaS includes a wide range of commercial services that facilitate
almost any type of cybercrime. Criminals are freely able to procuresuch services, such as the rental of botnets, denial-of-service attacks,
malware development, data theft and password cracking, to commit
crimes themselves.
Source:https://www.europol.europa.eu/activities-services/main-reports/
Internet-organised-crime-threat-assessment-iocta-2014

CAPTCHA

Censorshipcircumvention

Completely
Automated
Public Turing
test to tellComputersand Humans
Apart

CAPTCHA is a method used to protect websites against spam. The
goal is to stop interactive websites from being spammed by filtering out
automatically generated input.
Source:https://www.ionos.com/digitalguide/online-marketing/online-sales/
captcha-codes-and-images-for-spam-protection/
Internet censorship circumvention is the use of various methods
and tools to bypass Internet censorship. Internet censorship, forexample, may monitor and block certain website requests. Censorshipcircumvention may attempt to hide or obfuscate the request, or bypass
the monitor by tunnelling the request through a non-censored computer.
Source:https://ssd.eff.org/en/module/understanding-and-circumventingnetwork-censorship

Clearnet

Clearnet is the ‘regular’ Internet, which can be discovered using linkcrawling and DNS query techniques. These techniques are usedby typical search engines such as Google, Bing and Yahoo. It is the
unencrypted non-dark, non-Tor Internet.
Source:Europol,2017 “Drugs and the darknet – perspectives for enforcement
research and policy”
https://www.europol.europa.eu/sites/default/files/documents/drugs_
and_the_darknet_-_td0417834enn.pdf

46

Darknet Cybercrime Threats to Southeast Asia

Term

Definition

Cryptocurrencies

Cryptocurrencies are electronic tokens generated by networks ofcomputers to replace traditional currencies. The electronic tokens indigital currency have value based on the exchange of conventional
currencies and commodities for the tokens through special Internet
exchanges, such as BitPay. These exchanges function somewhat like
PayPal but are not associated with that company.
Source:https://www.kaspersky.com/resource-center/definitions/what-is-bitcoin
https://www.europol.europa.eu/sites/default/files/documents/drugs_
and_the_darknet_-_td0417834enn.pdf

CSEChild Sexual
Exploitation

The sexual maltreatment of children which consists of, but is not limited
to, child sexual abuse, child sexual assault, child sexual abuse material,
early or forced marriage, as well as the production of images of suchabuse and the sharing of those images online.
Source:https://www.icmec.org/resources/glossary/
https://www.europol.europa.eu/crime-areas-and-trends/crime-areas/child-sexual-exploitation

CSEM

Child Sexual
Exploitation
Material

Child Sexual Exploitation Material is any material that visually depicts achild engaged in real or simulated sexually explicit conduct. This can also
include any material generally depicting a child in a sexual manner.
Source:https://www.ecpat.org/what-we-do/online-child-sexual-exploitation/
https://www.europol.europa.eu/crime-areas-and-trends/crime-areas/child-sexual-exploitation

Cyberattack

A cyberattack occurs when cybercriminals attempt to inflict reputational
damage or harm to a business or person, or theft of valuable data.
Cyberattacks can target individuals, groups, organizations, orgovernments.
Source:https://us.norton.com/Internetsecurity-emerging-threats-cyberattackson-the-rise-what-to-do.html

Crypto-mixers

A cryptocurrency mixing service is a service offered to mix potentially
identifiable cryptocurrency funds with other non-related funds, toobscure the trail back to the fund’s original source.
Source:https://www.europol.europa.eu/newsroom/news/multi-million-eurocryptocurrency-laundering-service-bestmixerio-taken-down

47

Darknet Cybercrime Threats to Southeast Asia

Term

Definition

Darknet/Darkweb

A relatively covert part of the World Wide Web that is not indexed bysearch engines, and can only be accessed by specialized software suchas the Tor browser.
Source:https://iaca-dark web-tools.com/dictionary/
A network, built on top of the Internet, that is purposefully hidden; it
has been designed specifically for anonymity. Unlike the deep web, thedarknet is accessible only with special tools and software — browsers
and other protocol beyond direct links or credentials.
Source:Europol,2017 “Drugs and the darknet – perspectives for enforcement
research and policy”
https://www.europol.europa.eu/sites/default/files/documents/drugs_
and_the_darknet_-_td0417834enn.pdf

Data breach

A data breach exposes confidential, sensitive, or protected information
to an unauthorized person. The data in a data breach is viewed and/or
shared without permission.
Source:https://www.kaspersky.com/resource-center/definitions/data-breach

