< Back to Searchlight Blog

Effects of COVID-19 on the Darknet

Published on 07 Apr 2020 by Charlie

Countries’ attempts to thwart the Coronavirus appears to have had an impact on Darknet Markets possibly owing to widespread lockdowns affecting the ability of individuals to hide amongst the crowd, volatility in the World’s money markets and travel restrictions. Whatever the reasons Searchlight Security has observed a downward trend in the number of new listings on Darknet Markets.

New market listings for physical goods including cannabis, stimulants and dissociatives

Some have looked to capitalise on the outbreak with a move towards selling medical supplies. Several vendors are selling face masks, to help ward off the virus. Some ‘cures’ to COVID-19 are being offered for sale with an example being from lizardsquad who are reusing photos from their other listings whilst claiming:

“sent our scientists to the lab and trust us we can cure an entire country and Hospitals in china”-“some few infested countries with the virus have been on constant supply to save lives.”

Ventilation helps users in respiratory distress by assisting or replacing spontaneous breathing. During the current pandemic, there is an increased number of patients needing ventilation at hospitals, which has caused a worldwide surge in demand for ventilators, past the rate at which they can be produced.

Screenshot of a ventilator being sold on a darknet market

With this increased demand, vendors such as robertpark claim to be selling ventilators. However, there are a few inconsistencies with these claims. Firstly the vendor claims to have 1700 items available to purchase, secondly the vendor is only level one with 5 sales and finally they joined the market in February 2020, making their account relatively new.

The description for this item is also partially plagiarised from a recent news article, alongside the refund policy being nothing more than an advertisement for one of the vendors other items, M95 masks.

Darknet COVID-19 chatter

Mentions of COVID19 on the Darknet

COVID19 has become a trending issue on darknet forums, such as dread, where users are discussing how the quarantines and lockdowns will affect them. A popular topic is the paper produced by Yale university; “Guidance for People Who Use Substances on COVID-19 (Novel Coronavirus)”. Dedicated communities for the discussion have also been created such as the subdread “CoronaVirus”, where users keep a track of the number of reported cases.

Sexual predators often use the dark web to share and discuss child abuse content, with more than 300 users of a single site arrested late last year including 7 from the UK. With the country on lockdown people are spending more time at their computers. This has raised concerns from organisations such as the National Crime Agency (NCA), who are concerned that with children spending more time on computers, there will be an increased risk of them coming into contact with sexual predators.

Data suggests that Sexual predators are also spending more time on computers with an average increase in posts per week of 56% across three main darknet Child exploitation and sexual abuse (CESA) chats, compared with the start of the year.

Increased demand on darknet services

With people spending more time on their computers, more connections through Tor are being made. There were on average 3988 more connections to tor from the UK every day in the first 3 months of 2020 compared to the last three of 2019.

Source: Torproject.org

This increase in traffic may be behind the slowdown on sites that some users are reporting of on darknet chats. User illanu suggests that users should work together in order to make the service faster;

“As a result of Covid-19, increased web traffic at all websites, especially onion websites, has been an issue for everyone.

Firstly I suggest that only registered users be allowed to access” [chat name] “

Secondly, I request odd/even hours for log in based on your address. For instance, if your address is 519 High Life Drive, then log in at an odd hour, say 5pm or 3pm or 11am. If your address is 10 8th Street, choose an even hour to log in such as 4pm or 8am. If you don't have an address, just select a random digit, odd or even, and use this to determine the appropriate login time. And remember to try and stay not that long, no longer than 2 hours.”

Cryptocurrency volatility

Bitcoin closing price over the last month in USD. (data: coindesk.com)

The recent volatility of one of the most widespread and frequently used cryptocurrencies, Bitcoin, could be frustrating darknet market users. The majority of listings in darknet markets are priced in BTC. An example of how this can affect a vendor and buyers is that due to the price fluctuation their wallets are constantly changing value meaning that if vendors do not withdraw in time they can lose a lot of value. The time and cost to clear a BTC transaction is currently $1.4 but can vary a lot such as at the start of this month it was as low as $0.5135.

Postal services

Vendors are speculating that as the virus progresses, postal systems may back up if parcels are put into quarantine. Some online retailers and delivery services, such as Amazon, are restricting the movement of non essential parcels resulting in waiting times for a delivery slot surpassing 4 weeks. In the UK, Royal Mail has introduced a policy of no longer requiring a signature and have made changes to minimise human contact.

Conclusion

There has been a clear reduction in the number of new listing on Darknet markets. It is likely to be because of multiple reasons including uncertainty, postal services, national lockdowns restricting movement and cover and the volatility of crypto currencies. It will a while to see the full effects of COVID-19 on Darknet communities, but what is inevitable is that they will look for ways to adapt. Addicts relying on the darknet for their drugs may have to return to street dealers.

Try our Darknet Intelligence/Forensics tool for free, contact enquiries@slcyber.io


Latest News from Searchlight

20 May 2020

Europa market allegedly seized

The darknet market Europa, which offered a place of haven for users looking to buy drugs and weapons, including firearms, has become inaccessible. It is unclear as to whether the market was seized by authorities or if the seizure notice is just a ploy by the site admins in an attempt to avoid blame from its customers during an exit scam.

Read more...

19 May 2020

9 Million EasyJet customers details accessed in cyber attack.

Budget airliner EasyJet has released a statement notifying its customers that the email addresses and travel details of around 9 million user accounts were compromised in what it calls a “highly sophisticated attack", back in as early as January of this year.

Read more...

18 May 2020

Hackers claim to have "dirty laundry" on US President Donald Trump alongside many celebrities in law firm breach

One of the worlds largest entertainment lawyers who allegedly also worked for President Trump has been the victim of ransomware, with hackers threatening to sell off the acquired data to the highest bidder on the darknet.

Read more...

13 May 2020

Hacker sells millions of recently breached accounts on the darknet.

Unacademy, a service that claims to be “India’s largest learning platform” has reportedly had a data breach, with 28 million user accounts for sale on a darknet market.

Read more...