How Hackers Hide Themselves Using the Dark Web

A man looks at his computer monitor, where messages flash up from somewhere in the Dark Web. He's told he'll need to be screened. "Don't feel bad," says the next massage: "We do this for everyone. They tell him this small invasion of privacy is worth it. The hacking software they're about to sell him is expensive, but for anything he gets under $500,000, they only want 25%. If it's over five million, they only want 10%. "It's the sale of the century," the mystery person types. This is based on a true story. The hacker the guy is talking to is part of the DarkSide group. They provide what's called "ransomware as a service," meaning they sell people ransomware so they can then target someone with a lot of money.

This could potentially ruin them. Their data is held for ransom, and then comes the extortion part. The DarkSide hackers claim to be Robin Hood characters. Their ransomware is for extorting companies or governments, but thy won't let people hit a non-profit, a school, or any kind of health service. The targets might also be wealthy people, who usually have a lot to lose. Imagine if a billionaire such as Bill Gates had a deep, dark secret. Imagine this secret became known to the public. How much would Gates be willing to pay to suppress that information? Or how much would you be willing to pay? Because whether you're a billionaire or not, there's a good chance that your information is already out there on the Dark Web, which is why I'm so excited to partner with the sponsor of today's article - Aura. I decided to try out Aura for myself and I was absolutely shocked at what it found.

My data, tons of it, was out there on the web, just waiting to be used for who knows what. I shouldn't be surprised, after all, identity theft is the fastest growing crime in America with a new victim every fourteen seconds! That's why I've started using Aura. Aura is identity theft protection and fraud monitoring with near real time alerts, a VPN to keep you anonymous and your data encrypted, and anti-virus software all in one easy to use app. They even work to get any of your data that's already out there erased from the web, which has actually reduced the amount of spam and robocalls I receive. There's a good chance you have one, or maybe even a couple of these services already, but so did I, and you can see what good it did protecting my info from getting out there. It was like I had locked my front door, but left the back wide open! But with Aura, you have all the tools to remain protected no matter what the hackers on the Dark Web try. So start protecting yourself and your family from identity theft right now by going to aura.com/rnn. If you sign up using our link, Aura will give you a free, two-week trial so you can see for yourself how many times Aura finds your personal info on the Dark Web.

DarkSide isn't showing off when they say they only want 10% of anything over five million. Five million isn't unheard of in the world of ransomware attacks. You could potentially bring down a company like Apple with such an attack, certainly if you've managed to lock the company out of its own files and you are threatening to delete them. DarkSide is still around. In 2021, they targeted an oil pipeline company in the US called Colonial Pipeline. They took control of the operations, which was devastating for the company. About 45% of all the fuel used on the East Coast goes through this pipeline. The hackers said, "Give us 75 bitcoin (or $4.4 milion,) and we will give you your system back." They were paid within a few hours. Hackers often ask for cryptocurrency because it's hard to trace, especially if the hackers have taken extra precautions and anonymized the exchange. In some cases, they might even have hacked someone's bank account, so the money goes into it and then comes out without the person knowing, although this is tricky. It might be much easier in certain countries where banks don't monitor payments so strictly.

Back to the pipeline hack, the company later said, "It was the right thing to do for the country." It's thought DarkSide was able to do the hack because it bought a very important password on the Dark Web. DarkSide said they were after cash and didn't want to create chaos. Just pay up, and everything will be okay, they said. They've hit about ninety companies so far, most of which were in the US. They even get into the files of the companies, so they know the companies are able to pay the ransom. It's no use saying you're broke when your accounts have been seen. The US has had enough.

The government has now put a $10 million bounty on these hackers' heads. But will they be caught? We'll get around to that later. It's thought the DarkSide hackers are located somewhere in Eastern Europe, maybe Russia. The group might be made up of people not only from Eastern Europe but also from China, North Korea, Iran, and Syria. They certainly make spelling mistakes when they write messages. They like to do that. After that pipeline hack, they released a statement saying, "Our goal is to make money, not creating problems for society." You might now be thinking, released in a statement! If they can release statements, surely, they can be found! The news agency Reuters even sent messages to DarkSide's website. If that's possible, surely they can't remain in hiding for long.

The short answer is, they can, they might, or perhaps, they will. They're not alone in doing what they do. The BBC recently reported that Russian authorities had arrested hackers in Russia who went by the name of REvil. They also used ransomware to extort large amounts of money. When they were arrested, the Russian cops found over four million in cash and about $440,000 in bitcoin. They also seized twenty "premium cars." It's said this gang was prolific. In some cases involving rich people, perhaps the police were never even called. In some attacks, the authorities are not always contacted. After all, if Bill Gates did have a deep, dark secret, he wouldn't exactly want it to be known to everyone. That's the beauty of hacking scoundrels. We're not saying Gates is. We're just using him as an example because conspiracy theorists think he's up to no good. But if you do hack a real scoundrel, like robbing a drug dealer, the cops are usually not brought in.