Deep webA section of the Internet that is not indexed by search engines. The deep
web contains such things as intranet, banking information, membershipsites, as well as the Darkweb. The only way to access the deep web
is by conducting a search within a particular website. For example,
government databases and libraries contain huge amounts of deep web
data.
Source:https://iaca-dark web-tools.com/dictionary/
Source:Europol,2017 “Drugs and the darknet – perspectives for enforcement
research and policy”
https://www.europol.europa.eu/sites/default/files/documents/drugs_
and_the_darknet_-_td0417834enn.pdf

DDoS

Distributed
Denial ofService
AttackA Distributed Denial of Service attack attempts to block legitimate users
from accessing some service by using a distributed network of systems
to overwhelm the resources of a target.
Source:https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/48

Darknet Cybercrime Threats to Southeast Asia

Term
DoS

Definition
Denial ofService
AttackA Denial of Service attack attempts to block legitimate users fromaccessing some service. For example, by overwhelming a targeted
website to the point of crashing it or making it too busy to be accessible.
A successful Denial of Service attack can cripple any entity that relies on
its online presence by rendering their website virtually useless.
Source:https://evestigate.com/cyber-crime-hacker-terms-to-know/

DoxingDoxing is searching for and publishing private or identifying information
about an individual or their alias without their knowledge or permission.
Source:https://iaca-dark web-tools.com/dictionary/

E-commerce
websites

Websites that allow individuals to buy and sell goods and services online.

Encryption

The process of converting data to an unrecognisable or ‘encrypted’ form. It
is commonly used to protect sensitive information, including files, storage
devices and data transfers, so that only authorised parties can view it.
Source:Europol,2017 “Drugs and the darknet – perspectives for enforcement
research and policy”
https://www.europol.europa.eu/sites/default/files/documents/drugs_
and_the_darknet_-_td0417834enn.pdf

Escrow payment
systemA third-party payment system, often times a marketplace, that holds
funds while a transaction is made between the buyer and seller.
Source:https://iaca-dark web-tools.com/dictionary/

Exit scam

A scam in which a darknet market administrator or a vendor shuts down
operations while stealing as much money as possible from users and/or
buyers in the process.
Source:Europol,2017 “Drugs and the darknet – perspectives for enforcement
research and policy”
https://www.europol.europa.eu/sites/default/files/documents/drugs_
and_the_darknet_-_td0417834enn.pdf

49

Darknet Cybercrime Threats to Southeast Asia

Term

Definition

Forgery

An act of making a false object so that it may be accepted as genuine.
Source:https://legal-dictionary.thefreedictionary.com/forgery
Forgery typically require two necessary elements: (i) the alterationor manipulation of computer data, and (ii) a specific intent to use thedata as if they were authentic. Alternatively, countries may extend thedefinition of the object of traditional forgery. A number of countries
in Europe, for example, have covered computer-related forgery byextending the definition of ‘document’ to include computer data.
Other countries apply general provisions to computer-related forgery
without amending legislation if traditional provisions of forgery can beinterpreted to include digital documents, signatures and data.
Source:https://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_
EG.4_2013/CYBERCRIME_STUDY_210213.pdf

Hacktivism

Hacktivism is the intentional access to systems, websites, and/or data
without authorisation or having exceeded authorised access, and/or
the intentional interference with the functioning and/or accessibility ofsystems, websites, and data without authorisation or having exceededauthorised access, in order to effect social or political change.
Source:Maras, Marie-Helen. (2016). Cybercriminology. Oxford University Press.

Hidden services

A feature provided by the Tor network that enables a user toanonymously host content and services on the Darkweb.
Source:Europol,2017 “Drugs and the darknet – perspectives for enforcement
research and policy”
https://www.europol.europa.eu/sites/default/files/documents/drugs_
and_the_darknet_-_td0417834enn.pdf

HTTPS

Hypertext
TransferProtocolSecureThis transfer protocol is the language in which the web client – usually
the browser – and the web server communicate with each other.
HTTPS is the version of the transfer protocol that uses encrypted
communication.
Source:https://www.ionos.com/digitalguide/hosting/technical-matters/what-ishttps/

50

Darknet Cybercrime Threats to Southeast Asia

Term

Definition

Identity theft –computer related

Refers to acts involving the transfer, possession, or use, of means ofidentification of another person stored in computer data, without right,
with the intent to commit, aid or abet any unlawful criminal activity. Thisis the case, for example, if a perpetrator, without right, obtains driving
licence information from a computer system and either sells such data or
uses it to hide his true identity when committing a crime.
Source:https://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_
EG.4_2013/CYBERCRIME_STUDY_210213.pdf

