Dark Web Markets Compete for the Drug Trafficking and Illegal Pharmacy Monopoly
Cybercrime Intelligence
Major drug markets in the Dark Web are now worth around $315 million annually according to the United Nations Office on Drugs and Crime (UNODC). Resecurity estimates this figure to be significantly higher in 2023, the annual sales of illegal drugs in the Dark Web for 2022 exceeded $470 million - which is the result of increased geopolitical tensions, global pandemics, and unprecedented growth of shadow economy internationally.
Following the takedown of Hydra Marketplace by Germany's Federal Criminal Police Office in a joint operation with the FBI, DEA, IRS Criminal Investigations, and Homeland Security Investigations (HSI) in April 2022, at least 10 darknet markets (DNMs) have risen to fill the regional void for drugs and other illicit goods. Still, the disruption of Hydra dealt a “huge blow“ to the ecosystem, according to multiple sources on the Dark Web.
According to Resecurity® HUNTER team, the following 10 Marketplaces are currently representing the core ecosystem of drug trafficking in the Dark Web, which is split between actors from multiple regions and influence groups:
The Resecurity® Hunter unit performed an extensive analysis of current trends and dynamics related to the underground economy around active DNMs leveraging technical means and human intelligence (HUMINT) sources. Some results of this research (Drug Trafficking in the Dark Web - Status Report - 2022/2023) arranged by our team are provided within this blog post and are aimed to provide awareness for international law enforcement, cybercrime investigators and intelligence professionals. Some of the identified underground marketplaces hide the exact number of users revealing only the number of sellers and shops registered on them, that's why in such cases we used other available sources and assumptions to estimate it.
One of the credible actors (acting as a human source) interviewed to collect insights regarding the current drug trafficking situation in the Dark Web shared: “there is an oversupply of goods on the market right now. Hydra created an ecosystem. Everything you needed could be found there.” He went on to say: “For some, this provided new opportunities, but the restructuring of the market is always a problem for all participants...”.
Over the summer 2022, most of these new markets were primarily fighting for brand recognition, much like a ‘cyber-90s’ type of environment. Notably, a dominating number of actors moved from Hydra to other marketplaces, and started leveraging alternative digital channels – customized mobile apps and Instant Messengers (IM) including Telegram.
Multiple groups registered on Telegram facilitating sales of illegal drugs were Identified. A the beginning of 2023 their number has been significantly increased what may confirm the interest of threat actors to migrate to mobile communications and more actively leverage IMs. An example of one such group oriented towards English-speaking and German-speaking audiences can be seen below:
Some notable underground actors notified customers about the need to move to alternative communication channels as a security measure considering the increased activity by law enforcement targeting Dark Web communities:
Translation:
Due to the recent Hydra closure, we have created Telegram bots and increased the number of operators to service all of your cities. Check Telegram to receive the list of cities where we operate.
Around the beginning of Q3 2022, multiple drug shops were identified in the Dark Web providing customers with a customized Android-based mobile app for purchases and secure communications, as well as sending instructions to couriers. The significance of this new trend is increasing OPSEC measures (of threat actors) and a visible shift from traditional communications channels to proprietary (developed by other actors operating in Dark Web). In such case, bad actors control communications infrastructure, may easily destroy/wipe it, as well as get rid of mobile devices.
