Aidan Murphy: Hello, and welcome to another episode of The Dark Dive, the podcast that delves into the depths of the dark web. My name is Aidan Murphy and I'm your host as each episode we look at different aspects of the dark web. In the podcast feed, you can already find the entire limited series. In other episodes, we look at how the dark web works and we look at other areas of the dark web, like marketplaces and ransomware leak sites. In this episode, we're going to look at dark web forums, the place where criminals go to talk to each other, sharing tips, news and collaborating with one another. To discuss this topic, I'm joined by two individuals who spend their time trawling through the contents of dark web forums. Vlad, a threat intelligence analyst at Searchlight Cyber. Hello, Vlad.

Vlad: Hello, Aidan. Hello, everyone.

Aidan Murphy: And Joe Honey, one of Searchlight Cyber's threat intelligence engineers. Hello Joe.

Joe Honey: Hello, Aidan. Hello guys.

Aidan Murphy: Great. Before we jump in, can I just ask each of you to maybe give a quick overview of your role to listeners? We'll start with you, Vlad. What does it mean to be a threat intelligence analyst? What does your day-to-day look like?

Vlad: Well, I'm responsible for monitoring cyber criminal activity on underground forums, marketplaces, instant communication platforms. Basically anywhere that threat actors may interact with each other. As well as maintaining and ensuring elevated access on closed sources, analyzing and researching threat actor behavior and so on and so forth. Basically, anything that involves movement by threat actors of any kind.

Aidan Murphy: Brilliant. Well, you sound like the right person to speak to for this particular episode and we're going to talk about what that means in a minute. Joe, what does it mean to be a threat intelligence engineer? How does that, I guess, differ from Vlad's day-to-day?

Joe Honey: Thanks, Aidan. My role differs from Vlad in that it's very much more sales focused. I specialize working with our customers, helping them get the best from our tools and our data. A large part of that is technical. You know, what do our tools do, how do they work, how do customers use them but a massive part is understanding what criminals are doing on the dark web, how they're doing it, where they're doing it, why they're doing that and then translating that into a format that our customers can use and, kind of, guide their searches, ultimately making sure they get what they want out of our tools and our data.

Aidan Murphy: This episode, we're going to look at dark web forums. Our listeners may have listened to our last episode on dark web marketplaces. I think many will be familiar with the idea of Internet forums, the likes of Reddit. A good place to start maybe is how dark web forums differ from the forums that you might find on the clear web. Vlad, what's different between dark web forums and clear web forums?

Vlad: Of course, in terms of structure, there isn't that much of a difference, to be honest. It's basically the same thing. I wouldn't compare it to Reddit, apart from Dread which is a bit of a different kind of cyber crime board but most of the forums, they actually resemble regular forums that you see with car enthusiasts and art people and so on. I think this is because every forum is structured into a few categories, usually a marketplace, learning and knowledge part and everyone gets to click on their specific topic and they can go on from that point and basically interact with other forum members who have similar interests. Those interests vary quite a lot. It's a very similar place, it's a very similar structure. Only the topics are a bit more illegal sometimes. Most of the time but, yes, in large, it's basically the same thing. It works in the same way, it's just a different topic.

Aidan Murphy: Interesting. I guess that's quite helpful for the listener. If you know what an Internet forum looks like, you can imagine a dark web forum but the content is different. Joe, what type of things do people talk about on dark web forums that maybe they don't talk about on regular forums or do? Is there a crossover?

Joe Honey: Absolutely everything gets discussed on the dark web, really. I mean, as Vlad's, kind of, hinted to, probably the majority of content on dark web forums is illegal or shady in some shape or form. Everything from, you know, this particular piece of malware, how do I buy it, access it, use it, 'I've got this particular item or piece of data to trade'. You know, everything, kind of, illegal is discussed on the dark web. Equally as well, there is a lot of what could be called normal content on dark web forums. There is people sharing news stories and, you know, discussions about current politics and things like that. I was looking this morning and stumbled across a thread dedicated to a dog which had passed away but the dog was 30 years old and there was this massive outpouring of support. Yes, on the whole, these forums are quite dark places to hang around but you did get odd little, sort of, funny moments and moments of light and good humor and so on.

Aidan Murphy: Why do you think people use dark web forums instead of clear web forums then? Is it a privacy thing or is it because they want to talk about things that typically would be frowned upon or maybe even illegal on the clear web?

Vlad: I would say it's just because they know that on those specific forums, they're going to get an answer for their question because those people that also joined the forums have common interests. It makes sense to just go onto the dark web forums just because you know that there's someone there who has similar interests as you and you might get an actual useful answer while asking the same question on a regular forum might not lead you anywhere because there aren't similar people over there. There is no simple answer to this question, it's just a matter of choice for everyone. There is a lot of factors that might change this. For example, in some countries, there are some laws that prohibit people from using normal forums, countries like Iran and so on, so they are forced to go onto the dark web to ask questions that may not be seen as illegal. There are plenty of factors out there.

