What is the Darknet?
The Darknet is the part of the internet that can only be reached with special anonymisation software such as Tor or I2P, which hides the identity and location of both visitors and websites. Ordinary browsers and search engines cannot find or open these sites. The darknet has legitimate uses, such as reading news anonymously in countries with censorship and contacting journalists safely, but it is best known as a marketplace for stolen credentials, malware, access to corporate networks and leaked data. For security in IT and OT, it is therefore an important source of threat intelligence.
🌐 What is the difference between the surface web, deep web and darknet?
The three terms are often used interchangeably, but they describe different things. The difference lies in whether content is indexed and whether special software is needed.
| Layer | Description | Examples | Access |
|---|---|---|---|
| Surface web | Public, indexed by search engines | Corporate websites, Wikipedia, news sites | Any browser |
| Deep web | Not indexed, often behind a login | Webmail, intranets, paywalls, a SCADA vendor’s customer portal | Any browser, with an account |
| Darknet | Hidden services in an overlay network | .onion sites, I2P sites, ransomware leak sites | Tor Browser, I2P client |
The deep web is by far the largest part and is largely harmless: your own mailbox belongs to it. The darknet is a small part of it. Messaging services such as Telegram are strictly speaking not darknet, but much of the criminal trade has shifted to such channels in recent years.
Note a second meaning: in network security, a darknet or network telescope is also a block of unused IP address space on which researchers record all incoming traffic. Because nothing legitimate should arrive there, such a darknet reveals scanning activity, worms and DDoS backscatter. This article is about the first meaning.
🔧 How does the darknet work technically?
The best-known darknet runs on Tor (The Onion Router). The principle of onion routing was developed from 1995 at the US Naval Research Laboratory; the Tor network went live in October 2002, and since 2006 it has been run by the non-profit The Tor Project. The Tor Browser has been developed since 2008.
- Layered encryption - a message is encrypted in several layers, like an onion; each relay peels off one layer and only knows the previous and next hop
- Three relays per circuit - for ordinary web traffic a connection runs through a guard, middle and exit relay, so no single relay knows both sender and destination
- Onion services - a .onion site also hides the location of the server; client and service each build three hops to a rendezvous point, six relays in total
- v3 addresses - an .onion address is 56 characters long and is derived from the service’s public key, not registered with a DNS registrar
Besides Tor there is I2P (Invisible Internet Project, a network designed mainly for services inside the network itself) and Freenet, a peer-to-peer storage network from 2000. The term “darknet” itself became widely known through a 2002 paper by Microsoft researchers on the sharing of copyrighted files.
🧠 Why is the darknet relevant to OT security?
Attackers targeting industrial environments and industrial control systems rarely develop everything themselves. They buy components on the darknet and in criminal channels. The main products are:
| Product | What is traded | Consequence for OT |
|---|---|---|
| Credentials | Username and password pairs from data breaches and infostealers | Logging in to VPN, RDP or remote access portals |
| Initial access | Existing access to a corporate network, sold by so-called access brokers | Starting point for ransomware that halts IT and indirectly production |
| Session cookies | Browser data from infected PCs, which can sometimes bypass MFA | Takeover of cloud and vendor accounts |
| Exploits | Working attack code, sometimes for a zero-day | Abuse of vulnerable firewalls, VPN gateways or HMI software |
| Leaked files | Data that ransomware groups publish on leak sites | Network drawings, PLC programs, firmware details and password lists exposed |
| Ransomware-as-a-Service | Ransomware rented out to affiliates | Lower threshold for attacks on manufacturers |
In OT incidents, the control system itself is rarely the first target. Many incidents start in the IT environment, with a leaked password or purchased access, and hit production because IT and OT are connected or because the company shuts down as a precaution. Darknet information therefore mainly supports the first steps of the cyber kill chain: reconnaissance and initial access.
🧩 Which incidents show the role of the darknet?
| Incident | Year | Darknet element |
|---|---|---|
| Hansa and AlphaBay | 2017 | Dutch police took over the darknet market Hansa on 20 June 2017 and ran it covertly for about a month; AlphaBay went offline on 4 July 2017 |
| Colonial Pipeline | 2021 | The password of an unused VPN account without MFA was later found in a batch of leaked passwords on the dark web |
| Genesis Market | 2023 | Market for stolen browser data of more than two million people, taken down on 5 April 2023 in an operation led by the FBI and Dutch police |
| LockBit | 2024 | Its Tor leak site was seized in February 2024 during Operation Cronos, led by the UK’s NCA with participation of the Dutch police |
In the Colonial Pipeline case it was never established with certainty that the attackers took the password from that list. The example does show why password reuse and missing 2FA are dangerous.
