How Nation-State Actors Use the Dark Web for Espionage and Cyber Operations
Summary
DarkOwl examines how nation-state actors use the dark web for espionage, exploit acquisition, influence operations, and financial gain, and how leaked tools and proxy groups complicate attribution.
Key points
- The overview identifies intelligence collection, credential acquisition, exploit development, infrastructure disruption, and influence operations as motivations for state-sponsored dark web activity.
- DarkOwl argues that leaked NSA and CIA tools have expanded access to advanced cyber capabilities and made attack attribution more difficult.
- The article cites reporting that Russia-linked Turla reused Iranian tools and accessed backdoors planted by Iranian hackers, illustrating how overlapping operations can obscure responsibility.
- DarkOwl reported finding more than 550,000 dark web pages containing credentials with .gov email addresses; this measures pages, not unique accounts.
- Examples of state-linked targeting include spear-phishing against academic organizations and attacks using poorly secured IoT devices as entry points into corporate networks.
- The article describes governments' use of contractors and cybercriminal proxies, while assessing that some terrorist groups were shifting communication and recruitment toward messaging applications.
Article Details
- Topic
- Nation-state use of the dark web for espionage, exploit acquisition, influence operations, and cyberattacks
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bigwnet[.]com | Domain identified as command-and-control infrastructure for BabyShark. |
| IPV4 | 157[.]7[.]184[.]15 | IP address used in Operation STOLEN PENCIL that also hosted the BabyShark command-and-control domain. |
| IPV4 | 5[.]160[.]246[.]99 | Iran-based IP address associated with a targeted phishing campaign involving UK government domains, specifically HMRC. |
MITRE ATT&CK
T1005 · Data from Local SystemUNITEDRAKE supports access to data on attached external drives.T1016 · System Network Configuration DiscoveryDTrack gathers host IP addresses and information about available networks.T1049 · System Network Connections DiscoveryDTrack gathers information about active network connections.T1056.001 · KeyloggingUNITEDRAKE captures keyboard input, and DTrack includes keylogging capabilities.T1057 · Process DiscoveryDTrack can list all running processes on a victim machine.T1083 · File and Directory DiscoveryDTrack can list files across all available disk volumes on a victim machine.T1123 · Audio CaptureUNITEDRAKE can capture microphone output.T1125 · Video CaptureUNITEDRAKE can capture IP camera output, and UMBRAGE components include webcam capture.T1185 · Browser Session HijackingDTrack includes browser-history collection.T1566 · PhishingNorth Korean actors used phishing to obtain access to academic research organizations and US think tanks.T1588.005 · ExploitsNation-state actors purchase and steal exploits through underground markets for subsequent analysis and use.T1593 · Search Open Websites/DomainsNation-state actors search dark web sources for leaked credentials and information concerning hostile governments and other targets.
People
Edward SnowdenNSA whistleblower whose released material also mentioned UNITEDRAKE; discussed in connection with intelligence leaks facilitated by contractors.Gabriel WeinmannWilson Center professor whose report examined terrorist use of the dark web for communication, recruitment, propaganda storage, and fundraising.
Threat Actors
APT28Researcher designation explicitly associated with Fancy Bear and Strontium, linked to IoT intrusions and researcher email compromises.Fancy BearRussian state-sponsored group linked to IoT intrusions and compromised researcher email accounts; explicitly also named Strontium and APT28.Guccifer 2.0Identified in the article as breaching the DNC and releasing information to influence the 2016 US election.OilRigAllegedly state-backed Iranian hacking group whose operations were reportedly hijacked by Turla; explicitly also named APT34.ov1Ru$Hacking team that breached Russian intelligence contractor SyTech and exposed programs targeting Tor anonymity.PhosophorousMicrosoft-tracked group believed to be from Iran that attempted to identify and compromise accounts belonging to officials, journalists, prominent Iranians abroad, and President Trump's reelection campaign.Shadow BrokersHacking group that released NSA toolkits beginning in 2016 after reportedly maintaining persistent access since 2013.SOLAR IONAlternate name explicitly given for OilRig, the Iranian hacking group reportedly hijacked by Turla.STRONTIUMMicrosoft name for the Russian group attributed with attacks using IoT devices as entry points into corporate networks; explicitly identified as Fancy Bear and APT28.TurlaRussian hacking group reported to have co-opted Iranian tools and hijacked infrastructure associated with OilRig, also named APT34, to attack targets in numerous countries.
