Skip to content

Case Study: Fintech Security Team slashes Threat Remediation Time with NordStellar

2025-12-19   Combolists are massive datasets of stolen email/password pairs, aggregated from multiple data breaches and infostealer logs. Cybercriminals use them for credential stuffing and account takeover (ATO) attacks, exploiting password reuse across sites. Businesses must enforce MFA, strong passwords, and dark web monitoring to mitigate this threat.

Continue reading

The combolist economy: How stolen credentials fuel cybercrime

2025-12-19   Combolists are massive datasets of stolen email/password pairs, aggregated from multiple data breaches and infostealer logs. Cybercriminals use them for credential stuffing and account takeover (ATO) attacks, exploiting password reuse across sites. Businesses must enforce MFA, strong passwords, and dark web monitoring to mitigate this threat.

Continue reading

Research: Ransomware isn’t slowing down in Q3 2025

2025-12-05   Ransomware attacks surged 47% through Q3 2025, reaching 6,330 cases. The US, SMBs, and the manufacturing sector remain the top targets. This rise is fueled by Ransomware-as-a-Service (RaaS) and led by groups like Qilin, emphasizing the need for stronger employee training and data backup.

Continue reading

Understanding Dark Web Browsers

This article provides an overview of dark web browsers, explaining what they are and why they are used. It clarifies the distinction between the “dark web” and the “deep web,” and describes how these specialized browsers enable users to access a hidden part of the internet with enhanced privacy and anonymity.

What is a Dark Web Browser?

A dark web browser is a specific type of web browser designed to navigate the dark web. It provides anonymity by routing internet traffic through a series of random relays, or “nodes,” which hides a user’s IP address and location. The most well-known example of this is the Tor Browser, which stands for “The Onion Router.” The name “onion router” comes from the layered encryption process, where each layer of a user’s connection is peeled back like an onion as it passes through different nodes.

Dark Web vs. Deep Web

It is a common misconception that the dark web and the deep web are the same. The article clarifies this distinction:

  • Deep Web: This refers to any part of the internet that is not indexed by conventional search engines. It includes content behind paywalls, password-protected sites, and private databases (e.g., your online banking portal or a company’s internal network).
  • Dark Web: This is a small, specific part of the deep web that requires a specialized browser to access. Its primary purpose is to provide anonymity for communication and data exchange. While it is often associated with illegal activities, it is also used by journalists, activists, and others who need to protect their identity and communication.

Common Dark Web Browsers

The article highlights a few of the most popular dark web browsers:

  • Tor Browser: The most widely used dark web browser, known for its strong privacy features and multi-layered encryption.
  • I2P (Invisible Internet Project): A network that is similar to Tor but focuses more on creating a decentralized, peer-to-peer communication layer for things like forums and messaging.
  • Freenet: A decentralized, anonymous network that is designed to provide uncensored communication.

For Organizations and Security Professionals

For organizations, monitoring the dark web is a critical component of a proactive threat intelligence strategy. It allows security teams to identify if their company’s data, such as credentials or sensitive information, is being sold or discussed on illicit forums. Threat intelligence platforms, like NordStellar, can help automate this process, providing alerts and insights to protect against potential breaches.

About NordStellar
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Research: Ransomware attacks spike by 49% in the first half of 2025

Research: Ransomware Attacks Spiked by 49% in the First Half of 2025

A startling 49% surge in ransomware attacks marked the first half of 2025, with cybercriminals increasingly targeting U.S. organizations and small to medium-sized businesses (SMBs). Our latest research reveals that between January and June 2025, ransomware groups exposed 4,198 cases on the dark web—a dramatic increase from the 2,809 cases recorded during the same period in 2024.

