14 DAY TRIAL // Kaspersky security researchers have been monitoring the activities of cybercriminals on the Darknet, particularly Tor, and they’ve found that the number of operations relying on the anonymity network is increasing.
According to Kaspersky Lab Expert Sergey Lozhkin, there currently are around 900 hidden services on TOR with 5,500 nodes and 1,000 exit nodes.
Cybercriminals are attracted to the Tor network for a number of reasons. It enables them to create anonymous underground forums and markets, and they can use it to create malware command and control (C&C) infrastructure that’s difficult to disrupt.
Examples of malware that rely on Tor of C&C communications include ZeuS, ChewBacca and even the recently-discovered Backdoor.AndroidOS.Torec.a Android Trojan.
While using Tor has advantages, it also has disadvantages, including the fact that Tor-based malware is larger in size and more difficult to develop. However, Lozhkin believes that their number will increase. In addition, existing malware will probably include Tor support.
Silk Road is a perfect example of a successful underground market place. However, there are many others that can be used to buy or sell drugs, weapons and cybercrime tools.
Another important aspect of Tor’s dark side is the financial one. Since most underground markets rely on Bitcoin and other virtual currencies, it’s easy for cybercriminals to commit financial fraud and launder their criminal proceeds.