Perfect! Game, set, and match hackers. It could even happen to you if you had enough cash to attract hackers. One day you might wake up to discover you are locked out of all your devices. You might just think you have some kind of hardware problem, but then your computer might flash up the words, "You've been hacked." This is exactly what happened recently to a man in Australia. His computers were down, and then the message flashed up. "Oh, Jesus," he thought. I this case, the hackers wanted fifteen million. They'd got into his systems and encrypted everything, meaning they owned the key to all his data. They said, "If you pay us, we'll give you the encryption key and be gone straight away." This guy had security, too, but obviously not enough. This kind of cyber criminality is now a huge global issue.

People and companies pay millions in ransom these days. The gangs of lore have moved on from the bloody streets. Cybercrime is a damn sight easier than the old-school kidnapping of a rich person's daughter. No one gets hurt these days, physically, at least. No thumbs and pinky fingers need to be sent through the post. The crimes are bloodless, but such financial crimes are what governments hate the most. Kill a neighbor, sure, get ten years. Steal from a bank or corporation, expect to be burned on the proverbial stake. What's even more disturbing is within this fairly new criminal enterprise, as we said, there is ransomware as a service. Anyone wandering around the Dark Web is a potential hacker. Just imagine it. Some kid is looking to invest some money, and instead of gambling on the stock market or betting on housing prices to go up, he can earn a cool few hundred thousand from buying some ransomware from a complete stranger. We are sure you all know what the Dark Web is, if not we are about to explain the concept.

You have the web you are using right now, which is the regular internet. Then you have the Deep Web, which are networks, such as what you might use at work. You can't just log into other networks. They're private. Your email is private. No one can search for it. It's hidden deep, man. And then there's the Dark Web. This can only be accessed with certain browsers, such as the Tor Browser. It uses something called onion routing. We won't go into all the technical stuff today. All you need to know is that the onion is called that because it has layers. That means the user can't be found. Their data is anonymized, which means removing all the identifying information. In the Dark Web, you're a ghost. That's why people go on the Dark Web and don't feel too concerned about buying a kilogram of Colombia's finest or a bucketful of ecstasy pills. It should be said, in terms of drugs, some of the largest sellers have been caught in the past. While the Dark Web provides a certain amount of anonymity, if the FBI or another similar authority wants you, they can sometimes find you. How?

They don't always say, but in the game of hide and seek, it seems they sometimes cheat. Still, ask any Brit whose addicted to drugs where he gets his "gear" these days. He might have been given a contact from the Dark Web. He then uses encrypted messaging to contact the dealer, a dealer who could virtually be anywhere. He then asks for some drugs, maybe a gram or ten of brown (heroin), and it's delivered in the post, hidden really well in the package. This is the modern world. This is why crime these days is often of the cyber kind. The gangs have evolved, or in the parlance of the great TV show "The Wire", they've changed up their game. The ransomware folks work on a different level. These people really know how to hide. It's said that these days they are all over the Dark Web; that the ransomware business is "thriving". The hacking gig is booming right now because hackers are smarter than ever regarding not getting caught. If you don't believe us, listen to this. In 2022, a criminal intelligence group known as Forensic Pathways took a good look around the Dark Web using dark search engines.

They evaluated close to 35 million Dark Web URLs, which included various markets and forums. They found ransomware products and services, which in total numbered 475 web pages. The media reported that many of them were "aggressively promoting ransomware-as-a-service." No ransomware was exactly the same, but the upshot is they all held data for ransom so someone could extort money. You might have heard of WannaCry. This was one of the ransomware packages for sale. Not long ago, it got into a huge number of machines in 150 countries. It caused mayhem for Britain's National Health Service, which let's face it, wasn't cool at all. It's said there were 623 million ransomware attacks in 2021. No exact figure was given for the losses, but one security firm said the average cost of an attack on a big business is $1.4 million. Attacks on regular people are much bountiful but might feel like a lot to the victim. If you're going to be a criminal, this is a great business to be in. A global cyber-security firm called Black Frog wrote on its website in 2021, "With damages from cybercrime expected to hit six trillion this year (up from three trillion in 2015), we expect the number of ransomware attacks to increase and never forms to become more sophisticated and disruptive." Three trillion sounds like a lot. Other sources say it might be between $600 billion and one trillion.

This is still a hefty figure. That just boggles the mind. We know some of you RNN fans out there are thinking right now, "Hmm, this sounds like something I could get into..." Well, just remember that prison sentences for cyber-criminals are about as harsh as they come. If your country has the death penalty, you won't get that, although you could in Pakistan. Still, receiving a life sentence is not unusual at all. You are probably now thinking, how come if so many people are selling this stuff, there haven't been more arrests? Well, you already know that your data is anonymized when you go onto the Dark Web. Like the guy in the intro, you could be looking at the ransomware catalog of some website, and you wouldn't know a thing about the people behind it. Not where they live, not where their computers are. And it goes without saying that people on the Dark Web don't generally sign off with their own name.