So, what forces are driving this alarming trend, who are the primary targets, and what can organizations do to defend themselves?
Why the Sudden Increase? The Forces Driving the Ransomware Boom The profitability and effectiveness of ransomware have emboldened cybercriminals to intensify their efforts. Vakaris Noreika, a cybersecurity expert at NordStellar, identifies three key factors contributing to the growth:
“Factors contributing to the growth in ransomware attacks include the rise in ransomware-as-a-service (RaaS), expanded attack surfaces from remote or hybrid work models, and economic uncertainty that could encourage more people to turn to cybercrime.”
Let’s break down these drivers:
  • Ransomware-as-a-Service (RaaS): This business model lowers the barrier to entry for cybercrime. RaaS providers supply malicious software and infrastructure, allowing affiliates with little to no technical expertise to launch sophisticated attacks.
  • Expanded Attack Surfaces: The shift to remote and hybrid work has increased the number of endpoints, home networks, and personal devices connecting to corporate systems. This creates new vulnerabilities and strains security teams trying to maintain comprehensive protection.
  • Economic Uncertainty: Financial desperation often leads to a rise in illegal activities. Combined with the accessibility of RaaS, ransomware becomes an attractive option for illicit income, offering high potential rewards for relatively low effort.
In a typical modern attack, criminals don’t just encrypt files; they exfiltrate sensitive data and threaten to publish it if the ransom isn’t paid, adding a layer of public pressure. Even if a ransom is paid, there is no guarantee that attackers will provide a decryption key, and they may demand a second payment, leaving victims with severe financial, reputational, and legal damage.
The Prime Targets of Q2 2025 Our analysis of 1,758 ransomware incidents from April to June 2025 reveals clear patterns in targeting. The U.S. Remains in the Crosshairs Of the cases traced to a specific country, U.S. businesses were hit hardest, accounting for a staggering 49% of all attacks (596 incidents). Germany followed at a distant second with 84 cases, trailed by Canada (74) and the United Kingdom (40). The U.S. is a prime target due to its concentration of profitable businesses, which attackers believe are more likely to pay a ransom to avoid reputational damage and operational downtime. The Manufacturing Industry Under Siege The manufacturing sector was the most affected industry, with 229 recorded cases. It was followed by construction (97 cases) and information technology (88 cases). Manufacturing companies are often vulnerable because they struggle to centralize security across geographically dispersed locations and frequently rely on outdated, unpatched operational technology systems. SMBs: The Most Vulnerable Target Small to medium-sized businesses were the primary victims. Organizations with 51–200 employees and revenues between $5 million and $25 million experienced the most attacks.
“The victim profile mirrors data from Q1 2025, with SMBs and manufacturing companies remaining the prime targets,” notes Noreika. “This is a significant cause for concern because bad actors continue successfully exploiting preventable security vulnerabilities.”
Like manufacturing firms, SMBs often have limited budgets for cybersecurity and may rely on third-party IT providers, leaving them exposed.
Who Is Responsible for the Attacks? The ransomware landscape is dominated by a few highly active groups operating on a RaaS model.
  • Qilin: This Russia-linked group was the most prolific, responsible for 214 incidents in Q2 2025.
  • Safepay: A newer group first detected in late 2024, Safepay rapidly escalated its operations to claim the second spot with 201 incidents.
  • Akira: This established ransomware group was a close third, with 200 incidents.

Building a Ransomware-Resistant Business As ransomware attacks persist, a proactive defense strategy is essential.
“Aside from raising cybersecurity awareness, companies should build a comprehensive cybersecurity strategy to detect threats before they escalate,” advises Noreika. “This includes implementing endpoint protection, monitoring the dark web for potential data leaks, and keeping a close eye on the company’s attack surface for unpatched security vulnerabilities.”
Key defensive measures include:
  • Empower Your Employees: Your staff is the first line of defense. Implement continuous cybersecurity training focused on identifying phishing scams, using strong password management, and enabling multi-factor authentication.
  • Implement a Layered Technology Defense: Deploy endpoint protection, continuously monitor your external attack surface for vulnerabilities, and scan the dark web for compromised credentials or leaked data related to your organization.
  • Plan for Recovery: To minimize the impact of a potential attack, Noreika recommends that businesses “stay two steps ahead, implement recovery plans, and always back up critical data.” Regular, tested backups are the most effective way to recover from an attack without paying a ransom.