🔎 How do you monitor the darknet?
Darknet monitoring means searching criminal sources for data about your organisation. Few organisations do this themselves: it requires access to closed forums, which brings legal and operational risks. It is usually done through a service provider or a threat intelligence platform.
| Tool | Purpose |
|---|---|
| Darknet monitoring service | Alerts on leaked credentials, email domains, IP addresses or documents of your organisation |
| Threat intelligence platform | Links darknet findings to indicators of compromise and known threat actors |
| SOC and SIEM | Correlates leaked accounts with login attempts in your own logs |
| Anomaly detection | Detects abuse of leaked data, such as logins at unusual times |
| Threat hunting | Searches for traces of an attacker after access was found for sale |
Step-by-step approach for an OT organisation
- Define what to look for - email domains, VPN hostnames, public IP addresses, plant names and vendors with remote access
- Choose a source - a commercial service, your MSSP or sector information via the NCSC and sector ISACs
- Define the follow-up - who resets a password, who checks the logs and when it becomes an incident under your incident response plan
- Close the root cause - a found credential means: block or reset the account, enforce MFA and remove unused accounts
- Review periodically - how many findings there were, how fast the follow-up was and which vendors keep coming back
🔐 How do you limit the damage from darknet information?
You cannot prevent data from leaking somewhere, but you can make it useless:
- MFA on all external access - a leaked password alone is then not enough; prefer phishing-resistant methods
- No direct access to OT - let vendors work via a jump server, with network segmentation between IT and OT
- Least Privilege and access control - accounts get only the rights they need, and unused accounts are removed
- Zero Trust - every connection is assessed again, even from a known account
- Patch edge devices quickly - exploits for VPN gateways and firewalls are traded soon after publication; see vulnerability management
- Security Awareness - staff recognise spear phishing that uses leaked personal data
What does the law say?
Visiting the darknet is not a criminal offence in the Netherlands. Buying, holding or reselling stolen data is: since 1 March 2019 (Computer Crime Act III), article 139g of the Dutch Criminal Code makes handling non-public data obtained through a crime an offence, punishable by up to one year in prison. So never buy back leaked data yourself. Organisations covered by NIS2 and the Dutch Cyberbeveiligingswet must also manage their cyber risks, and ISO 27001:2022 explicitly requires threat intelligence in control 5.7.
❓ Frequently asked questions
Is the darknet illegal?
The darknet itself is not illegal: Tor and I2P are legal software, and visiting .onion sites is permitted in the Netherlands. What you do there can be a criminal offence, such as buying drugs, malware or stolen data. Handling non-public data obtained through a crime has been an offence under article 139g of the Dutch Criminal Code since 2019.
What is the difference between the darknet and the dark web?
Darknet is the collective name for anonymous overlay networks such as Tor and I2P. Dark web usually refers to the websites that run on those networks. In practice, security professionals use both terms as synonyms.
How do I know whether my company data is on the darknet?
You find out through darknet monitoring by a threat intelligence service or your MSSP, which alerts you to findings involving your domains or accounts. After takedowns, the Dutch police sometimes offer a check, such as the Check your Hack page for Genesis Market. Never search criminal forums yourself and never buy data back.
Are OT-specific items sold on the darknet as well?
Yes, but less often than general IT access. Access to VPN and remote access environments of industrial companies is offered, and ransomware leak sites sometimes contain network drawings and PLC documentation. Most damage to OT arises indirectly, through ransomware in the IT environment.
Does MFA help against passwords leaked on the darknet?
Yes, MFA is the most important measure against the abuse of leaked passwords, because the password alone is then not enough. Stolen session cookies can bypass MFA, so phishing-resistant MFA and short session lifetimes are advisable. At Colonial Pipeline, MFA on the VPN account would probably have prevented the attack.
What is Tor?
Tor (The Onion Router) is open-source software that routes internet traffic through three volunteer-run relays with layered encryption, so the destination does not see the user’s IP address. Tor also enables onion services, websites whose server location remains hidden. The network has been active since 2002 and is run by The Tor Project.
📌 In summary
The darknet is a hidden part of the internet where attackers trade credentials, network access, exploits and leaked data, which makes it a frequent starting point for attacks that also hit OT. Monitor specifically for your own data, make leaked passwords worthless with MFA and segmentation, and define how you follow up when your organisation turns up in a darknet source.