But Russians fleeing the country since the war have still been able to buy drugs on the dark web. Cannabis is also a popular drug bought on the Russian darknet. Afilipoaie said analysis by TRM Labs shows a wide variety of criminal groups are laundering funds through these platforms, including those connected to non-drug related crimes, such as those selling credit card data and other personal information through fraud hubs, where people’s stolen identities are traded online. There is direct evidence that two of the three markets in question offer money laundering services. In the post-OMG dominance period, OMG retained a number of those former Hydra counterparties, but lost a significant share of their illicit activity to the other two markets across all categories. The color of the lines show the former Hydra users’ category of activity and the thickness of the lines show the proportion of their activity flowing to new markets after Hydra was shut down.
- Buyers can browse through the marketplace using filters like domain name, platform (Google, PayPal, Steam, etc.), or country.
- The dark web has become an immense centre of criminal activity, a fully working marketplace where buyers and sellers may buy banned goods and services without any fear of detection.
- We’re back with another video in our Webz Insider video series on everything web data.
- Youth are drawn into this high-tech drug economy, often working as couriers or “kladmen” for online shops—a job that comes with high risks, including violence, criminal charges, and addiction.
- And over the last 9 months, using a mix of publicity stunts and crippling cyber attacks on each other, OMG, Kraken and around 10 other darknet markets have been engaged in a tit-for-tat turf war for Hydra’s throne.
Russia Sentences Alleged Founder Of Hydra Darknet Market To Life In Prison
The entity “DNM Aggregator” that appears within each category refers to a service we’ve identified as being in control of multiple, disparate darknet markets. By contrast, it appears today’s darknet markets largely serve specific niches and have individually organized themselves into unique criminal functions, which we determined when examining the origin points for darknet market inflows last year. In total, darknet markets and fraud shops received $1.7 billion last year, a rebound from 2022 — the year that saw the sizable Hydra Marketplace close.
Darknet Markets Explained
Twelve months into the war, the fleet had grown to some 600 tankers and other types of vessels. But Russia has been successful in circumventing these sanctions, especially through its extensive use of so-called shadow vessels, which are old and lack proper insurance. They and other Western countries already promised to phase out Russian crude oil from their own markets. In addition to serving the transportation needs of Russia (as well as Iran, North Korea, and Venezuela), the shadow fleet forms quintessential “gray zone” aggression, causing tangible harm that targeted countries can do little to punish.
Protecting Against Russian Market–Linked Threats
With the closure of giants such as AlphaBay, many sellers and buyers migrated to Abacus in search of a new home, and boy did they find it.This marketplace has over 40,000 listings, offering everything from illegal drugs, fake documents, stolen credit cards, and fake IDs to phishing kits and hacking tools. Before that, Hydra not only dominated darknet market sales, but also served as a major money laundering service for criminals of various stripes, including ransomware operators, scammers and money-mixing services, officials said. Payment for goods and services on dark web marketplaces are usually made using anonymous cryptocurrencies like BTC.
Hydra alone accounted for an estimated 80% of all darknet market-related cryptocurrency transactions in 2021. Was there any russian dark market in the past who ever got seized by authorities on russian soil? According to the Chainanalysis report, four out of five of the highest-earning dark net markets in 2022 were involved in the drug trade. These underground online marketplaces allow dealers and buyers to operate covertly, challenging law enforcement investigations and arrests. Technological advances have made the battle against cybercrime syndicates all the more challenging for law enforcement, and the same encryption and anonymity tools are being used to run the dark net markets.
World's Biggest Darknet Marketplace, Russia-linked Hydra Market, Seized And Shut Down, DOJ Says
Though the drug transactions were limited to Russia and its geographic neighbors, the cyber and money laundering tools were available to anyone in the world willing to pay. Vendors on Hydra also offered services such as “Hacking for Hire,” “Ransomware as a Service” (“RaaS”), and a myriad of money laundering features. Over the years, dozens of large DNMs have been established and eventually shut down by law enforcement, including AlphaBay, Dream Market, Wall Street, and, most recently, Hydra. Ulbricht was eventually arrested by US law enforcement and Silk Road was seized and taken offline. Silk Road not only aggregated thousands of drug vendors, it created a user-friendly interface that resembled a clear-net shopping website. The boom in dark e-commerce is also partly to blame for a recent surge in global ransomware attacks, which were expected to inflict damages exceeding USD 20 bn in 2021, according to a 2017 report (pdf) by CyberSecurity Ventures — that’s 57 times the costs they inflicted in 2015.
Are you struggling to stay on top of the main dark web markets worth monitoring? Instead, they must gain access to multiple, hyper-secure markets and then regularly monitor this wide array of smaller, highly localized platforms. By offering heightened anonymity and stronger defenses against law enforcement, these markets attract criminals who feel they provide a safe environment. As major players tear each other apart, new, niche markets are carving out their own territories, often with a sharp focus on specific categories of illicit goods. Historically, the darknet drug trade has been dominated by large, multi-purpose platforms like AlphaBay and DrugHub.
Industry-Specific Cyber Threat Intelligence Powered By Agentic AI
As for drug markets serving Western customers, ASAP Market held a 25.0% share, followed by Mega and Incognito. In addition to that activity, markets like these host vendors that advertise their own cashout or swapping services, resulting in tens of millions of dollars in laundered funds. When it comes to cybercriminal enablement, markets like Kraken Market, the DNM Aggregator, and Exploit.in are go-to services, providing bad actors with tools to carry out ransomware attacks, hacks, and more. According to the Tor Metrics data in Tables 1 and 2, Russia has accounted for upward of 20% to 35% of the bridge users by country since December 2021, when Moscow tightened the dark web/VPN restrictions. The ease of use with market-specific apps built for Android operating systems allowed ready access to Russian markets like “RuTor,” “Blacksprut, and “OMG!