Resecurity identified at least 7 underground drug shops providing Android-based mobile apps based on the same engine known as M-Club (CMS) in Dark Web, which may confirm the involvement of the same developer. This CMS has been developed specifically for drug traffickers and is currently marketed on major underground communities. Some of these mobile apps have been recently observed by our experts on seized mobile devices by law enforcement - they belong to several suspects involved in drug trafficking and other illegal operations:
# |
Drug Shops |
Screenshot |
Mobile App |
Hash |
|---|---|---|---|---|
| 1 | https://yakudza.top |  |
https://yakudza.top/assets/c7bf7fb1/shop.apk | acbd7a50db5094c315b9dc6d9d8b63e2 |
| 2 | https://tomford24.biz |  |
https://tomford24.biz/app.apk | 3c7676f14cbdfbbfbb2b8326e3e5b5e1 |
| 3 | https://24deluxe.biz |  |
https://24deluxe.biz/app.apk | B556QnYRb3g6kJspoGGmBSSPxEmmwh4f |
| 4 | https://pnts32.biz |  |
https://pnts32.biz/app.apk | 724bfeb805e040194118597bcf291426 |
| 5 | https://flakka24.biz |  |
https://flakka24.biz/app.apk | 2efe2cc04ee87526fde5effe24a6ea33 |
| 6 | https://24cana.biz |  |
https://24cana.biz/app.apk | 82feb699fa9022fa29ad7a7ce2e3dfc7 |
| 7 | https://mapstgk.biz |  |
https://mapstgk.biz/app.apk | iedDHIFn1SX8n0E3oSGbtj7XjzvSRE2A |
Typically, the drug shops providing such mobile apps don’t reveal a lot of information, and their customers have substantial prior knowledge about them and their inventory from references or their past experience.
The mobile apps provide the ability to transfer details about successful drug orders, and they can also send geographical coordinates of the "package" left by the courier for further pick-up. Typically, such information is transmitted in form of an image to prevent possible indexing. The additional notes may contain details how deep the "package" has been hidden under the ground or any other information to find it (for example: color of the label). Typically, drug traffickers have become very careful in their tactics, and try to choose locations where it would be complicated to monitor couriers without prior knowledge (parks, forests, abandoned buildings, etc.). The actors also use magnetic cases to hide packages not easily detectable without having exact coordinates.
After the closure of Hydra, underground shop owners also became more careful. Some of them even masked their products and removed all public descriptions, so only vetted customers could see what they are selling.
Cocaine, hashish, and amphetamines continue to remain the key products for sale in the Dark Web. Some previous sellers from the Hydra marketplace moved to new marketplaces and renamed/rebranded themselves to avoid possible tracking because of the takedown and continued their operations under new aliases. While at the same time, their product titling is still the same, so they could be easily recognized by experienced buyers:
Today, some of the larger players vying for the throne include Blacksprut, OMG!OMG!, RuTOR, WayAway who possibly have roots connecting them with Eastern Europe and Eurasia, but also in the English-speaking world - Nemesis and Anon Market. Beyond battling for brand credibility, Eastern DNMs have predictably splintered along war-time allegiances between Russia and Ukraine.
Earlier this month, the group of hacktivists known as Killnet along with their associate from DEANON CLUB announced the hack of Blacksprut. The full dump from one of the most recognizable drug trafficking communities was put up for sale for $250,000. The group published multiple (presumably compromised) accounts of users registered on the Blacksprut platform and released the communications and screenshots of personal cabinets belonging to some users.
Later, Blacksprut released a statement on their Telegram channel stating how this hack had been fabricated, and how the hackers published phished and previously registered accounts to instill panic, essentially creating a disinformation campaign to impact their business. Even if this statement was true, some of the accounts released were most certainly valid at the moment of publication, and they contained information about operations arranged on the marketplace.
Killnet has attracted a lot of attention because of past DDOS attacks against NATO, U.S. law enforcement, and multiple EU government agencies during the peak of war in Ukraine. It is not clear if this group may be state-supported or solely driven by their ideological motivation, or perhaps artificially created by foreign governments considering ongoing geopolitical tensions. It is worth mentioning, another actor with the alias Wazawaka was presumably responsible for a similar attack against the now closed Hydra marketplace back in 2018. He arranged domain spoofing to steal user accounts.
The actors behind the possible attack on Blacksput threatened the administrators with the leakage of their identities, as well as to reveal sensitive operations between buyers and sellers. Likely, they used similar tactics, and were able to successfully phish some number of Blacksprut users. In both cases, this activity is coming from cybercriminal or semi-criminal elements, which are likely driven not just by their personal interest, but the direction from a third-party.