That's where forensics comes in. Forensics is basically the science of trying to find out who criminals are. So, with the Dark Web, forensic officers will try to link the messages or websites to the actual people. You already know that's hard since the DarkSide crew is still in business. But you know it's not impossible because the Russian REvil guys are locked up. Still, they are incredibly hard to track down. They are hidden not just within the Tor Browser but hidden behind many more layers. You all know what a VPN is (a virtual private network) because that's how you watch stuff on the BBC iPlayer when you're not in Britain, or at least, ahem, that's how some people do it. When you're using a VPN, your data is encrypted and then re-routed to another server. In the BBC iPlayer case, the server is in Britain, so the BBC website thinks that's where you are. Eezy peezy, lemon squeezy, as the Brits might say.

You can also use a proxy server, which will re-route your connection via a third party, so the website you hit won't have your personal data. This is why the FBI often says things like, "We think the attackers might be somewhere in Russia or some part of Eastern Europe." They might know that not from following digital tracks but from other forensic evidence regarding names, language, etc. Just like when the cops are looking for serial killers, criminal profilers can also draw up profiles for hackers. If they are clever, they' don't leave a digital footprint at all, not just when they're selling ransomware on the Dark Web, but also when they're manually executing an attack. Maybe the guy who bought that ransomware at the start of the article wasn't just using Tor and a VPN when he talked to the criminals, but he later protected himself when he attacked his victim. He was in and out and gone, and it was as if he'd never been there. It reminds us of some dialogue in the movie "The Usual Suspects". "That was his power. The greatest trick the Devil ever pulled was convincing the world he didn't exist. And like that, poof. He's gone."

The greatest trick a hacker ever played was convincing his victim he didn't exist. And, as we have shown you, it doesn't take a genius to hide. The genius part is writing the program that performs the attack, which brings us to something else. Hackers might also hijack something called an "RDP session". If you don't know already, something you might have an issue with your computer, so you have to allow someone to get into your computer remotely. Sometimes with Microsoft, the folks who start using your computer are as far away as India. When someone does this for the first time, watching them open and close files from halfway across the world while you're sitting there feeling exposed, can be unnerving. It's like that office management training activity when you have to trust people to catch you when you fall backward.

In the end, he tells you the session is done. You get the message that the session is over. Relief. You can go to bed. But what if someone can unlock a locked, closed session while you're fast asleep? It's happened in the past. Think about it. If the guy in India can take over your computer, surely there are ways for hackers to do the same. In other cases of hacking, it might be possible to hack a website and use its server from which to launch an attack. Pure, unadulterated anonymity! With ransomware, they might get information by sending you a dodgy file. It's a virus. It's malicious. But you, you can't resist opening things. It might come from anywhere. A video file might say, "OMG. Wow, watch this! This is crazy." And you, well, an OMG always gets you. When you open the file, you impetuous fool, malicious software gets into your machine. It might wait until your computer is dormant to infect your drives, shared drives, servers, attached computers, and other systems.

This is why you should never just open a file without knowing what it is. Even if it seems that a buddy just sent you it through email or through Messenger. The hackers have just hacked his email or gotten access to his Messenger. It happens all the time. Some people will do stuff like answer a question on a Facebook page which asks them what their dog's name was when they were a kid. Sometimes, these are just harmless ways to promote companies, but sometimes hackers can use that information. It's called phishing. Stay well away from putting anything personal online, especially when you don't even know who you are communicating with. So, don't open mystery files. If they are sent by a friend, contact him or her and ask if they sent it. And don't go talking about yourself in the comment boxes of groups you don't know on Facebook. Obviously, big companies and people like Bill Gates have amazing security, but humans are humans, and they sometimes make errors.

\You can have the best security in the world and a staff member who puts his pet's name on Facebook. In that pipeline attack, it's thought the hackers got a VPN password from one of the staff. As we told you, it is very hard to catch hackers, but as you know, it does happen. Take, for instance, a guy named Eric Eoin Marques. He was offering hosting capabilities on the Dark Web for a long time. He hosted websites for drugs, hacking, and money laundering, and websites where people posted lots and lots of illegal images. So, how did they break his anonymity? That's not known exactly because the FBI, it seems, didn't want to talk about it. Marques himself said he thought it was the hackers who work for NASA. Remember, many hackers end up working for the other team. If you can beat them, join them, and ask for lots of money.

The Electronic Frontier Foundation, a civil liberties group, said, "It does a disservice to our criminal justice system when the government hides techniques of investigation from public and criminal defendants." They accused the government of using illegal methods to catch Marques. You might think, well, that seems fair, but as we know from Edward Snowden, the government can sometimes be blamed for using tentacles to go to places they have no right to go to. Nonetheless, cybercrime is getting out of hand. It's thought the government these days manages to arrest only about 5% of these criminals.

Maybe crime does pay. Ask any old-school gangster or a common drug dealer about the chances of getting caught. They will tell you that, in the end, everyone gets caught. Or they die. It's one or the other. But that's not always the case with cybercrime. Obviously, this highly unethical way of living is still dangerous, and as we said earlier, if you are caught, you can kiss goodbye to the rest of your life. The US government says it will find you, never mind where you are hiding out in the world. The Justice Department proudly announced in 2021: "Our message to ransomware criminals is clear. If you target victims here, we will target you."

By: Tannor Cannon | Nov 16, 2022

Read Next: The Coder Who Became a Criminal Mastermind - Paul Le Roux