- Confidential and Proprietary -
Luminar Annual Threat Landscape Report Page 4
which requires members to be active contributors on the forum to gain full access to the contents
of the posts. All these factors help threat actors to isolate their activity from the public and force
researchers to use manual collection efforts.
Screenshot from the English-Speaking Forum, Breached Forum. Source: Dark Web
Traditionally, these forums were the largest and most common platforms for hackers to share hacking
resources. More recently, Telegram is often used in a similar fashion. There are numerous dedicated
hacking groups operating on Telegram, where hundreds of members actively discuss various aspects
of cybercrime and share techniques to exploit data dumps.
2.2 Underground Marketplaces
Underground marketplaces are platforms where vendors advertise illicit products, including but not
limited to breached databases, stolen passwords, compromised login credentials, credit cards, and
web shells. Access to marketplaces differs from one marketplace to another. While some
marketplaces are accessed using the surface web, several underground marketplaces operate on
TOR, which adds an extra layer of encryption and makes transactions harder to trace.
4
Underground marketplaces sellers often obtain the data they sell using an information stealer
malware (also known as InfoStealers) to collect data from the victims’ infected systems. The stolen
4
https://intel471.com/blog/how-threat-actors-use-underground-marketplaces