Attacks on drug marketplaces may be interpreted as a possible fight for certain influence in that niche in Dark Web and likely arranged by competing powers representing different groups involved in drug trafficking internationally.
Original post of Blacksprut DB offered for sale:
According to a popular DNM news aggregator, the trouble started when RuTor and OMG!OMG! “created a coalition to monopolize the market,” offering a bonus fee as high as 10% to vendors if they relocated their illicit shops there.
Rival DNMs then began launching ‘black PR’ campaigns against one another, they even resorted to DDoSing each other during last summer, with competitors disrupting OMG!OMG! in June. In July, the Solaris DNM then hijacked RuTor’s onion domains. National allegiances became sharply defined in late July. On one side, allegedly RuTor operators hacked its largest competitor, WayAway. RuTor hackers flaunted pilfered logs of WayAway’s user chats and mocked the ineptitude of the DNM’s admins.
Diving deeper, several RuTor posts and other available sources for our analysts suggest the Khimprom Syndicate, an international drug mafia notorious for slicing off the fingers of “disobedient” members, covertly operate the forum. But in 2019, media reported the cartel was managing their business from remote locales in Latin America and some of their key actors have been arrested by law enforcement.
Underlying regional organized crime networks aside, Resecurity combed the leading DNMs to explore their product offerings and payment methods. Here is an overview of the post-Hydra DNM ecosystem represented by 10 key marketplaces:
1. RuTor
With nearly 292,000 members, RuTor is the largest DNM on the Russian-speaking dark web. The forum statistics panel also notes how the forum hosts over 2.2 million user posts scattered across 37,310 unique topics to date.
Like Hydra, users can find a wide variety of criminal goods and services solicited on this forum, including drugs and the precursor chemicals / reagents used to produce synthetic narcotics, money laundering services, weapons, business automation botnets, job boards, private investigation services, identity documents, hacking kits, and more. Beyond Russia, RuTor services the CIS countries of Azerbaijan, Armenia, Belarus, Georgia, Kazakhstan, Kyrgyzstan, Moldova, Tajikistan, Turkmenistan, and much of Uzbekistan.
Notably, Uzbekistan was identified as a relatively popular market for drug traffickers with 2 major points in Tashkent and Namangan city.
Below, is a picture of the top 10 vendors and services on the platform.
Many Hydra vendors have also migrated to RuTor, particularly in the immediate aftermath of the forum’s seizure. Take for example, drug seller ‘Candy Shop’ and money laundering service provider ‘bitcoin bank’.
Broadly speaking, the most popular drugs sold by RuTor vendors are cannabis and synthetics, with an emphasis on spice (synthetic marijuana), mephedrone (bath salts), and ALPHA-PVP, another crystalline substance known more commonly in the U.S. as ‘flakka.’ In the West, flakka has a reputation- the especially dangerous “zombie” drug that can induce persistent psychosis in users upon their first dosing. Here is a posting from the 6th ranked vendor on RuTor, ‘Crystal-Mafia’ that shows what the drug looks like.
Precursors for these synthetic substances are sourced from Asia, with several sources reporting that Chinese chemical suppliers ship reagents and other ingredients by “rail to Primorye through two main transshipment points: Suifynhe - Grodekovo and Hunchun – Kamyshovaya,” “delivery of mail containers from Hong Kong to Vladivostok,” and “cargo flights from Harbin and Beijing to Novosibirsk and Yekaterinburg.”
Meanwhile, the top shop on RuTor is Chemical-Mix, which like the larger forum, can be accessed on the clear web. When accessing the Chemical-Biz website, the interface advises users on which browsers and VPNs they should use to optimize anonymous commerce.
When checking out, users are offered the options:- bitcoin or card-to-card transactions (C2C), bother are possible payment rails. Based on our assessment, C2C transactions remain one of the top ways of moving illicit funds.
