DarkOwl Snapshot Finds Exchange Market Offers Stolen Data, Malware and Cybercrime Services
Summary
DarkOwl analysts describe Exchange Market, a Chinese-language Tor marketplace observed since 2019, with listings for allegedly stolen personal data, malware, fraud and hacking services, weapons, and counterfeit documents.
Key points
- DarkOwl says it has observed Exchange Market since 2019; the marketplace is primarily in Chinese Mandarin and is not widely promoted on darknet forums and link lists.
- Analysts found listings offering personal data said to include names, contact details, birth dates, and financial or service-user records from multiple countries.
- Other advertised services included social engineering, fraud technologies, penetration testing, money laundering, private investigations, and evasion of tracking.
- Virtual-item listings included remote-access trojans, other malware, hacking tutorials, and tools or services associated with identity theft and fraud.
- The marketplace also advertised weapons, counterfeit documents, drugs, and other illicit goods; the article notes a mismatch between one handgun listing’s description and its pictured model.
- Accounts use randomly assigned identifiers, and buyers must set a separate transaction password; account activation requires a Bitcoin deposit, with the marketplace acting as escrow.
- DarkOwl assesses that the marketplace supports a broad range of cybercrime, but the article does not independently verify the provenance of each advertised dataset or the sellers’ claims.
Article Details
- Event Type
- DarkOwl's analysis of Exchange Market, a Tor-hosted darknet marketplace selling illicit goods and services, including stolen personal data, fraud services, hacking resources, malware, and weapons.
- Impact
- The marketplace has operated since at least 2019 and facilitates a broad range of cybercrime, including identity and financial fraud, data brokerage, hacking, and ransomware activity. Listings claim to offer personal data from multiple countries; the article does not verify the sellers' claims or establish the provenance of all listed data.
Products
Exchange MarketThis edition features Exchange Market.Taobao11 elitemate US online dating site data 1.04 million 11 Check cars, check people, check all 11 AliExpress eBay Amazon Alibaba Taobao and other e-commerce seller data WeChataccount with US phone numbers, online credit card loans, DDoS attacks, and scraping information from WeChat chat records real-time.WeiboProducts on the marketplace are tailored towards Chinese online services, e.g. ransomware to target Taobao, Xianyu, WeChat, and Weibo. XianyuProducts on the marketplace are tailored towards Chinese online services, e.g. ransomware to target Taobao, Xianyu, WeChat, and Weibo.
Countries
Brazil4 Brazil shopping data 450,000 items_Automatic delivery_August 2022 4 Website penetration-obtaining database-webshell permissions 4 17 sets of Polish ID cards with front and back photos ChinaThe market’s onion service is advertised as though it is based in China, uses mostly Chinese Mandarin language, and references popular technology and applications exclusive to China culture.IndiaThe personal data offered appears to be primarily sourced from individuals located in the Netherlands, India, Brazil, Spain, the United States, and Taiwan.ItalyInterestingly, most of the PII offered here originated from citizens in Spain, Italy, the United Kingdom, Japan, the United States, and Poland – suggesting that either Chinese-based threat actors are directly targetingJapan“A large number of financial investment data in the currency circle of Japan, South Korea, Europe and the United States stock and foreign exchange exchanges are collected”; andNetherlands2 470,000 pieces of data on the wehkamp shopping station in the Netherlands 2 In 2022, the latest PAYPAL binding foreign credit card fraud core technology 2 Spanish driver’s license positive and negative hand-heldPolandoffered here originated from citizens in Spain, Italy, the United Kingdom, Japan, the United States, and Poland – suggesting that either Chinese-based threat actors are directly targeting these countries or non-ChinaSpainThe personal data offered appears to be primarily sourced from individuals located in the Netherlands, India, Brazil, Spain, the United States, and Taiwan.Taiwan8 Taiwan personal data 730,000 names, phone numbers, email addresses, birth dates 8 Anti-drinking tea network security Anonymous anti-tracking evades the investigation of the Internet police to deal with nationalUnited KingdomInterestingly, most of the PII offered here originated from citizens in Spain, Italy, the United Kingdom, Japan, the United States, and Poland – suggesting that either Chinese-based threat actors are directly targetingUnited States“A large number of financial investment data in the currency circle of Japan, South Korea, Europe and the United States stock and foreign exchange exchanges are collected”; and