Cybercriminal Underground

For most users, the Visible Web is all that they'll ever need, where information, products, and services can be readily accessed or searched for. But little is known about the Deep Web. What is it? How does it work? Is it legal? Is it real?

In Operation Onymous, 17 people were arrested and 414 different .onion domains were seized by various law enforcement agencies around the world. Soon after, new marketplaces using I2P and new currencies sprung up. Read more on Deep Web shutdowns.

This research paper covers the cybercriminal underground market in Brazil, including the unique tools and training services created by Brazilians to attack targets that are based in the country.

Trend Micro's first look into the cybercriminal underground covers the different activities and services found in the Russian underground—the pioneer underground scene—in 2012.

This research paper reviews messages related to activities, along with trends observed and product and service price updates seen in the Chinese underground market throughout 2013.

This Trend Micro research looks into the emergence of the “mobile underground” in China as a result of the market's shift to mobile platforms, including mobile underground products and services.

Different cybercriminal underground markets offer a distinct list of tools and services. Here's a list of known products and services that are available in the Chinese, Russian, and Brazilian underground.

According to the FBI, in the two and a half years of Silk Road’s existence, the site has generated sales totaling over 9.5 million Bitcoins and collected commissions on those sales of over 600,000 Bitcoins. Read more about Deep Web marketplaces here.

Over several months, our researchers monitored the Chinese mobile cybercriminal underground to see what kind of wares cybercriminals were trading. What they found was a diverse set of offerings created to suit different purposes.