I2P

Invisible
Internet
Project

Software that provides access to a network that allows for anonymousbrowsing, messaging, and file transfers.
Source:https://iaca-dark web-tools.com/dictionary/
An alternative to Tor hidden services. It is an overlay network basedon passing messages between routers using garlic routing with a
distributed hash table for a global directory of available routers.
Source:Europol,2017 “Drugs and the darknet – perspectives for enforcement
research and policy”
https://www.europol.europa.eu/sites/default/files/documents/drugs_
and_the_darknet_-_td0417834enn.pdf

IP address

Internet
protocoladdress

The address of a connected device in an IP network (TCP/IP network),
which is the worldwide standard for both local-network and Internet
connections. Every desktop and laptop computer, server, modem,
router, smartphone, tablet and smart TV is assigned an IP address whenconnected to the network. Every IP packet traversing an IP network
contains a source IP address and a destination IP address.
Source:https://www.pcmag.com/encyclopedia/term/ip-address51

Darknet Cybercrime Threats to Southeast Asia

References1

https://www.unodc.org/unodc/en/frontpage/2019/
June/world-drug-report-2019_-35-million-peopleworldwide-suffer-from-drug-use-disorders-whileonly-1-in-7-people-receive-treatment.html

20 K. Kruithof, J. Aldridge, D. Hétu, M. Sim, E. Dujso,
and S. Hoorens, Internet-facilitated drugs trade:
An analysis of the size, scope and the role of theNetherlands. RAND Corporation, 2016.

2 Cyber Intelligence House. (2020) Dark web
intelligence data. https://cyberintelligencehouse.
com/

21 Ibid.
22 “AlphaBay, the Largest Online ‘Dark Market,’ Shut
Down | OPA | Department of Justice.” [Online].
Available: https://www.justice.gov/opa/pr/alphabaylargest-online-dark-market-shut-down. [Accessed:
10-Mar-2020].

3 Ibid.
4 D. Moore and T. Rid, “Cryptopolitik and theDarknet,” Survival, vol. 58, no. 1, pp. 7–38, Jan. 2016,
doi: 10.1080/00396338.2016.1142085.

23 “Dark web drug bust: Three arrested for Singapore
connect | Cities News, The Indian Express.”[Online]. Available: https://indianexpress.com/
article/cities/delhi/dark-web-drug-bust-3-arrestedfor-singapore-connect-6276649/. [Accessed: 10-Mar2020].

5 G. Owen and N. Savage, “The Tor Dark Net,” 2015.
6 J. Nurmi, “Understanding the Usage of AnonymousOnion Services Empirical Experiments to Study
Criminal Activities in the Tor Network,” 2019.
7 J. Nurmi and M. S. Niemelä, “Tor de-anonymisation
techniques,” in 11th International Conference, NSS,2017.
8

24 “Australian Peter Scully given life sentence forhuman trafficking, rape in Philippines, reports say ABC News (Australian Broadcasting Corporation).”[Online]. Available: https://www.abc.net.au/
news/2018-06-14/australian-peter-scully-convictedin-philippines/9868958. [Accessed: 10-Mar-2020].

“Category:Anonymous file sharing networks Wikipedia.” [Online]. Available: https://en.wikipedia.
org/wiki/Category:Anonymous_file_sharing_
networks. [Accessed: 07-Jan-2020].

25 Ibid.

9 K. Loesing, “Privacy-enhancing Technologies forPrivate Services,” 2009.

26 “Alleged pedophilia ‘dark web’ site bust by Interpol
brings arrests in Thailand, US and Australia andrescue of 50 children today - CBS News.” [Online].
Available: https://www.cbsnews.com/news/
pedophilia-ring-dark-web-interpol-operationblackwrist-thailand-us-australia-children-rescued/.
[Accessed: 10-Mar-2020].

10 K. S. Bauer, “Improving Security and Performance in
Low Latency Anonymous Networks,” 2011.
11 R. G. Jansen, “Privacy Preserving Performance
Enhancements for Anonymous Communication
Networks,” 2012.

27 “Paedophile Richard Huckle ‘murdered’ in prison| UK news | The Guardian.” [Online]. Available:
https://www.theguardian.com/uk-news/2019/oct/14/
paedophile-richard-huckle-found-dead-in-prison.
[Accessed: 10-Mar-2020].