As for RuTor’s ownership, this post by user ‘ER1VD4PC’ alleges that new owners of the forum are the Khimprom syndicate, “a large cartel, but alas, already operating under protection,” according to the translation. Such claims couldn't be fully validated and should be treated with certain grain of salt. Same time, RuTOR may be definitely named one of the longest living underground communities surviving challenging times for other Dark Web actors without significant issues. The community remains online and available for drug sellers 24/7 despite repeated DDoS attacks.
2. OMG!OMG!
OMG!OMG! is another go-to regional DNM. This forum openly collaborates with RuTor. Dark web chatter and innuendo suggests how both DNMs are rumored to be more pro-Ukrainian than Russian. This market first emerged in April 2022, according to a RuTor post.
Beyond Russia and Belarus, the market claims to serve various countries in the Caucasus and Central Asia region. Whereas in reality, only users from Russia and Belarus can find shops operating in their proximity. The forum lists 1012 shops operating in Moscow and 54 in Minsk, the most populous cities in other countries:
Another RuTor post authored by user ‘DrugLandNews’ last week further alleges the RuTor/OMG alliance, claiming the following:
“The leaked correspondence from the “Diplomacy” chat, founded by a representative of the SuperNova site, which in turn was created in fear of the upcoming release of the Kraken, in order to unite before the upcoming new round of the site war; we see that OMG / RuTor understood the word “union” in their own way and offer to organize a Cartel.
They propose within the framework of the drug cartel to establish a predatory "tax" percentage for stores of 8-10%, and do not hesitate to point out that there will only be shops and buyers in the red, and they will be covered in chocolate.”
We recently analyzed what the leadership of this syndicate (Omg / RuTor) is like, and they never tire of reminding us about what kind of pigs are hiding under the masks of these benefactors. At the same time, all this is served under the knightly slogan “Let's knock the crown off Hydra!”, Only the guys, probably, have forgotten what conditions Hydra offered, and what they are offering now.”
OMG!OMG! product offerings are mostly drugs, as illustrated by the top banner.
It's not surprising how drugs promoted in the forum are like RuTor’s most in-demand substances, highlighted by these Mephedrone postings and the top-featured products below.
This market also features an ‘Other’ section where users can browse delivery services, as well as bank/SIM cards, passports and other identity documents, hacking services, web design, and laboratory equipment/precursor chemicals.
Like all these other DNMs, the forum features crypto payment rails, with a seemingly exclusive bias towards Bitcoin.
3. BlackSprut
BlackSprut is another popular DNM. This forum has been around for over two years. Unlike OMG!OMG!, BlackSprut doesn't give users the option of choosing the country they're shopping in. There are over 2500 active drug ‘shops’ operating on the site. There is however a steep drop-off in activity between the top sellers who have done over 10,000 sales compared to the others.
The top selling and highest rated store on BlackSprut is ‘Sliviki Shop’. Sliviki has done over 39,000 sales.
This shop primarily deals in synthetic drugs like mephedrone, A-PVP, and ecstasy.
Apart from Sliviki, there are 15 BlackSprut shops that have done over 10,000 sales. From there the drop-off is steep and rapidly descends into the low quadruple digits. Like the other DNMs, popular products listed on BlackSprut are biased towards synthetics. But BlackSprut seems to solicit Mephedrone more prominently than other markets:
Like RuTor, BlackSprut also offers cash-out services, including Bitcoin-to-Ruble and C2C transactions.
4. WayAway
WayAway is one of the largest DNMs with over 162,000 registered users. These users have authored nearly 242,000 posts which are dispersed across 11,303 topics.
Kraken, a WayAway partner and exclusive drug market, has been hyped as the successor to Hydra since May 2022. But at the time of this writing, the forum has not yet launched. WayAway also promotes the Monero anonymity enhancing cryptocurrency far more prominently than other regional DNMs.
