Dark web: meaning

In short

It helps to distinguish three layers. The surface web is the part indexed by search engines. The deep web is everything that is not indexed: mailboxes, reserved areas, online business applications; it is the largest part of the internet, and entirely normal. The dark web is a small portion of the deep web accessible only with special software; sites on the Tor network have addresses ending in .onion.

Anonymity in itself is not illegal: the dark web is also used by journalists and activists in countries that censor the internet. But it is also where a significant part of cybercrime is organised.

What circulates there about a company

• employee credentials, coming from breaches of third-party services where they signed up with their work address, or from malware that steals passwords saved in the browser;
• ready-to-use access (VPN, remote desktop, mailboxes) sold by brokers to whoever then carries out the attack;
• data stolen during a ransomware attack, published on criminal groups' leak sites when the victim does not pay;
• information useful for preparing targeted attacks, such as organisation charts and email addresses for phishing.

Why it matters

An exposed password is not a problem only for the account it came from. Attackers try it on email, VPN and other services, and often work out the pattern the person uses to build their passwords. People who have already been exposed also become preferred targets. Knowing which credentials are circulating lets you force a change and switch on multi-factor authentication before they are used.

In the same way, finding your company's name on a leak site may be the first sign of a data breach, at your company or at a supplier.

Example

Monitoring reports that the purchasing manager's address appears in a collection of credentials from a breach of an e-commerce site, with a password similar to her work one ("Summer2023!" against "Winter2024!"). The company forces a password change, switches on the second factor for the mailbox and recommends a password manager. Two weeks later the mail logs show login attempts using variants of the old password: all rejected.

Related terms

• Threat intelligence
• Attack Surface Management
• Data breach
• Ransomware