NZ Incident Response Bulletin - October 2024

The October edition of the NZ Incident Response Bulletin was published today. The bulletin is a monthly high-level executive summary containing some of the most important news articles that have been published on Forensic and Cyber Security matters during the last month. Each Bulletin also includes a section of our own content, based on a trending theme, this months being?“Dark Web Monitoring – Data Leak v Forums”.

Introduction

Both data leak sites and dark web forums play significant roles in the cybercriminal ecosystem, but they serve different purposes and present unique challenges for organisations trying to defend against cyberattacks. Understanding their differences is crucial for crafting a comprehensive dark web monitoring strategy.

Data Leak Sites

Data leak sites are platforms where cybercriminals, especially ransomware groups, post stolen data as leverage to pressure victims into paying ransom. These sites are typically maintained by organised criminal groups and are used to publish sensitive information if a ransom is not paid. The primary function of these sites is extortion and showcasing proof of a breach, offering a threat to further release confidential or sensitive data.

Monitoring data leak sites is relatively straightforward in comparison to forums. These sites are often public or semi-public, designed to attract the attention of the victim or external parties. However, they can still present challenges, such as requiring manual interventions when CAPTCHA or anti-scraping tools are used to block automated monitoring systems. Additionally, attackers often remove data after negotiations, limiting the window for organisations to respond. Organisations need to act swiftly when their data appears on these sites to minimise damage and take appropriate action, including breach notification and legal responses.

These sites have become central to modern ransomware operations, where cybercriminals publish small portions of data to prove they have sensitive information. If the victim does not comply with ransom, the rest of the data is leaked. This tactic, known as "double extortion," is a growing trend where not only is a ransom demanded to decrypt files but also to prevent the exposure of stolen data.

Dark Web Forums

Dark web forums, on the other hand, serve as broader discussion and marketplace environments where cybercriminals communicate, share techniques, and buy or sell illegal goods, including stolen data, malware, and hacking tools. These forums are not solely dedicated to leaking stolen data but are also places where criminal networks organise, collaborate, and trade resources. Membership in some forums can be exclusive or require invitations, which makes access more difficult for monitoring.

Forums are often harder to monitor due to their hidden nature. Many forums require invitations or vetting processes for new members, meaning even security researchers can face difficulties gaining access. Forums frequently use encryption and anonymity tools like Tor, making it challenging to trace conversations or individuals. They are also temporary in nature, with some forums disappearing or rebranding frequently to avoid law enforcement detection, further complicating monitoring efforts.

Dark web forums are more versatile and act as the breeding grounds for cybercrime. Criminals use them to share tactics, techniques, and procedures (TTPs) to launch ransomware attacks. These forums allow actors to collaborate, obtain initial access tools, malware, and zero-day exploits, and even recruit insiders from targeted organisations. They also help cybercriminals find buyers for stolen data or credentials, enabling broader criminal activities beyond extortion.

Monitoring dark web forums requires more sophisticated techniques. Automated scrapers are used but often need to be tailored to work in these highly anonymous and encrypted environments. Human analysts play a critical role in manually navigating and interpreting conversations, identifying emerging threats, and extracting useful intelligence. The broad volume of data in these forums makes it difficult to distinguish between real and exaggerated threats, adding complexity to the monitoring process.

Conclusion

Both data leak sites and dark web forums are essential elements of the cybercriminal infrastructure, but they serve distinct functions. Data leak sites are primarily used for extortion following ransomware attacks, whereas dark web forums are used for broader criminal collaboration, planning, and trade. Effective monitoring of both requires a combination of automated tools and human expertise to overcome the challenges presented by encryption, anonymity, and the sheer volume of data.

By incorporating strategies for monitoring both types of platforms, organisations can stay ahead of cybercriminals, respond to emerging threats more efficiently, and protect their sensitive data from being exploited.

Feel free to contact us to discuss your Dark Web monitoring requirements.

The Bulletin:

To obtain a full copy of the Bulletin, please visit https://incidentresponse.co.nz/bulletin