The top drug store on WayAway is GangBang Instant Store.
The gangbang shop’s top featured projects are cocaine and mephedrone of various brands.
On the broader WayAway forum, most of the postings are for marijuana followed by Euphorics.
Like BlackSprut, WayAway vendors appear to be more focused on operating within Russia and Belarus as noted by the locations marketed by the ‘El Chapo’ mephedrone shop. WayAway also features a searchable collection of former Hydra store operators.
Around November 2022 the Administrator of WayWay started a new thread about the planned launch for a new marketplace called Kraken. Notably, the Administrator of WayWay has exactly the same alias (aka "Kraken") who described the news of decentralized infrastructure having multiple data centers and nodes for the new project.
Original post by WayWay Administrator:
According to the published statement from WayWay, the new marketplace will become one of the most secure decentralized marketplaces with very attractive conditions for both sellers and buyers having 0% commissions, as well as no fee for opening a new shop on the platform. The reason behind the creation of the new marketplace is not yet completely clear, but likely could be interpreted as an expanding influence of WayWay organizers with the goal to capture a significant illegal drug market share in the Dark Web and diversification of their operations.
5. Kraken
The new marketplace launched by WayWay founders has emerged in the end of December 2022 - almost as a Christmas gift for both criminals and law enforcement monitoring the underground. Nevertheless, this marketplace is relatively new, over 1,720 shops were identified and registered on the Kraken platform (some of them are not fully operating, or have just a registered profile). Likely, some of them are migrating from trusted communities to WayWay, simply because the organizers have significant reputation in the Dark Web world. It is hard to estimate the total number of buyers, but due to active support from established marketplaces such as WayWay, their audience is expected to grow rapidly in 2023. Besides 0% commission and absolutely no fees for operating a shop on Kraken, the founders implemented a 5% "cashback" system on payments for certain items to facilitate deals between marketplace members.
The marketplace has a well-established team including Administrator (Professor), Vice-Administrator(-s), Cybersecurity Team, Customer Support, and multiple moderators. The roles and responsibilities of the operators are like Hydra however look more advanced. For example, there are at least 3 operators responsible for the security of the project, as well as over 15 moderators. Identified were at least 80 actors in total involved in Kraken management. According to a statement by WayWay founders responsible for launch of Kraken - the marketplace aims to become the best in category and providing "the most secure decentralized platform" in Dark Web.
Also identified were several notable sellers who migrated to Kraken from the now closed Hydra marketplace. One of them - "Emirates" having over 300,000 successful deals on Hydra.
Other reputable sellers who joined Kraken include "Shiva" operating at least since 2014 in Dark Web. Both services have extremely sophisticated network of couriers with wide inventory of illegal drugs.
6. Solaris
Some of the sellers and their ads published at WayWay had references to another marketplace called Solaris. It also has its own forum with the same name for discussions between buyers and sellers. The platform has over 3840 registered shops. As of today, this marketplace is one of the most significant players in drugs sales in Dark Web.
Unless there is a plausible connection between WayWay and Solaris, the teams running them entered a direct conflict right before the start of 2023. December 28, 2022, one of the Solaris moderators with alias "Juri" published a statement "WayWay and Kraken have been blacklisted by Solaris, and all sellers having accounts there should remove their profiles, otherwise the administrators will apply strict sanctions against them." Later, OMGOMG! and RuTOR were also added to the list of prohibited resources and outlined as "enemies of Solaris". The rules of Solaris have also been updated with a statement where Administrators added a new point 1.7 stating the same.
Translation:
Prohibited to have profiles at other resources which are included in 'blacklist' by Solaris, and have aggression against Solaris and conduct attacks against us, or may be threatening our community. This list includes: RuTOR / OMG / WayWay/Kraken. If you will have a profile there - serious sanctions will be applied.
