How Cybercriminals Use Stolen Data to Target Companies — A Deep Dive into the Dark Web

The digital world has revolutionized the way we live and work, but it has also opened up a new realm for cybercriminals. The rise of the dark web has provided a breeding ground for hackers and other malicious actors to trade stolen data and launch attacks against companies worldwide. This blog post provides a summary of some of the trends observed over the past few days, highlighting how threat actors are using compromised data to exploit businesses, the sectors most impacted, and the dynamics of this underground market.

Cybercriminal’s Hidden Market for Stolen Data

Imagine an underground marketplace bustling with activity — vendors selling hacked streaming service accounts, buyers bidding on cloud storage credentials, and a community exchanging tips on how to bypass security features. This is the reality of the dark web, where forums like BreachForums act as virtual bazaars for compromised data.

Stolen information is incredibly valuable in this shadowy ecosystem. From streaming service logins to financial account credentials, threat actors peddle a variety of digital goods. But why is there such a demand? The answer lies in the sheer usability of this data — for unauthorized access, fraud, identity theft, or even blackmail.

Which Sectors Are Being Targeted the Most?

Recent activity on underground forums reveals a worrying trend: threat actors are targeting multiple industries. The most affected sectors include digital services, cloud storage platforms, and financial services, reflecting a shift in focus towards companies that hold valuable user data and offer high resale value.

1. Digital Services and Streaming Platforms:

• Who’s at Risk? Companies like Netflix and Disney+ are prime targets. Their popularity and the fact that millions of users are willing to pay for premium content make them attractive for hackers.
• What’s Being Sold? Compromised accounts are often shared or sold with details like session cookies, making it easy for buyers to bypass login security. This enables users to enjoy premium services without the account owner’s knowledge.
• Why It Matters: Compromised accounts are often resold or shared for free, undermining these companies’ revenue models. For example, a Netflix account that allows multiple streams can be used by multiple individuals without the company’s knowledge.

2. Cloud Storage and File Hosting:

• Who’s at Risk? Platforms like Mega.nz and Google Drive are frequently targeted.
• What’s Being Sold? Access to cloud storage accounts can potentially contain sensitive personal files or proprietary business data.
• Why It Matters: Access to these accounts can be devastating. Personal data may be exposed, business information can be leaked, and in the worst cases, this access can be leveraged for ransom or further exploitation.

3. Financial Services:

• Who’s at Risk? PayPal and other online banking services remain high-value targets.
• What’s Being Sold? Financial account credentials, often including transaction history and linked bank details, are sold for quick financial gain.
• Why It Matters: Once compromised, these accounts can be used for fraudulent purchases, laundering money, or draining linked bank accounts.

4. Government and Educational Institutions:

• Who’s at Risk? Certain threads also reveal a focus on educational and governmental institutions, often in specific regions. These breaches can lead to the exposure of sensitive or classified information and may be driven by politically motivated actors.
• Why It Matters: Database access to regional entities such as educational systems and government bodies can spark interest, potentially signaling politically motivated targeting or the pursuit of classified information for espionage purposes.

A Growing Market: Why is Stolen Data So Valuable?

Data is the new oil — it’s valuable, in-demand, and fuels an entire underground economy. But what makes stolen data so enticing for cybercriminals?

1. Ease of Access and Use:
   1. Many compromised accounts come with details like session cookies, allowing threat actors to bypass multi-factor authentication and other security measures effortlessly. This makes it easy to log in without the hassle of entering passwords or passing security checks.
2. High Resale Value:
   1. Digital accounts, particularly for streaming services, can be resold for a fraction of the original subscription cost. Similarly, cloud storage accounts are valued for the data they contain, making them an attractive purchase.
3. Potential for Further Exploitation:
   1. Some threat actors aren’t just looking to sell; they’re seeking to exploit. Access to cloud storage or email accounts can serve as an entry point for more targeted attacks, such as spear-phishing campaigns, business email compromise (BEC), or even corporate espionage.

Sophistication Levels: From Novices to Experts

Not all cybercriminals are created equal. The dark web is home to a diverse group of actors, each with varying levels of sophistication. Understanding these levels helps in identifying the potential impact of their activities:

1. Newbies:

• Profile: Typically engage in low-risk activities such as trading basic credentials (e.g., single account login details for streaming services).
• Activities: Selling or sharing low-value accounts for platforms like Netflix and Hulu.
• Risk: Minimal, as these actors lack the skills to perform more complex attacks. However, their activities can still lead to widespread account sharing.

2. Intermediate Threat Actors:

• Profile: Have the capability to conduct more sophisticated breaches, such as accessing cloud storage services or hijacking VPN accounts.
• Activities: Frequent discussions around financial account credentials or access to cloud storage with potential sensitive information.
• Risk: Moderate to high, as these actors can exploit compromised data for financial gain or to access deeper networks.

3. Advanced Threat Actors:

• Profile: Possess deep technical expertise and may even carry out targeted attacks on specific industries or regions.
• Activities: Breaching government or educational systems, reflecting interest in sensitive or classified data.
• Risk: Very high, as these actors are capable of executing large-scale data breaches, espionage, or infrastructure disruption.

The Dark Web’s Pulse: Measuring Community Interest

The number of replies and discussions around specific types of accounts serves as a strong indicator of the community’s interest and perceived value of the stolen data. The vibrant discussions around cloud storage platforms and digital services suggest that these sectors remain high-priority targets.

The rapid growth in interest within hours of posting reflects the increasing demand for certain types of data. For businesses, this means staying vigilant and being aware of the value cybercriminals place on different types of data assets.

Conclusion: A Threat That’s Here to Stay

The use of compromised data by cybercriminals to target companies is not a passing trend — it’s a growing, complex issue that demands attention. From digital services and cloud storage to financial and governmental sectors, no industry is immune. The sophistication levels of threat actors continue to rise, and the vibrant underground markets provide an easy way for them to exchange and monetize this data.

For companies, this means investing more in security, training employees to recognize potential threats, and staying one step ahead by monitoring these underground forums for early warnings. The fight against cybercrime is ongoing, and understanding how threat actors operate is the first step in protecting our digital assets.

By shedding light on these dark activities, we hope to raise awareness and help companies build stronger defenses against the ever-evolving threat of compromised data.