Dark Web Markets: How Criminal Marketplaces Work

Most of what people imagine about the dark web is wrong in one direction or the other. It is either a lurid bazaar of everything illegal, or a myth invented to sell antivirus. The reality for a defender is more useful and more boring. Dark web markets are commerce platforms. They have catalogues, search bars, seller ratings, dispute resolution, and customer support. What makes them criminal is the inventory, not the machinery.

This guide explains how those markets work at a conceptual level, what trades on them, and why they keep coming back after every takedown. It does not explain how to reach one, and it does not need to. Understanding the shape of the economy is what helps you defend against it.

What "dark web market" actually means

The dark web is the slice of the internet that is deliberately unindexed and reachable only through anonymising networks, most commonly Tor. A dark web market is a shop hosted as a Tor hidden service, addressed with a .onion name instead of a normal domain.

The hidden service model does two things at once. It hides where the server physically sits, and it hides who is visiting. Traffic is relayed through several volunteer-run nodes, each of which knows only the hop before and after it, so no single point sees both ends of a connection. That property is what the market operators rely on for survival, and what buyers rely on for cover.

None of that is inherently criminal. The same technology protects journalists, dissidents, and privacy-conscious users. The markets are simply one use of it, and the one that matters for threat intelligence.

What gets traded

Cyber-focused markets deal mostly in digital goods, because digital goods are infinitely copyable and easy to deliver. The catalogue tends to fall into three buckets.

Category	Examples	Who buys it
Stolen data	Credential dumps, stealer logs, payment cards, personal records	Fraudsters, account-takeover crews
Access	Footholds into corporate networks, valid VPN and RDP logins, admin sessions	Ransomware affiliates, other intruders
Tooling and services	Malware builders, exploit kits, phishing kits, cashout and money-laundering services	Aspiring operators, established crews

The second row is the one that should worry a security team most. When an initial-access broker sells a working entry point into a company, the buyer skips the hardest part of an intrusion. On MITRE ATT&CK this maps to Acquire Access (T1650), and the reconnaissance side of buying stolen data maps to Purchase Technical Data (T1597.002).

Access is the product that connects the quiet, high-volume world of infostealers to the loud, expensive world of ransomware. A stealer infection on one laptop becomes a log, the log surfaces in a market, a broker refines it into a corporate foothold, and an affiliate turns that foothold into an extortion event weeks later.

Follow the supply chain

The buyers downstream of these markets are trackable actors, not anonymous ghosts. Our Threat Groups directory maps the ransomware crews and access brokers that sit on either side of the marketplace, so you can see who sells footholds and who turns them into incidents.

How anonymous strangers learn to trust each other

The interesting engineering problem for a criminal market is not anonymity. Tor solves that. The hard problem is trust. Two parties who have hidden their identities from each other, and from the law, still need to complete a transaction where one side pays and the other delivers. Every design feature of these markets exists to manage that problem.

Escrow is the core mechanism. The buyer's payment, usually in cryptocurrency, is held by the market rather than sent straight to the vendor. The funds release only when the buyer confirms delivery, or after a dispute is resolved. This stops the simplest scam, taking the money and vanishing, and it is the same principle a legitimate marketplace uses to protect buyers.

Reputation is the second mechanism. Vendors accumulate ratings, review counts, and tenure. A seller with hundreds of positive transactions is a known quantity, and buyers pay a premium for that predictability. New vendors often have to post a bond or sell cheaply to build a record. The effect is a self-policing quality signal that makes the market usable.

Dispute resolution, forums, and support round it out. Markets run moderators and arbitration precisely because a marketplace that cannot resolve conflicts loses its users to one that can. The result looks unnervingly professional, because the incentives that shaped legitimate e-commerce shaped these too.

Why markets keep dying and coming back

Individual markets are fragile. They disappear for three main reasons.