The reasons behind these steps are not yet fully clear but have been interpreted by Solaris as a "separation of the market". Notably, both resources seem to be allies before, when in June 2022 there were certain rumors about a joint DDOS attack against RuTOR by them. Unless the attribution and motivation of actors behind this activity remains unknown, it was confirmed RuTOR and its mirrors were unavailable for significant amount of time around that time.
Notably, the growing tensions between Solaris and WayWay have also been heating up as claims of possible money theft from Solaris appear the same month (December 2022), which later have been disputed by Solaris Administrators and interpreted as "geopolitical" and "fake". According to them, their marketplace is completely safe and they spent significant financial means to maintain the infrastructure, but competitors and other malicious parties attempted to abuse their reputation. Same time, Solaris has also announced a significant upgrade to their payment system and blocked all payouts for 2 days around the same time which may confirm some activities behind the scenes, likely related to improvements of security of the marketplace.
The Administrators of Solaris gave their sellers 7 days to remove their profiles from other unfriendly marketplaces and mentioned how their security team will be monitoring it, warning that if they identify profiles under another name belonging to the same sellers, they may expect problems including blocking of their balances and doxing.
The Administrators of Solaris also highlighted strong connection to KillNet responsible for multiple DDOS attacks against the U.S., NATO and various EU-based government resources - who may assist Solaris in fighting against their competitors and enemies. The group has also attacked multiple resources in Ukraine and has been originally positioning themselves as "pro-Russian" cooperating with other hacktivists groups such as Zarya and Beregini what may clarify the complicated geopolitical aspect of tensions between drug trafficking market players as well.
7. Nemesis
Nemesis is another relatively new market that first launched back in 2021, but changed its business model last March to combine a market with a forum section. Similar to RuTor and WayAway, products and services promoted on the service include hacking, drugs, weapons, and forgeries. The market appears to target users in Europe and the U.S. All products sold on the website are visible to users, without having to register an account. The market accepts both Bitcoin and Monero as a source of payment. Curiously, Nemesis’ web design and user experience seem to be inspired by the Dread forum, which is the most popular DNM message board in the English-speaking world. At present, the Nemesis forum has over 55,200 registered subscribers.
Like RuTor, some Nemesis vendors deal in the weapons trade, including 3D printed gun schematics. Threat actors ‘TheDangerousTomato’ and ‘TheFreelancer’ recently posted advertisements for these goods:
Freelancer has also posted ads for grenades.
As for drugs, the ‘foreigness’ of the forum is further evident from the types of drugs promoted, as well as those that are more difficult, if not impossible, to find there (A-PVP and Mephedrone). Instead, more traditional stimulants and hallucinogens prevail. For example, Vendor ‘SunshineShop’ recently advertised LSD at different price points and amounts.
Additionally, threat actor ‘GermanDrugScout24’ advertised a wide array of illicit substances priced in euros.
8. Legalizer
This marketplace has originally appeared from an underground community (forum) which connects buyers and sellers of illicit drugs.
Notably, one of the main target markets of Legalizer Marketplace - Ukraine. Numerous drug shops operate in major cities including Kiev, Lviv, Kharkov.
Historically, Legalizer is positioned perfectly for the audience primarily based in Kazahstan, Moldova, Russia, and Belarus. However, Legalizer also have vendors supporting delivery abroad.
Notably, other regions include Kyrgizia, Indonesia (Bali), Uzbekistan, Tajikistan, the U.K., Poland, Turkey, Czech Republic, Latvia and China:
Today complicated geopolitical agendas affect legitimate business and trade, unfortunately, it doesn't seem to be affecting criminal activity the with the same negativity. Based on the observed dynamics, criminal actors are actively engaging in new deals and thus attracting both buyers and sellers which is increasing the volumes of drugs for sales in the Dark Web.
9. Mega
Another rapidly growing drug marketplace worth mentioning in the Dark Web is called Mega. The business model of this marketplace is focused on enabling criminals to create their own online shops to sell drugs and other illegal goods. As of the 16th Dec, 2022, there are over 2,496 drug shops registered shops on Mega, and that number is continuing to growing at a rapid pace.