Darknet Marketplace Shutdown Upends Russia’s Illegal Drug Market
However, in recent decades, as Western governments have imposed economic sanctions on Iran, North Korea, and Venezuela, the fleet has become an established phenomenon. Because the world lacks a maritime police, vessels have operated in this manner for practically as long as there has been an organized maritime industry. If countries do try to block dark ships from their waters, or escort them away, it could prompt retaliation and escalation by Russia. Their presence poses considerable risk to other ships, to the environment, and to countries experiencing maritime accidents caused by the vessels. It’s affecting Russian youth heavily, leading to violence, criminalization, and increased synthetic drug dependence. Youth are drawn into this high-tech drug economy, often working as couriers or “kladmen” for online shops—a job that comes with high risks, including violence, criminal charges, and addiction.
Cybersecurity experts should pay close attention to these trends, as they often indicate emerging threats and profit-generating tactics among the cybercriminal forums. It offers counterfeit documents, financial fraud tools, hacking and malware services. Active for a decade since 2014, it is a widely used credit card shop used to source stolen credit card information such as dumps, CVVs, Wholesale Accounts. It maintains a very strict level of user verification and integration with an official Telegram account to provide real-time updates to users. Some people go a step further by using a virtual machine or a dedicated device just for dark web browsing. If you ever decide to explore the dark web, protecting your identity is crucial.
The shadow fleet poses mounting risks to other vessels, to coastal countries, and to countries in whose search and rescue areas of responsibility the vessels may have incidents. It is, indeed, vital for governments and legally operating shipping companies to have a clear picture of vessels and accidents involving the shadow fleet, and it’s equally important for environmental organizations and seafarer welfare organizations to have a comprehensive understanding of the accidents. The nature of the shadow fleet’s aging and poorly maintained vessels makes incidents and accidents far more likely than is the case in regular shipping. Tanker traffic from Russia via the Baltic Sea gives a good indication of shadow fleet activity (though some tankers departing Russian ports are not dark ships).
By analyzing threat actor motives and tactics, he provides timely intelligence that helps readers understand and anticipate the security challenges of tomorrow. His reporting focuses on ransomware gangs, data breach incidents, and state-sponsored cyber operations. This was starkly illustrated in a recent global sting that dismantled a massive dark web network dedicated to sharing child exploitation material.
The bus blocked two traffic lanes on a road near Russia’s Ministry of Foreign Affairs before security forces removed it an hour later. For those who are enveloped within country conflicts and severely restricted from what they can view or say online, the dark web serves as the only avenue to communicate or see the outside world. For many in the United States, it merely remains a novelty—a gateway into a shadowy underworld where contraband and taboo reign supreme.
“Nobody is interested in taking the vessels into a port and arresting the crew, because then you’re stuck with the ship in your harbor. UNCLOS provides more significant rights to vessels traveling in countries’ exclusive economic zones (EEZs), which extend 200 nautical miles beyond the territorial waters. The United Nations Convention on the Law of the Sea (UNCLOS) grants vessels the right of innocent passage, which means the right to “freely navigate through territorial seas.”23Jennifer El-Fakir, “Retaliatory or Lawful? Although the International Oil Pollution Compensation Funds (IOPC Funds) provide financial compensation for oil tanker spills in its member states, it’s not yet clear whether it will compensate coastal states for spills by shadow tankers. Such monitoring provides insight into the vessels involved and the type of incidents caused, which can be used for forward planning. The fact that the vessels frequently engage in risky ship-to-ship transfers further adds to the risk of incidents.
Some of the best-known names include Abacus Market, Russian Market, and BriansClub, all with thousands of illegal items available.Despite closures by authorities or the typical “exit scams” (when a marketplace disappears with all the money), these sites continue to pop up. "As a result, they are much easier for darknet vendors to distribute and sell cheap, so their popularity has exploded." "These drugs are comparatively easy to make using basic equipment and precursor chemicals imported from countries such as India and China," said researchers Max Daly and Patrick Shortis last month in a report for the Global Initiative Against Transnational Organized Crime. Before being disrupted in April 2022, Hydra "accounted for 80% to 90% of all drug sales on the dark web," largely of synthetic stimulants including cathinones, says the UN's World Drug Report 2024. Authorities said Hydra's vendors supplied their drugs by stashing them in predetermined dead-drop locations, aka caches. On April , the Genesis market was seized as part of the international law enforcement crackdown dubbed “Operation Cookie Monster". The site had specialized in the sale of “browser fingerprints”.
People in Russia and the U.S. were the source of over $284 million to illicit online marketplaces in 2020, blockchain research firm Chainalysis said in its latest report. In April 2022, the servers of Hydra, the largest Russian darknet drug market, were closed in Germany. “They show an affluent lifestyle with expensive apartments, luxury brands, but with a touch of illicit intrigue.” Many of Telegram’s Russian drug bloggers are most likely sponsored by new darknet drug shops. So we can say that the issues of harm reduction and preserving the health of people who use drugs have become an integral part of the Russian darknet.” In Georgia, on its southern border, where more than 100,000 Russians have fled, there is Matanga, a local Russian-speaking darknet market offering the same “treasure hunt” buying system as back home.
FreshTools has been around since 2019 and has earned its place as one of the most well-known underground markets, even though it doesn’t follow the traditional dark web rules. The categories are well organized, ranging from drugs and fraud to digital products, guides, and malware.What really sets it apart is its focus on security and usability. Abacus Market appeared on the scene in 2021 and quickly became one of the heavyweights among English-speaking markets on the dark web. Dark web markets are like hidden online stores, except instead of selling clothes or technology, they specialize in illegal products and services.