12 D. M. Goldschlag, M. G. Reed, and P. F. Syverson,“Hiding Routing Information,” in International
Workshop on Information Hiding, 1996.
13 R. Dingledine, N. Mathewson, and P. Syverson,“Tor: The Second-Generation Onion Router,”in Proceedings of the 13th USENIX Security
Symposium, 2004.

28 Ibid.
29 “US indicts Russian cybercrime Dark Web market‘Infraud Organization’ suspect Sergey Medvedev,
arrested in Thailand - CBS News.” [Online].
Available: https://www.cbsnews.com/news/usrussia-cybercrime-dark-web-market-suspect-sergeymedvedev-thailand/. [Accessed: 10-Mar-2020].

14 https://www.torproject.org
15 Cyber Intelligence House. (2020) Dark web
intelligence data. https://cyberintelligencehouse.
com/
16 “Tor Metrics.” [Online]. Available: https://metrics.
torproject.org.

30 Tor Metrics. https://metrics.torproject.org/
31 Roderic Broadhurst, Matthew Ball, Chuxuan Jessie
Jiang. (2020) Availability of COVID-19 related
products on Tor darknet markets. https://www.aic.
gov.au/sites/default/files/2020-05/sb24_availability_of_covid-19_related_products_on_tor_darknet_
markets.pdf

17 Ibid.
18 Ibid.
19 C. Dion-Schwarz, D. Manheim, and P. Johnston,
Terrorist Use of Cryptocurrencies: Technical andOrganizational Barriers and Future Threats. RAND
Corporation, 2019.

52

Darknet Cybercrime Threats to Southeast Asia

32 CISOMAG. (2020) Over 230K Indonesian COVID-19
Patients’ Records Exposed on Darknet. https://cisomag.eccouncil.org/indonesian-patients-dataleak/

45 J. Nurmi and M. S. Niemelä, “Tor de-anonymisation
techniques,” in 11th International Conference, NSS,2017.
46 J. Aldridge and D. Décary-Hétu, “Cryptomarkets:
The Darknet As An Online Drug Market
Innovation,” 2015.

33 PWC. (2020) Why has there been an increase incyber security incidents during COVID-19?. https://www.pwc.co.uk/issues/crisis-and-resilience/covid-19/
why-an-increase-in-cyber-incidents-during-covid-19.
html

47 J. Nurmi, “Understanding the Usage of AnonymousOnion Services Empirical Experiments to Study
Criminal Activities in the Tor Network,” 2019.

34 Microsoft Threat Intelligence. (2020) Open-sourcing
new COVID-19 threat intelligence. https://www.
microsoft.com/security/blog/2020/05/14/opensourcing-covid-threat-intelligence/

48 J. Aldridge and D. Décary-Hétu, “Cryptomarkets:
The Darknet as an Online Drug Market Innovation,”
2015.
49 K. Masson and A. Bancroft, “‘Nice people doing
shady things’: Drugs and the morality of exchange inthe darknet cryptomarkets,” International Journalof Drug Policy, vol. 58, pp. 78–84, 2018.

35 Dumrongkiat Mala. (2020) ‹Dark net› a godsend
for paedophiles. https://www.bangkokpost.com/
thailand/general/1860539/dark-net-a-godsend-forpaedophiles

50 G. Owen and N. Savage, “Empirical analysis of Tor
hidden services,” IET Information Security, vol.
10, no. 3, pp. 113–118, May 2016, doi: 10.1049/ietifs.2015.0121.

36 Thomas Brewster. (2020) Child Exploitation
Complaints Rise 106% To Hit 2 Million In Just One
Month: Is COVID-19 To Blame?.
https://www.forbes.com/sites/
thomasbrewster/2020/04/24/child-exploitationcomplaints-rise-106-to-hit-2-million-in-just-onemonth-is-covid-19-to-blame/#15c5a0204c9c

51 A. Biryukov, I. Pustogarov, and R. P. Weinmann,“Trawling for tor hidden services: Detection,measurement, deanonymization,” in Proceedings IEEE Symposium on Security and Privacy, 2013, pp.
80–94, doi: 10.1109/SP.2013.15.