Mega provides an automated exchange service and a built-in wallet to process cryptocurrencies. To further attract buyers of drugs from other underground communities, the actors behind the Mega frequently organize "Black Friday" discounts to stimulate the sellers, by doing so offering lower commission rates from their sales.
The engine of the marketplace protects the total number of users registered on it, but based on the number of unique shops, likely it may exceed 15,000 unique actors. Unless all of them remain active for significant period of time and/or frequently change their alias online, Mega may be characterized as a significant Dark Web marketplace which primarily focuses on Eurasia region and other certain countries in South East Asia such as Thailand and Cambodia specifically.
10. Anon Market
Anon Market, a new underground dark web marketplace popped up after the closure of Hydra. Anon Market has a wide range of offerings ranging from Drugs, Software, Tutorials, Forgery, Currencies, Databases and much more.
Upon inspection, the main difference with Anon Market is their vast catalog of pharmaceuticals, specifically prescription drugs. In the image below you can see an array of pharmaceuticals currently for sale at the time of writing.
Prescription pharmaceuticals such as Adderall, Atomoxetine, Mersyndol Forte Codeine, Morphine Zomorph Ethypharm, Oxycontin, and many others are readily available on this DNM, all of which can be paid for using Crypto.
Aside from prescription pharmaceuticals used to treat conditions such as extreme pain, anxiety, ADHD, Insomnia and many others, Anon Market is also offering for sale male performance drugs such as Viagra, Cialis, Kamagra Oral Jelly, all of which cannot be verified as original and as such should be considered dangerous.
Dark Web Marketplaces selling prescription pharmaceuticals conjure up a plethora of issues, for example the pharmaceuticals for sale on Anon Market may be low quality / counterfeit with no valid indication on quality, ingredients, strength or where they’ve come from. Such pharmaceuticals could / will most likely have a negative impact on health or even result in death.
What do the ‘Cyber 90s’ Mean for the Eurasian DNM Drug Trade?
As Eurasian narco-DNMs continue to battle for market supremacy, the informed prognosis on the Russian dark web is a grim, especially for user safety, according to Telegram darknet chatter. “The absence of a monopolist with simple and understandable rules will lead to a deterioration in the quality of the goods. This, in turn, according to narcologists and darknet analysts, will greatly increase the likelihood of death when using illegal substances,” said a post authored on a Telegram channel widely circulated within the Russian darknet community.
However, with credible rumors of the transnational drug cartels lurking behind some of these digital store fronts and leveraging established Asian supply chains to source and manufacture the precursor agents, which are required to produce locally popular synthetic drugs, these concerns may be overblown. Regardless, the DNM criminal economy continues to proliferate unimpeded by the intervention of law enforcement.
Significance
Criminal entities involved in drug trafficking continue to upgrade their tooling and advance their operations in the Dark Web. Threat actors have begun developing proprietary mobile apps allowing buyers and sellers of illegal goods to communicate in close to real-time mode, as well as transmitting information about "packages" with delivered drugs via alternative digital channels. This process is accelerated by the availability of Instant Messengers (IMs) and Automated Bots which allow the distribution of information across available digital channels with relatively high levels of anonymity. Resecurity expects mobile communication channels and mobile apps to soon replace traditional underground communities, forums, and marketplaces in order to facilitate quick information exchanges between Dark Web actors. It is expected new marketplaces will emerge in 2023 (like the recently launched Kraken) to expand influence. The key 10 marketplaces outlined in this report will continue to keep fighting for market monopolization. As outlined in the report, geopolitics and drug trafficking have become inextricably linked, that's why the volume of shadow economy in the Dark Web will remain to grow and accelerated by ongoing tensions. The law enforcement community needs to develop new ways to monitor illegal drug trades in the Dark Web and adjust their tactics to the dynamically changing threat landscape.