Law enforcement seizure. Agencies identify the operators or the hosting, take control of the infrastructure, and often run the site quietly for a period to gather intelligence before the takedown becomes public.
Exit scams. The operators wait until escrow holds a large balance, then take everything and disappear. Trust was the product, and they sell it out at the end.
Internal collapse. Denial-of-service attacks from rivals, disputes among administrators, or a loss of nerve after a competitor is arrested can end a market on their own.

The important point for defenders is that the death of a market does not shrink the ecosystem. The vendors, the buyers, and often the operators simply move. A seizure removes a storefront; it rarely removes the people. Reputation is portable, so a trusted vendor announces a new home and their customers follow. This is why chasing specific market names is a treadmill. The underground reorganises around the same functions every time.

A takedown is a pause, not a cure

When a major market is seized, exposed credentials and access that were listed on it do not become safe. They were already copied and sold. Treat any confirmed exposure as compromised regardless of what happens to the market it appeared on, and rotate accordingly.

What this means for a security team

You will almost never visit these markets, and you do not need to. What matters is treating them as an intelligence signal about your own organisation.

Watch for exposure of your assets. Credential-monitoring and stealer-log services can tell you when logins tied to your domains surface for sale. That is an early warning of an infection you may not have detected internally.
Assume access is for sale before an incident, not during one. The broker economy means intrusions are often bought, not earned. Harden the things brokers sell: exposed VPN and RDP, reused credentials, and unmanaged remote access.
Kill the supply at the source. Most of the data in these markets originates from infostealer infections and phishing. Reducing what a browser stores and blocking credential-harvesting delivery cuts off inventory upstream. See What Is an Infostealer.
Rotate on confirmation, not on takedown. If your data is confirmed exposed, invalidate sessions and rotate credentials immediately. Do not wait for a market to be seized to act.
Track the buyers, not the storefronts. Understanding which crews buy access into organisations like yours tells you more than the name of this month's market.

Dark web markets are durable because they are well designed and because demand is constant. You cannot shut down the demand, but you can make yourself a poor supplier: fewer harvested credentials, fewer exposed footholds, faster rotation when something leaks. The market will keep running. The goal is that your name stops appearing in the catalogue.

How a single infection becomes a marketplace listing

The abstract categories become concrete when you follow one piece of data through the chain. Consider a laptop that runs an infostealer after the owner opens a booby-trapped download. The malware runs for a few seconds, harvests everything the browser has saved, and exits. What it collected is now a stealer log, and that log has a life of its own.

The first stop is a log aggregation channel or a bulk seller. Raw stealer output arrives in enormous volume, most of it worthless: personal webmail, streaming logins, forum accounts. A bulk operator sorts it, dedupes it, and packages it. At this stage the data is cheap and sold by the thousand, because the buyer is prospecting rather than targeting.

The second stop happens when a buyer parses those logs for something valuable. A single corporate credential, a session cookie for a company single sign-on portal, or a saved VPN login turns a commodity log into a lead. The person who spots it is often an initial-access broker, and their skill is recognising which lines in a dump are worth real money.

The third stop is the access listing. The broker validates the credential, confirms it reaches a live corporate environment, and lists it for sale with a description: the sector, the rough revenue of the target, the level of access, and a price. This is the high-value inventory a security team should fear, and it is why the same infection that looked trivial on day one becomes an intrusion weeks later.

The fourth stop is the incident. A ransomware affiliate buys the access, moves through the network, and launches an extortion event. By the time the victim notices, the data has changed hands three or four times and the original infection is long forgotten. Understanding this pipeline is what lets a defender intervene early, at the log stage, rather than late, at the ransom note.

How markets compare to other criminal channels

A market is one venue for these trades, and it helps to see it beside the alternatives, because the choice of venue tells you something about the actor and the risk.