About the Methodology We continuously monitor over 200 dark web blogs operated by ransomware groups to collect data on victim organizations. Once a company is identified, we use publicly accessible business data sources to gather firmographic information, such as industry, size, and location. The total number of attacks is accurate, though figures in categorized breakdowns may be slightly higher due to a smaller sample size where full firmographic data was available.

About NordStellar
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

How omnisend enhanced its threat visibility with nordstellar

Summary: Omnisend, a leading provider of marketing automation technology, now leverages NordStellar to proactively monitor and mitigate external threats before they escalate.

As a provider of a marketing automation platform used by over 150,000 online stores worldwide, Omnisend must stay ahead of cyber threats at all times. To achieve this, the company relies on solutions like NordStellar.

KEY FACTS

Industry: Marketing technology

Challenge: Limited visibility into external cyber threats and dark web exposure

Solution: NordStellar threat exposure management platform

Results:

  • Improved detection of cyber threats targeting the company
  • Simplified threat prioritization for the Omnisend team
  • Identified instances of company credential leaks
  • Found the root cause of a past security incident

ABOUT OMNISEND

Omnisend provides a cutting-edge marketing automation platform for e-commerce brands, dedicated primarily to email and SMS marketing. The company’s solution is used by over 150,000 online shops worldwide. In 2022, Omnisend was ranked #77 in the Financial Times ranking of Europe’s 1000 fastest-growing companies, and earned the #44 spot in the Deloitte UKFast50 for the third consecutive year.

CHALLENGE

While Omnisend already had several protective measures in place to ensure strong protection of its data and infrastructure, some threats remained under the radar. This was due to the company’s limited visibility into areas such as the dark web. As a result, Omnisend didn’t have the means to monitor leaked company credentials or data compromised by malware.

The company decided to address this after its team attended a live demo of NordStellar, where the platform was used to assess their threat exposure using actual company data. The results were eye-opening. Once they saw what kind of information NordStellar was able to uncover about their business on the dark web, they decided to take appropriate action. In their own words: “Like any professional security team with high standards, we couldn’t just walk away from such findings.”

SOLUTION

Shortly after the demo, Omnisend decided to move forward with the NordStellar platform. The decision was based on three factors:

  • The actionable and impactful findings it delivers
  • A wide range of external threat management features
  • Immediate proof of the platform’s high value during the demo

The company was most impressed with NordStellar’s ability to detect leaks involving employee credentials, a threat vector that often goes unnoticed. Omnisend also praised the platform for providing clear, practical feedback that the team could act on right away, rather than just basic notifications.

To gain insights into external threats targeting the company, Omnisend is making full use of all NordStellar’s features, including:

  • Data breach monitoring
  • Dark web monitoring
  • Attack surface management
  • Domain squatting detection

NordStellar delivers findings that include risk levels and contextual information about security events to help Omnisend better understand the specific circumstances surrounding each incident. As a result, it significantly improves the company’s cybersecurity posture and threat response.

IMPACT

The findings provided by NordStellar help Omnisend’s security team prioritize their tasks and dedicate more attention to other urgent issues. As Žygimantas Stauga, Director of Information Security at Omnisend, said, “There is always an issue to address, but resources are limited. That’s why it’s crucial to prioritize tasks when planning security activities. Insights from NordStellar help us do exactly that.”

NordStellar has also helped the company uncover the root cause of a past security incident. Although the issue had already been handled, the team wasn’t sure exactly what had caused it. Thanks to NordStellar, they discovered it was malware. This revelation had a big impact on the company’s processes and led to important changes in its threat response strategy.

Today, instead of guessing if there’s any trouble, NordStellar immediately notifies Omnisend whenever external threats require their attention. With this information, the company can mitigate risks before they escalate.

“NordStellar is the missing puzzle piece in most organizations’ cybersecurity, catching threats that slip past other defenses.”

Žygimantas Stauga, Director of Information Security at Omnisend

Curious what hackers might know about your business? See NordStellar in action—book a demo with us and learn about the risks you’re probably unaware of.

