I thought the dark web was the exploit shelf. Then I built an engine to look inside it and found a dump of stolen data, refilled by double-extortion ransomware. Here's onionwatch: why I built it, what I found, and how it's built.
I used to think the dark web was the exploit shelf too: the place where anyone grabs a ready-made 0-day. Then I built a tool to really look inside it — a search engine — and I found something else. Not an armoury. A dump of stolen data, refilled every day by the same machine: double-extortion ransomware.
I had the old ransomware model in my head: they encrypt your files, you don’t pay, you don’t get them back. Backups in order, problem solved. That’s been false for years. Today it works like this (they call it double extortion): before encrypting, the attacker copies everything out. Then encrypts. And the blackmail becomes double: “pay, or (a) you won’t get your data back and (b) I publish it.” If you don’t pay, when the countdown expires, gigabytes of the victim’s data appear on a leak site in the dark web — downloadable by anyone.
Reserved for members
This content is reserved for those in the dojo.
Entry is free: you subscribe to the newsletter with your email and then choose to join the dojo, without a password. How it works