Malware
ATMDTrackAccording to open source intelligence reporting, North Korean hackers have successfully deployed a new ATM malware, called ATMDTrack that records and steals banking data from cards inserted in vulnerable ATMs in India.BabysharkOne of the IP addresses used in this campaign, (157.7.184.15) also hosted the domain bigwnet[.]com, which was used as the command-and-control infrastructure for the malware “BabyShark”.DTrackATMDTrack is assessed to be a component of a much larger DTrack malware family that involves not only command and control remote access trojan (RAT) software, but keylogging, retrieving browser history, gathering hostHive ransomwareThe most notable leak from the CIA Vault 8 was HIVE, a multi-platform CIA malware suite with its associated control software.NautilusLeveraging Iranian developed malware, Nautilus and Neuron, in combination with one of its own toolkits, called Snake, Turla obtained access to targets by scouring their networks for backdoors that had been inserted byNeuronLeveraging Iranian developed malware, Nautilus and Neuron, in combination with one of its own toolkits, called Snake, Turla obtained access to targets by scouring their networks for backdoors that had been inserted byTRITONHackers used the Triton malware to alter one of these facility’s safety controllers, which resulted in the controller shutting down an unspecified industrial process.UNITEDRAKEThe disks included UNITEDRAKE’s “fully extensible remote collection system” also mentioned in data released by Edward Snowden, infamous NSA whistleblower still in exile in Russia.Weeping AngelThe Vault 7 release discussed the Remote Device Branch’s project UMBRAGE group sophisticated false flag operations as well Weeping Angel, where IoT devices, such as smart televisions are exploited for use as spyware.
Products
Telegraminstead terrorists are demonstrating a preference for encrypted mobile applications such as Whatsapp and Telegram for organizational coordination and communication.TorNumerous doxes of various key international figures on Tor’s DoxBin.WhatsAppOpen source reporting reveled that Israel’s Whatsapp intelligence collection tool, Peagsus, had been deployed in 45 different countries for mobile phone collection and even sold to Saudi Arabia for monitoring potential
Tools
Nautilus-SPosing as a malicious exit node in the Tor anonymous network, the contractor’s program called Nautilus-S was specifically setup to deanonymize Tor traffic.PeagsusOpen source reporting reveled that Israel’s Whatsapp intelligence collection tool, Peagsus, had been deployed in 45 different countries for mobile phone collection and even sold to Saudi Arabia for monitoring potentialSnakeIranian developed malware, Nautilus and Neuron, in combination with one of its own toolkits, called Snake, Turla obtained access to targets by scouring their networks for backdoors that had been inserted byUMBRAGEThe Vault 7 release discussed the Remote Device Branch’s project UMBRAGE group sophisticated false flag operations as well Weeping Angel, where IoT devices, such as smart televisions are exploited for use as spyware.
Countries
ChinaIntelligence and Espionage — The early beginnings of cyber-based information operations were conducted by the US government’s National Security Agency (NSA) and China’s People’s Liberation Army (PLA).IndiaAccording to open source intelligence reporting, North Korean hackers have successfully deployed a new ATM malware, called ATMDTrack that records and steals banking data from cards inserted in vulnerable ATMs in India.IranUS government officials, journalists covering global politics and prominent Iranians living outside of Iran.IsraelIt a widely known “secret” that key HUMINT (human intelligence) collection is conducted by Israel’s Mossad and the US CIA in dark web forums, chatrooms and internet relay chats.North KoreaIn recent years, North Korea has been successful in launching nation-wide banking system hacks across east Asia.RussiaIn late 2015, Russia demonstrated how kinetic attacks conducted against critical infrastructure (e.g., telecommunications, utilities, etc.) and information outlets could cripple a Nation-State, with hacks againstSaudi ArabiaIn 2017, Iran conducted cyber attacks against safety systems at Saudi Arabia’s Aramco, one of the largest oil producer in the world.Ukraineutilities, etc.) and information outlets could cripple a Nation-State, with hacks against Ukraine during on-going conflicts over Crimea.United KingdomRecent reporting that hackers from the United Kingdom infiltrated Russia’s Turla Group highlights the sophistication of the UK’s capabilities.United StatesIn the era of digital information operations, the United States, Russia and China are the primary Nation-State actors discussed in mass media and open source reporting.
Industries
Academic researchreporting suggests that North Korea has successfully used phishing for obtaining access to numerous academic research organizations and critical US think tanks, using China’s model for technological advancement viaBankingIn recent years, North Korea has been successful in launching nation-wide banking system hacks across east Asia.DefenseCritical US defense technology has been released on the dark web and available for intelligence collection and reverse engineering by foreign adversaries.EnergyRussia is also believed to be behind a number of attacks against Irish energy networks, possibly a testing ground for exploit development planned to use against more formidable opponents.GovernmentCyber Actors will utilize the dark web to conduct intelligence collection and source development, government and corporate espionage, exploit development and testing, disinformation operations for geopoliticalTelecommunicationslate 2015, Russia demonstrated how kinetic attacks conducted against critical infrastructure (e.g., telecommunications, utilities, etc.) and information outlets could cripple a Nation-State, with hacks against Ukraine