 

About NordStellar
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Cybercrime-as-a-service: the business model behind digital attacks

A cybercriminal stands in the shadows against a red background, his eye spotlit

Summary: Cybercrime-as-a-service mirrors the SaaS model, selling attack tools on the dark web. Learn how it works and how to defend your business.

Cybercrime-as-a-service (CaaS) is the dark side of modern software development. While the SaaS business model offers low-cost and flexible solutions, CaaS provides similar benefits for cybercriminals.

Thanks to CaaS, executing data breaches or distributed denial-of-service attacks has never been easier, challenging companies to upgrade their security measures. This article will explain how CaaS works and who is behind it, before exploring practical security responses.

What is cybercrime-as-a-service (CaaS)

Cybercrime-as-a-service is a threat model in which vendors provide services or tools to enable attacks by third-party clients. CaaS vendors generally sell products via pay-per-use or subscription models and use dark web marketplaces to conceal transactions.

CaaS operations allow attacks by unskilled criminal groups, expanding the community of threat actors. They cover many cyber threats, including ransomware, DDoS attacks, and credential theft. This makes cybercrime-as-a-service a critical part of the global threat landscape.

How the service model works in cybercrime

Cybercrime-as-a-service (CaaS) functions similarly to conventional third-party applications or cloud services. This familiarity is one reason why CaaS is spreading rapidly. Once restricted to specialist hackers, advanced tools are now available to novice threat actors.

How the cybercrime-as-a-service works in a  nutshell

CaaS attacks follow a lifecycle that starts with purchasing and ends with successful cyber attacks:

Purchase

Vendors create kits that include the tools needed to mount cyber-attacks. They offer these products for sale via encrypted sites. Popular purchasing platforms include dark web marketplaces and encrypted communication tools like Telegram channels.

Buyers can choose between several different kits depending on their goals and budget. CaaS vendors typically offer ransomware-as-a-service kits, tools to spread malware, and phishing kits featuring templates for fake websites and login portals.

Purchases typically take place via hard-to-trace cryptocurrencies. Transactions could be one-off purchases, but subscriptions are common. Marketplaces also often apply escrow models to enforce standards and resolve disputes.

Deployment

Cybercriminals customize CaaS kits to suit their needs before deploying attacks via their favored method. Forms of deployment include:

  • Drive-by downloads: Cybercrime services create credible websites to deceive victims and deploy downloads containing malicious payloads.
  • Phishing emails. Automated kits send personalized phishing emails to mount targeted attacks on victims. Emails persuade victims to download infected attachments, provide login credentials via fake websites, or take other risky actions.
  • Malvertising. CaaS kits deploy fake ads that are infected with malicious software. Malware spreads as users visit websites hosting the ads, enabling secondary data theft or ransomware attacks.

In the above deployment methods, off-the-shelf kits do the technical work (bypassing encryption, anonymizing attackers, or creating convincing fake assets).

CaaS kits also implant malicious tools on target systems. They seek ways to achieve lateral movement and discover sensitive data, often deploying credential theft tools to expand their reach. Backdoors also enable unskilled attackers to achieve persistence and execute sophisticated attacks.

Outcomes

After deploying threats and achieving persistence, cybercriminals can launch many types of cyberattacks.

For example, criminals use cybercrime services for gaining access to a target’s network security and implanting ransomware agents. These agents encrypt sensitive data or infrastructure until victims pay a ransom.

CaaS can also enable distributed denial-of-service (DDoS) attacks against network systems. Cybercriminals can extract data from cloud databases, use stolen financial credentials to make illicit transfers, or launch crypto-jacking attacks.

Who runs cybercrime-as-a-service operations?

Security experts estimate that cybercrime-as-a-service vendors earn over $23 billion annually, with an annual growth rate of over 12 percent. The market is increasingly complex, creating an ecosystem with many specialized roles.

Developers handle the production aspect of CaaS. For example, developers might create and update malware to stay ahead of cybersecurity measures. Other development teams focus on building botnets or exploit kits to target recently discovered vulnerabilities.

