What is the dark web?

The dark web in plain English

Imagine the internet as a big city. The shopping streets with their storefronts are the public internet that anyone can find through search engines. Behind closed doors are offices and apartments: your email inbox, your online banking, your company’s intranet. This part, which can’t be found through public searches, is called the deep web – and it is completely ordinary. The dark web, by contrast, is like a hidden neighborhood that you can only enter through a special entrance and where everyone wears a mask.

The best-known entrance is the Tor Browser. Tor stands for “The Onion Router.” Sites on the Tor network have long, cryptic-looking addresses ending in “.onion” and don’t show up in regular search engines.

Important: the dark web is not illegal in itself. Journalists, whistleblowers, and people living under authoritarian regimes use it to protect themselves from surveillance. Using the Tor Browser is legal in Germany. Certain activities, however, are criminal offenses – such as trading in stolen data, which is punishable under § 202d StGB (German Criminal Code, handling of stolen data).

How the dark web works

The Tor network works on the onion principle:

1. Multiple layers: The Tor Browser encrypts every request in several layers – like the layers of an onion.
2. Indirect routes: The data passes through at least three intermediate stations, called nodes, which volunteers operate around the world.
3. Layer by layer: Each node removes only one layer. It knows only its predecessor and its successor, never the entire route.
4. Hidden services: With .onion sites, not only the person at the computer stays hidden but also the location of the server.

It is precisely this anonymity that makes the dark web attractive to criminals. Items traded on marketplaces and in forums include:

• Credentials for email accounts, VPN access, and cloud services
• Data sets from infostealers – malicious programs that steal saved passwords and login sessions from browsers
• Ready-made access to corporate networks, offered by specialized brokers
• Customer databases and internal documents from data leaks
• Malware and attack tools for rent

In addition, ransomware groups run leak sites there. On these sites, they publish stolen data from companies that don’t pay a ransom. Some of this trade now also takes place in closed messaging channels.

A practical example

Here’s a typical scenario: A sales representative at a wholesaler downloads supposedly free software onto a personal laptop. Hidden inside is an infostealer. Among the stolen data are the employee’s credentials for the company VPN, which they use to work from home. Shortly afterward, these credentials are offered for sale in a dark web forum.

The company finds out through an alert from its dark web monitoring. The IT team immediately resets the password, enables multi-factor authentication for VPN access, and checks the sign-in logs to see whether the credentials have already been used. The personal laptop is no longer used for work. The credentials on offer are now worthless.

Why does this matter for businesses?

What turns up on the dark web is often the precursor to an attack. Criminals use stolen credentials for credential stuffing, for example – automatically trying stolen passwords on other services. Network access that has been sold can be the first step in a ransomware attack. And if customer data surfaces, there has usually been a data breach that may have to be reported under the GDPR.

The insidious part: affected companies often don’t notice a thing. The theft may have happened at a service provider, on a personal device, or at an online service where employees reused their company password. If you find out early, you can act before the data is misused.

How to protect your organization

• Introduce MFA: With multi-factor authentication, a stolen password alone is no longer enough.
• Don’t reuse passwords: A password manager helps you use a separate, long password for every service.
• Protect devices: Keep computers up to date and only allow software from trusted sources – especially on devices that are also used for work.
• Involve service providers: Clarify how partners handle your data and how they will notify you of incidents.
• Use early warning: Dark web monitoring alerts you when your company’s data turns up.
• Plan your response: Define who resets passwords, reviews accounts, and informs affected individuals when something is found.

How Rootsektor can help

With our Dark Web Monitoring, we monitor relevant sources automatically using our own applications. If something turns up that matches your organization – such as credentials containing email addresses from your company domain – you are notified automatically. We then provide individual support with the countermeasures. We tailor the monitoring to your organization and quote it individually. An OSINT assessment also shows what information about your organization is freely available online.