37 Michael Kapilkov. (2020) Criminals Are Selling
COVID-19 Infected Blood on the Darknet. https://
cointelegraph.com/news/criminals-are-selling-covid19-infected-blood-on-the-darknet

52 J. Aldridge and D. Décary-Hétu, “Cryptomarkets:
The Darknet as an Online Drug Market Innovation,”
2015.

38 Ibid.

53 K. Masson and A. Bancroft, “‘Nice people doing
shady things’: Drugs and the morality of exchange inthe darknet cryptomarkets,” International Journalof Drug Policy, vol. 58, pp. 78–84, 2018.

39 M. J. Barratt, “Silk Road: Ebay for drugs,” Addiction,
vol. 107, no. 3, pp. 683–683, Mar. 2012, doi:
10.1111/j.1360-0443.2011.03709.x.
40 M. C. van Hout and T. Bingham, “‘Surfing the Silk
Road’: A study of users’ experiences,” International
Journal of Drug Policy, vol. 24, no. 6, pp. 524–529,
Nov. 2013, doi: 10.1016/j.drugpo.2013.08.011.

54 “Payment Fraud | Crime areas | Europol.” [Online].
Available: https://www.europol.europa.eu/crimeareas-and-trends/crime-areas/forgery-of-moneyand-means-of-payment/payment-fraud. [Accessed:
18-May-2020].

41 M. J. Barratt, “Silk Road: Ebay for drugs,” Addiction,
vol. 107, no. 3, pp. 683–683, Mar. 2012, doi:
10.1111/j.1360-0443.2011.03709.x.

55 Ibid.
56 Cyber Intelligence House. (2020) Dark web
intelligence data. https://cyberintelligencehouse.
com/

42 M. C. van Hout and T. Bingham, “‘Surfing the Silk
Road’: A study of users’ experiences,” International
Journal of Drug Policy, vol. 24, no. 6, pp. 524–529,
Nov. 2013, doi: 10.1016/j.drugpo.2013.08.011.

57 Dan Goodin. (2013) Sudden spike of Tor users
likely caused by one “massive” botnet. Ars
Technica. https://arstechnica.com/informationtechnology/2013/09/sudden-spike-of-tor-users-likelycaused-by-one-massive-botnet/

43 N. Christin, “Traveling the Silk Road: A
measurement analysis of a large anonymous online
marketplace,” Proceedings of the 22nd international
conference on World Wide Web, Jul. 2013.

58 United Nations. (2019) World Population Prospects
2019. https://population.un.org/wpp/

44 J. Martin, “Lost on the Silk Road: Online drug
distribution and the ‘cryptomarket,’” Criminology &Criminal Justice, vol. 14, no. 3, pp. 351–367, Jul. 2014,
doi: 10.1177/1748895813505234.

59 Ibid.

53

Darknet Cybercrime Threats to Southeast Asia

60 Dan Goodin. (2013) Sudden spike of Tor users
likely caused by one “massive” botnet. Ars
Technica. https://arstechnica.com/informationtechnology/2013/09/sudden-spike-of-tor-users-likelycaused-by-one-massive-botnet/
61 United Nations. (2019) World Population Prospects
2019. https://population.un.org/wpp/
62 Ibid.
63 Ibid.
64 Ibid.
65 Ibid.
66 Ibid.
67 Ibid.
68 Ibid.
69 A. Biryukov, I. Pustogarov, and R. P. Weinmann,“Trawling for tor hidden services: Detection,measurement, deanonymization,” in Proceedings IEEE Symposium on Security and Privacy, 2013, pp.
80–94, doi: 10.1109/SP.2013.15.
70 M. Wesam, A. Nabki, E. Fidalgo, E. Alegre, and I. dePaz, “Classifying Illegal Activities on Tor Network
Based on Web Textual Contents,” 2017.
71 “Tor Metrics.” [Online]. Available: https://metrics.
torproject.org.
72 E. Çalışkan, T. Minárik, and A.-M. Osula, “Technicaland Legal Overview of the Tor Anonymity Network
Technical and Legal Overview of the Tor Anonymity
Network,” 2015.

54

United Nations Office on Drugs
and Crime (UNODC)
Regional Office for Southeast Asiaand the PacificUnited Nations Building, 3rd floor, Block B
Rajadamnern Nok Avenue
Bangkok 10200, Thailand
Website: https://www.unodc.org/
southeastasiaandpacific
Twitter: @UNODC__SEAP
Global Programme on Cybercrime
Vienna International Centre
P.O. Box 500, A-1400 Vienna, Austria.
Website: https://www.unodc.org/unodc/
en/cybercrime/global-programmecybercrime.html
Twitter: @UN__Cyber

UNODC would like to thank theGovernment of Japan for funding
this research.