Affiliates tend to handle marketing and sales for developers. Marketers advertise CaaS products on the dark web and Telegram, along with prices and payment plans. Affiliates often earn commissions from successful attacks (sometimes as high as 30 percent).

Resellers operate independently from developers and affiliates. They sell products directly to customers, often those with less tech knowledge or awareness of the cybercrime landscape. Resellers may combine CaaS sales with tech support to attract buyers. They also buy in bulk and resell subscriptions at significant discounts.

Where does that leave the customers who actually purchase off-the-shelf CaaS products? Many buyers are new entrants to the cybercrime ecosystem. So-called “script kiddies” with few skills use CaaS kits to launch previously inaccessible attacks.

However, organized cybercriminals also rely on CaaS products to expand their operations. These criminals act like conventional businesses, seeking ways to cut costs and maximize revenues.

About NordStellar
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Phishing-as-a-service: Tools, tactics, and risks for organizations

Symbolic illustration of phishing as a service system, with interconnected circles representing the attacker’s toolkit and workflow

Summary: Phishing-as-a-service lets anyone launch advanced attacks using ready-made kits. Learn how it works, the risks it poses, and how to defend.

SaaS models have spread to the dark web, and that’s a problem. Criminals can now buy or sell the technology needed to mount diverse cyberattacks, including large-scale phishing campaigns.

Phishing-as-a-service (PhaaS) is a critical cyber risk for all companies. Attacks that were once too complex for low-skill hackers now have an affordable price tag. This article will introduce how PhaaS works, what kits offer, and how to respond.

What is phishing-as-a-service (PhaaS) and who uses it?

Phishing-as-a-service allows unskilled cyber attackers to run phishing attacks by purchasing or renting advanced tools. PhaaS kits created by specialist developers enable novice attackers to build fake websites or send believable emails from trusted contacts.

Phishing-as-a-service streamlines phishing activities. Previously, threat actors needed to build websites, implant payloads, and research targets to create social engineering content. PhaaS provides ready-made phishing kits via familiar subscription models.

PhaaS emerged due to the rising demand for phishing technologies from professional criminal collectives and fraud rings. However, malicious insiders may also purchase and use PhaaS kits to damage their employers and steal sensitive data.

Common features offered in phishing kits

Phishing-as-a-service kits include the tools to contact, manipulate, and attack targets. Common elements of phishing kits include:

  • Customizable templates. Developers include email templates or web pages from legitimate brands. Phishers can enter basic details for each target, or customize the content if needed. Advanced templates offer responsive designs for mobile devices and desktops, and may also include geolocation tools to tailor phishing emails and pages to different regions.
  • Fake login pages. Developers create sites resembling portals for reputable brands (for instance, Google Mail). These phishing domains harvest login credentials from unsuspecting visitors. Advanced kits may include Captcha filters to add credibility.
  • Data harvesting tools. Kits provide backend tools to harvest information from phishing pages and securely store exfiltrated data. Developers may offer encrypted storage via Telegram as a core function or an optional add-on.
  • SMS spoofing tools. Kits allow users to send large quantities of SMS messages from seemingly trusted sources. This is particularly effective when phishers aim to capture one-time passwords and gain access to internal networks.
  • Email spoofing tools. Spoofing allows phishers to bypass email security filters. Phishing tools create fake sender addresses that resemble legitimate contacts.
  • Obfuscation tools. Phishing kits include tools to avoid detection by security systems or make analyzing phishing pages more complex. For example, kits may use URL redirection or content cloaking to avoid filters flagging sites as dangerous.
  • Domain spoofing. Kits include tools to create fake websites that resemble legitimate versions. They may use homoglyphs or typosquatting to generate domains that contain spelling errors but superficially appear convincing.
  • Analytics dashboards. Advanced phishing-as-a-service kits include dashboards to monitor key metrics. For example, analytics tools track click-through rates, rates of successful phishing attempts, and how often victims open malicious attachments. Dashboards may also enable A/B testing to fine-tune phishing techniques and help attackers work around security filters.
  • Customer support/documentation. Some phishing-as-a-service vendors offer onboarding and operational assistance. Kits often feature step-by-step tutorials to evade security measures, research potential victims, and harvest stolen data.
  • Authentication bypassing. Advanced kits like Tycoon 2FA use fake login portals and reverse proxies to create authentic sessions using intercepted credentials – potentially bypassing multi-factor authentication controls.
  • Automatic updates. High-quality phishing kits automatically update tools to work around the latest anti-phishing software.
  • Integrations. Phishing-as-a-service is part of a wider cybercrime ecosystem. For instance, phishing kits integrate with keyloggers and infostealers to gather information and enhance social engineering attacks.

