# How does dark web activity threaten organizations?

> Dark web markets sell stolen credentials that fuel ransomware and BEC. How the trade works, what monitoring can and can't do, and how MSPs should respond.

Dark web activity threatens organizations because it is where stolen access gets packaged, priced, and resold. A password lifted from one employee's laptop by infostealer malware can be listed on a criminal marketplace within days, bought by a ransomware affiliate, and used to walk into your network through a legitimate login. The scale is real: the FBI's Internet Crime Complaint Center logged [859,532 complaints and $16.6 billion in reported losses in 2024](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf), with losses up 33% from 2023. For MSPs the risk is multiplied, because one exposed technician credential can open the door to every client you manage.

![Dark web concept image](/images/cms/68e1f1ee500e12df92d4c5be_img-q0cosp8whb3zjaohwvndohwt.png)

## What is the dark web, exactly?

The dark web is the part of the internet you need special software to reach, most commonly [Tor](https://support.torproject.org/about/what-is-tor/), which the Tor Project describes as a program that "protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world." Tor itself is legitimate privacy technology used by journalists and researchers. The problem is that the same anonymity shelters criminal forums, leak sites, and marketplaces.

Two clarifications help cut through the mystique:

- The **deep web** is simply anything search engines don't index: your webmail, client portals, internal databases. Most of it is boring and lawful.
- Criminal markets are not confined to Tor. [Genesis Market](https://www.europol.europa.eu/media-press/newsroom/news/takedown-of-notorious-hacker-marketplace-selling-your-identity-to-criminals), one of the largest stolen-credential shops ever taken down, ran on the open web behind an invitation-only wall. Today a lot of the same trade happens in private Telegram channels.

So treat "dark web" as shorthand for the criminal data economy, wherever it lives.

## What do criminals actually buy and sell there?

The takedown of Genesis Market in April 2023 gave the public a rare inside look. According to [Europol's takedown press release](https://www.politie.nl/binaries/content/assets/politie/nieuws/2023/april/182400ee-4e14-4ff6-840c-7d7a9c199904.pdf) (the operation was led by the FBI and the Dutch National Police) the market listed over 1.5 million infected devices ("bots") covering more than 2 million identities, priced from as little as $0.70 up to several hundred dollars each. Buyers got saved logins, cookies, autofill data, and browser fingerprints, plus a custom browser that impersonated the victim's device so well it slipped past location and device checks.

| Commodity | What it is | Why it matters to you |
|---|---|---|
| Stealer logs / "bots" | Passwords, session cookies, and browser fingerprints harvested by infostealer malware | Lets a buyer log in as your user, sometimes without tripping MFA |
| Bulk credential dumps | Recycled username/password lists from old breaches | Fuels credential stuffing against VPNs, M365, and client portals |
| Initial access | A verified foothold in a named company's network (VPN, RDP, admin account) | Skips the hard part of an intrusion; often the first step before ransomware |
| Ransomware-as-a-service | Malware, infrastructure, and playbooks rented to affiliates | Low-skill criminals can run high-impact attacks |

The ransomware-as-a-service model is well documented. CISA's [LockBit advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a) describes an operation "where affiliates are recruited to conduct ransomware attacks using LockBit ransomware tools and infrastructure", about 1,700 U.S. attacks since 2020 by the FBI's count, and approximately $91 million in U.S. ransoms paid. If you want the mechanics, see [how ransomware spreads](/learning/threats).

## How do stolen credentials turn into real breaches?

Because they work. [Verizon's 2025 Data Breach Investigations Report research](https://www.verizon.com/business/resources/articles/credential-stuffing-attacks-2025-dbir-research/) found compromised credentials were the initial access vector in 22% of breaches, the single most common way in. The same research found credential stuffing made up a median of 19% of all authentication attempts against SSO providers over two years, peaking at 44% in a single day. For the median infostealer victim, only 49% of their passwords were distinct across services. One reused password can unlock several systems.

The credential trade also feeds ransomware directly. [SpyCloud's analysis of the 2025 DBIR](https://spycloud.com/blog/verizon-2025-data-breach-report-insights/) highlights that 54% of ransomware victims had credentials already sitting in infostealer logs before the attack, and 40% of those logs contained corporate email addresses. The sequence is mundane: infection, listing, purchase, login, encryption. Our guide on [preventing credential theft](/learning/threats) covers the front end of that chain.

Session cookies deserve special mention. A fresh stolen cookie can replay an already-authenticated session, which is how marketplaces like Genesis helped buyers sidestep security checks entirely.

## Why should MSPs care more than most?

Three reasons:

1. **Concentration of access.** Your technicians hold admin credentials for dozens of client environments. One exposed login is not one incident, it's a portfolio-wide event. The [compilation leak of more than 10 billion passwords](/learning/msp) showed how fast recycled credentials pile up.
2. **Email is the follow-on weapon.** Leaked staff lists, vendor invoices, and mailbox access all make business email compromise more convincing. The FBI counted [$2.77 billion in reported BEC losses in 2024](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf), with phishing/spoofing the most-reported crime type at 193,407 complaints. Here's [how BEC actually plays out](/learning/what-is-the-complete-guide-to-business-email-compromise-bec-attacks-in-2025).
3. **Clients expect you to know.** Dark web exposure reports are now a standard line item in security reviews. If you can't answer "is any of our data for sale?", someone else will.