Channel	How it works	Trust model	Typical use
Market (hidden service)	Catalogue with escrow and vendor ratings	Enforced by the platform	Volume sales of data and tooling
Invite forum	Reputation-gated boards with vetted members	Community vouching and history	Access deals, recruitment, higher-value trades
Encrypted messaging	Private channels and group chats	Direct, personal, deal by deal	Fast deals, affiliate coordination, closed crews
Direct broker contact	One seller negotiating privately	Bilateral, often via a known handle	Bespoke, high-price corporate access

The trend over recent years has moved some trade off large markets and onto invite-only forums and encrypted messaging. The reason is exposure. A big market is a single target for law enforcement, and its takedown burns everyone on it. Smaller, gated venues spread the risk and make infiltration harder. For a defender this matters because it means the absence of your data on public markets does not prove it is unsold. It may simply be moving through a channel you cannot see.

Detection signals: how exposure surfaces

You will not browse these venues, so exposure reaches you through indicators rather than direct observation. These are the concrete signals worth wiring into a monitoring program.

The first signal is a corporate credential appearing in a stealer-log feed. Commercial and community services ingest large volumes of stealer output and index it by domain. A login tied to your company surfacing there is a strong indicator that an employee or contractor device is infected, even if your own endpoint tools saw nothing.

The second signal is a session cookie or authentication token for one of your portals showing up for sale. Cookies are more dangerous than passwords because they can bypass multifactor prompts entirely. A stolen valid session lets an attacker resume an authenticated session without ever seeing the password or the second factor.

The third signal is a vague access listing that matches your organisation's profile. Brokers rarely name the victim, but they describe it: the country, the industry, the approximate size, and the type of access. A listing describing a company that looks like yours is worth treating as a lead to investigate internally.

The fourth signal is chatter that references your brand, your executives, or your products in criminal channels. Mentions can precede a listing, as an actor gauges interest or recruits help.

The fifth signal is a spike in credential-stuffing or password-spray activity against your login surfaces shortly after a breach elsewhere. Freshly traded credential sets get tested at scale, and a sudden rise in failed logins from distributed sources can be the downstream echo of a new dump.

Cookies outrank passwords

A stolen session cookie can be more valuable to an attacker than a password, because a live cookie may sail straight past multifactor authentication. If you learn that session tokens for your applications are exposed, invalidating active sessions matters as much as resetting passwords. Rotating the password alone leaves the stolen session working until it expires.

Common misconceptions

Several beliefs about dark web markets lead defenders to the wrong conclusions.

The first is that the dark web is mostly about drugs and contraband. Those markets exist, but the part that matters for a security team is the digital economy: credentials, access, and tooling. Cyber-focused venues trade almost entirely in data and services, because those are copyable and deliverable without a physical shipment.

The second is that a market takedown makes the listed data safe. It does not. Anything listed was already copied, and usually already sold, well before the seizure. A takedown removes a storefront and sometimes arrests operators, and it does nothing to un-leak the data. Treat any confirmed exposure as compromised regardless of what happens to the venue.

The third is that being on Tor makes participants untraceable. The network hides connection metadata, but the humans still make mistakes. Reused handles, cashout patterns, operational slip-ups, and the money trail have all led to identifications. Anonymity technology does not make anonymous behaviour, and law enforcement attacks the human layer rather than the transport.

The fourth is that these markets are chaotic and amateurish. The durable ones are the opposite. Escrow, arbitration, reputation, and customer support exist because a marketplace that cannot manage trust loses its users. The professionalism is what makes the ecosystem resilient.

The fifth is that only large enterprises are targeted. The broker economy runs on volume, and small and mid-sized organisations are frequently the easier, cheaper access to sell. A company being unremarkable is no protection when the product is simply a working way in.

Where this fits in the criminal supply chain

It helps to place markets in the wider structure of cybercrime, because they are one layer of a division of labour that has matured over years. The specialisation is what makes the whole system efficient and hard to disrupt.

At the bottom are the harvesters: infostealer operators, phishing crews, and mass-scanning groups that generate raw material at volume. In the middle are the refiners and brokers who turn raw data into targeted, validated products. Near the top are the operators who buy access and monetise it, most visibly ransomware affiliates, but also fraud crews and business-email-compromise groups. Around all of them sit the service providers: bulletproof hosting, malware developers, and money launderers who cash out the proceeds.