Like standard SaaS, phishing-as-a-service kits provide everything users need to begin operations while minimizing the need for IT expertise. Developers sell flexible payment options, streamline tools for novices, ensure regular updates, and support customer queries.

About NordStellar
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Deep web vs dark web: Key differences business and security teams need to know

Deep web vs dark web

Summary: Uncover the critical differences between the deep web and dark web, understand their cybersecurity risks, and learn why proactive monitoring is essential to protect your business from modern cyber threats.

The internet is far more than the visible web. Like the mass of an iceberg, most information and web pages lie below the surface.

The hidden corners of the web can be “deep” – buried beneath the surface, but easy to uncover. However, they can also be “dark” – allowing criminal activity to flourish without surveillance.

Understanding the difference between the deep web and the dark web could be critical to your enterprise cybersecurity. This article will explain how the deep and dark web differ and provide valuable tips for securing sensitive data.

What is the deep web?

The deep web includes web content that is not indexed by search engines. This may seem trivial, but it amounts to vast amounts of data.

For instance, Google appears comprehensive. However, its web crawler index is less than five percent of the World Wide Web. The rest remains on the deep web, and you can’t reach it via traditional search engine results.

Pages on the deep web include password-protected sites like private databases, internal company pages, academic journals, and medical records. Web browsers can often access these pages with the correct credentials, but search engine crawlers cannot process them.

Most deep web content is not malicious. Universities and medical providers need to keep confidential content out of the public eye. Website owners often use the robots.txt file to manage traffic and determine what data search engines can access.

The critical takeaway when comparing deep web vs dark web content is that the deep web is publicly accessible without special browser tools. Anyone with the right credentials can gain access. That’s why criminals prefer the more private environment of the dark web.

What is the dark web?

The dark web is a section of the deep web protected by multiple layers of encryption.

Users can only access dark web servers via special browsers like Tor (the Onion Router). The Tor browser uses randomization to route traffic through virtual tunnels before granting access. This architecture anonymizes users and complicates dark web monitoring.

Ordinary browsers cannot access dark web sites due to unique registry operators. Web crawlers cannot penetrate the encryption protecting dark web servers. Without Tor or other specialist tools, access is impossible.

The dark web emerged in 2000 as a decentralized platform for anonymous communication. In theory, it remains a valuable tool – enabling secure communication for whistle-blowers and individuals in repressive states. However, it has also become a haven for illegal activities.

Dark web marketplaces allow data thieves to sell credentials and other sensitive information. Hackers plan data breaches on dark web forums, while merchants sell many types of illegal goods to customers worldwide.

What is the surface web?

Both the dark web and the deep web exist beneath the surface web. The surface web includes websites indexed by search engines like Google or Bing.

For most internet users, the surface web is all they see. However, the visible web is only a small fraction of all web traffic. 90–95% of web content is submerged and wholly or partially inaccessible via browsers like Google Chrome.

Layers of the web

Deep web vs dark web: key differences

The table below provides a quick deep web vs dark web comparison to understand the differences between the two:

 

Deep web

Dark web

Access method

Accessible via normal web browsers.

Only accessible via special tools (such as the Tor browser or the Invisible Internet Project)

Size

Massive, containing more than 90% of the internet, consisting of hundreds to thousands of exabytes of data, eclipsing both the surface web and dark web.