## Does dark web monitoring actually help?

Yes, with honest caveats. Monitoring services crawl markets, forums, leak sites, and Telegram channels for your domains, email addresses, and client assets. The value is time: you learn about an exposed credential before or at least soon after someone buys it, and you can reset it while it's still worthless.

Be clear-eyed about the limits:

- **It's detective, not preventive.** By the time data is listed, the theft already happened.
- **You can't get data removed.** Copies persist; the only fix is making the data useless (resets, revoked sessions, MFA).
- **Coverage is partial.** Invitation-only channels and private sales are invisible to every vendor, whatever the brochure says.
- **Noise is real.** Old dumps get recycled and resold; triage matters more than alert volume.

For a quick baseline, [Have I Been Pwned](https://haveibeenpwned.com/) indexes more than 17 billion compromised accounts from over a thousand breaches, and it lets verified domain owners [search for breached addresses under their own domains](https://haveibeenpwned.com/DomainSearch).

## What should you do when company data shows up on the dark web?

Treat a verified hit as a live incident, not an FYI:

1. **Scope it.** Which accounts, which client, how fresh is the data? A 2019 dump is a different problem than yesterday's stealer log.
2. **Clean before you reset.** Europol's [post-Genesis guidance](https://www.politie.nl/binaries/content/assets/politie/nieuws/2023/april/182400ee-4e14-4ff6-840c-7d7a9c199904.pdf) is blunt: remove the malware first, *then* change passwords, otherwise the infostealer captures the new ones too.
3. **Reset credentials and kill sessions.** Password changes don't invalidate stolen cookies; revoke active sessions and API tokens as well.
4. **Hunt for actual intrusion.** Check sign-in logs, mail forwarding rules, and MFA enrollments for anything the exposed account touched.
5. **Notify who you must.** Breach notification duties vary by jurisdiction and contract; loop in legal early.
6. **Keep watching.** Confirm the exposure doesn't reappear or spread.

If the hit involves a client environment, run your standard breach playbook, here's [what MSPs should do in the first 24 hours](/learning/msps-first-24-hours-after-data-breach).

## How do you shrink what ends up there in the first place?

The prevention list is unglamorous and effective, and it matches what [CISA](https://www.cisa.gov/secure-our-world/turn-mfa) and [Europol](https://www.politie.nl/binaries/content/assets/politie/nieuws/2023/april/182400ee-4e14-4ff6-840c-7d7a9c199904.pdf) both recommend:

- **MFA everywhere.** As CISA puts it, even if someone steals your password, "they won't be able to meet the second step requirement." Pick the [right MFA type for your stack](/learning/mfatypesformsp), phishing-resistant methods beat SMS codes.
- **Unique passwords via a password manager**, so one leak doesn't cascade.
- **Patch and control software sources.** Stealer infections typically start with a malicious download or an unpatched browser.
- **Lock down email authentication.** Criminals combine bought data with spoofed email to cash out. Enforcing DMARC ([RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html)) at `p=reject` stops attackers from sending mail as your exact domain. Check your record with our free [DMARC checker](/tools/dmarc). Be honest with clients about the boundary: DMARC does not stop [lookalike-domain phishing](/learning/how-can-i-take-down-lookalike-domains), which needs monitoring and takedowns. This is the layer Palisade automates for MSPs, alongside a quick [email security score](/tools/email-security-score) you can run per client domain.

## Is it illegal to look at the dark web?

Accessing Tor or browsing dark web sites is not a crime in most jurisdictions: buying stolen data, contraband, or attack services is, on any network. If your team investigates exposures directly, set written rules of engagement: no purchases, no credential testing against third parties, and document everything. Most MSPs are better served consuming curated intelligence from a monitoring provider than wandering marketplaces themselves.

## Frequently asked questions

### What's the difference between the deep web and the dark web?

The deep web is everything search engines don't index, internal apps, databases, mailboxes, and it's almost entirely legitimate. The dark web is a small slice of it that requires special software like Tor and is designed for anonymity. Criminal markets cluster there, but as Genesis Market showed, they also operate on the open web and in messaging apps.

### Can we pay to have our data removed from the dark web?

No. Once data is copied and sold it cannot be reliably deleted, and "removal" services can't reach every copy. Spend the money on making the data worthless instead: force resets, revoke sessions and tokens, enable MFA, and fix whatever leaked the data, see [what a data breach is and how to stop it](/learning/threats).

### If we use MFA, why do stolen sessions still work?

Infostealers grab session cookies from the browser after you've already authenticated. Replaying that cookie inherits the logged-in state, so the MFA prompt never fires. Genesis Market even bundled a browser that mimicked the victim's device fingerprint to avoid triggering new-device checks. Short session lifetimes, device-bound tokens, and revoking sessions on every reset close this gap.

### How do we check whether a client's domain appears in known breaches?

Start with [Have I Been Pwned's domain search](https://haveibeenpwned.com/DomainSearch) to see breached accounts under a domain you control, then layer commercial monitoring for stealer logs and fresh listings if the client's risk warrants it. Pair the exposure check with an outside-in review of their email posture so the fixes land in the same conversation.