Markets are the connective tissue between these layers. They let a harvester sell to a broker without knowing them, and a broker sell to an operator without knowing them either. Escrow and reputation make those introductions safe enough to transact. When you understand the market as an exchange between specialists, its persistence makes sense: you can seize a specific exchange, and the specialists just find another.

This division of labour also explains why the barrier to entry for cybercrime has fallen. An operator no longer needs to write malware, run a phishing campaign, and breach a network personally. They can buy each capability as a product or a service from a specialist who does only that. The market is what makes that outsourcing possible, and it is why a relatively unskilled actor can still cause a serious incident by assembling bought parts. The defensive implication is that hardening against one stage is not enough, because the attacker can simply purchase their way past the stage you strengthened.

Frequently asked questions

Is visiting a dark web market illegal?

Accessing Tor and viewing a hidden service is generally not illegal by itself in most jurisdictions, but buying stolen data, access, or criminal tooling is. For a defender there is rarely any reason to visit directly. The intelligence you need comes through monitoring services that do the collection for you, which keeps you out of legal and safety risk.

How do defenders find out if their data is for sale?

Through credential-monitoring and stealer-log services that ingest and index leaked and traded data, and through threat-intelligence providers who track listings and chatter. These services alert you when logins tied to your domains, or descriptions matching your organisation, appear. That is far safer and more complete than trying to browse venues yourself.

Why do seized markets reappear under new names?

Because a seizure removes infrastructure, not people. The vendors, buyers, and often the operators survive, and reputation is portable. A trusted vendor announces a new home and their customers follow. Chasing individual market names is a treadmill, since the underground reorganises around the same functions each time.

What is the single most valuable product traded?

Validated access into corporate networks, sold by initial-access brokers. It removes the hardest part of an intrusion for the buyer and directly feeds ransomware and extortion. On MITRE ATT&CK this maps to Acquire Access, technique T1650. Stolen data and tooling matter, but access is the product that turns a quiet infection into a loud incident.

Does multifactor authentication protect me if my credentials are sold?

It helps a great deal against plain password reuse, but it is not absolute. Stolen session cookies can bypass multifactor prompts, and some phishing kits capture the second factor in real time. Multifactor should be on everywhere, and it should be paired with session invalidation and phishing-resistant methods where possible.

How fast should I act on a confirmed exposure?

Immediately. Do not wait for a takedown or further confirmation. Invalidate active sessions, rotate the exposed credentials, and hunt for signs the access was already used. Data on a market was copied before you learned about it, so the clock started before your alert did.

How does payment work on these markets?

Almost always in cryptocurrency, held in escrow by the platform until a deal completes. Buyers fund an account, escrow holds the balance during a transaction, and funds release to the vendor once the buyer confirms delivery or a dispute resolves. Operators take a commission on each sale, which is their revenue and also their exit-scam temptation: when escrow holds a large balance, the operators can vanish with it. The reliance on cryptocurrency is also a weakness for the criminals, because the money trail is a persistent record that investigators can follow long after a transaction, and clustering analysis has repeatedly linked pseudonymous wallets back to real identities.

Should a defender ever engage with a seller?

No. Contacting a vendor, negotiating, or attempting a purchase carries legal risk, funds the criminal economy, and can expose you or your organisation to retaliation and further targeting. Any interaction that is genuinely useful, such as validating a listing, belongs to specialised threat-intelligence teams and law enforcement operating under legal authority, not to an in-house security team acting alone.

Dark web markets will outlast any single takedown because they are well built and demand for their inventory never stops. Your leverage is upstream and downstream: cut the supply by reducing harvested credentials and exposed footholds, and cut the damage by rotating fast when something leaks. You cannot close the market, and you can make sure your organisation is a poor supplier to it.