Joe Honey: I think one of the other things for me, you know, if you're after illegal content, the dark web is the place to go but I think one of the other attractive parts to a dark web forum is the fact that they are anonymous. You know, the Internet is general anonymous. You can de-anonymize people and work out who they are and so on but the dark web is even more anonymous than that and because of that perceived anonymity, you know, people feel a lot freer to be who they want to be, look for what they want to look for, talk about what they want to do, share opinions that would be problematic elsewhere. I think that, kind of, enables people to be, you know, the version of themselves they want to be almost.

Aidan Murphy: That's really interesting. The sense I'm getting from both of you is almost it's about this, kind of, community feel, finding like-minded people, having the ability to speak freely. If people want to find out a little bit more about how the dark web is more anonymous than the clear web, we have a separate episode on that, the first episode in the series. You've mentioned one of the forums, Dread, Vlad. Are there any other, I guess, noteworthy forums on the dark web that people should know about?

Vlad: It really depends on the type of activity you're looking to get yourself into but usually with cyber crime, the most used at the moment in terms of English language forums is Breach forums. It's a reincarnation of Right forums, which was taken down a couple of years ago, which then morphed into Breach forums, which then morphed again into another Breach forums because the first version was taken offline for a bit as the admin was arrested but now it still lingers on, it's still here. The most well-known Russian language forums at the moment are Exploit and XSS which have been around for almost twenty years. There are plenty of other forums but these three are the trifecta. There's others that popped up more recently like RAMP, which widely accepts ransomware discussions, while Exploit and XSS actually banned this to make sure they're not targeted by law enforcement.

Aidan Murphy: Do either of you have a sense of why hacking forums are able to stay operational for much longer than marketplaces?

Vlad: The forums are seen as a community rather than a money-making platform. The admins of cyber crime forums are there for the community, they're there for the reputation. They just want to make sure they keep the community living and alive.

Joe Honey: On forums there is a lot of non-illegal content. If I was to sit and have a conversation with Vlad about how to hack into a particular system and the methods I would use, that in itself isn't illegal. Me going to do it is, absolutely, but me just talking about writing code is perfectly fine. Because of that, the proportion of illegal content is much lower. I also wonder if there's an element of a resourcing challenge for law enforcement. If you've got resources to target and take down one dark web community, are you going to go for the forums where there's some bad stuff but also lots of not illegal stuff, or the marketplace where the vast majority is illegal goods? You're going to get more return on investment by taking down that marketplace.

Joe Honey: Yes, OpSec, operational security. Essentially, it's about the measures that you take to ensure the security of you, yourself, your operation. The exact same thing that applies in the military and intelligence community applies in the dark web.

Vlad: A good example - someone named Conor Fitzpatrick who was the admin of Breachforums. His alias on the forum was Pompompurin and he was actually found and arrested because he used one of his real email addresses. That was a huge OpSec flaw.

Aidan Murphy: One thing I just wanted to bring up for the benefit of our listeners - it is worth saying that some of the forums we're talking about don't only exist in the dark web, some of them exist on the clear web and deep web. Vlad, are there any kind of barriers to stop regular people just accidentally wandering onto them?

Vlad: There is absolutely no barrier, especially with free forums like Breachforums. Anyone can join. Some forums require extra verification - on RAMP forums, you either pay $500 to the admins via Bitcoin, or provide proof that you are reputable on a secondary forum like Exploit or XSS. It's a way for the admin to ensure that whoever is joining the forum is knowledgeable of hacking. Most of the well-known forums also have a surface web option for those who don't want to bother with TOR.

Joe Honey: The dark web has this aura of being this really mysterious, hard to access thing. It's not. The main technical barrier is just working out where to go. There isn't a Google for the dark web, there isn't a site index, so you have to know the address. Addresses on the dark web are just 56 random characters thrown together. That's the only technical barrier.

Aidan Murphy: This leads me on to initial access brokers. Joe, maybe if you could explain what an initial access broker is and how they operate?

Joe Honey: An initial access broker specializes in that very first part of an attack on a business - getting a foothold into that organization. They will exploit a vulnerability, gain a foothold inside the systems, do a bit of enumeration to understand what potential assets are there, then package up that access and try to sell it on the dark web. Accesses could go for $20-50 for a small company, or tens of thousands of dollars for a large organization. They do that on forums because forums are much better suited to that product - there's a back and forward nature to these negotiations that doesn't suit a marketplace model.

Vlad: Monitoring initial access sales is quite relevant. Sometimes actors provide too much information which would allow any security team to actually identify how the actor got there. We've seen actors providing so much detail about companies that the actual company was able to identify themselves, they identified the door that was accessed to get into their systems and they secured their network before anything much happened.

Joe Honey: The initial access broker post sits much earlier in the kill chain. If you can identify you being attacked much earlier, it's going to be quicker, cheaper, and easier to fix that particular vulnerability rather than waiting until the ransomware is detonated and the many millions in ransoms, downtime and negative media exposure follow.

Aidan Murphy: Brilliant. Well, that seems like a good note to draw a line under this episode of The Dark Dive. A big thank you to Vlad and Joe for joining me and if you can't wait to find out more, remember, you can follow us for free on Apple Podcasts, Spotify and whatever podcast app you have on your device. Until next time, stay safe.