Relatively small subset of the deep web, estimated at 0,01–5% of the total internet or around 150,000 websites, with only a few thousand unique sites globally.

Visibility

Visible to web browsers, provided users have the appropriate credentials.

Invisible to ordinary web browsers due to strong encryption.

Threat level

Relatively low. Deep web content may include confidential data, requiring robust access controls and encryption. However, most content is benign and carries a low threat level.

High. Criminal collectives routinely use dark web sites for illegal activities like planning cyber attacks, sharing leaked credentials, and selling exploit or ransomware-as-a-service kits. If credentials appear on dark web forums, companies should anticipate their use in future attacks.

Legal exposure

Low. Companies often use the deep web in everyday operations. Deep web sites may host illegal content (such as torrents). However, using the deep web for legitimate reasons is uncontroversial.

Many dark web sites carry a high legal risk due to illegal activities. Using Tor to browse the dark web is legal, although participation is not advisable.

Why the difference matters for businesses

The differences above matter for one core reason: the dark web functions as a clearinghouse for illegal activities. Cyber threats hatched on the dark web steal data, disrupt business operations, and lead to severe regulatory and reputational damage.

Attackers may collaborate on dark web forums to share information and create sophisticated phishing campaigns, use off-the-shelf exploit kits to leverage backdoors, or mobilize stolen login credentials in brute-force attacks.

This situation challenges risk analysts and security teams to discover leaked credentials and gather threat intelligence. Companies need to update their threat prevention techniques to monitor dark web environments.

Dark web threats also pose a critical compliance challenge. Regulators penalize businesses that put customer data at risk. Data protection increasingly requires active dark web monitoring to manage compliance risks.

These factors make integrating dark web security into your risk management strategy critical. Security teams need to upgrade their capabilities. Analysts need security tools to track dark web activities, while engineers must implement alerting systems and controls to counter threats before they escalate.

How to monitor dark web activity for business security

The next cybersecurity threat to your critical systems and data could be incubating on the dark web as you read this. Without visibility and dark web intelligence, security teams can only wait and hope their network defenses are sufficiently robust.

Fortunately, monitoring solutions work around this problem, giving security analysts advanced warning of dark web discussions and potential threats.

Dark web monitoring checklist

Dark web monitoring tools search for your information. They detect stolen employee logins, customer data, postal addresses, social security numbers, and other valuable personal data relating to your business operations.

Monitoring tools can also scan for intellectual property and other confidential information, helping you manage the threat posed by malicious insiders and corporate espionage.

Moreover, dark web monitoring happens in real time. Monitoring tools detect compromised data and automatically generate alerts. Security teams gain time to mitigate potential threats (for example, by requesting password changes for affected users).

NordStellar’s threat intelligence platform is a great example. Data breach monitoring continuously tracks marketplaces and forums, informing security teams when sensitive data appears on the dark web. Meanwhile, account takeover prevention monitors privileged employee and customer accounts for stolen credentials or suspicious activity. Active scanning identifies hijacks at an early stage before damage results.

Security analysts can also use monitoring tools for threat-hunting expeditions. Cyber threat intelligence helps analysts learn about active groups and attack techniques – generating research outcomes to improve the company’s security posture.

Companies should actively monitor the dark web for security threats. However, it’s important to stress that not all security actions on the dark web are legally safe or advisable from an ethical perspective.

Firstly, we should clarify what is legally permitted when investigating dark web threats. Using Tor and accessing dark web servers is legal. Companies can passively monitor activity and data sales on dark web marketplaces.

There’s nothing wrong with simply accessing dark web sites. Most countries allow free access, although the Tor browser is illegal in China, Russia, and Iran.

However, engaging with threat actors on the dark web creates risks wherever you are. Exposed investigators could receive inaccurate information or provoke cyberattacks. If discovered, automated scanning tools could mark companies as targets for reprisals by criminal groups.

Investigators could also accidentally encounter illegal content while browsing marketplaces and forums. This creates a legal risk (possession of harmful images or confidential data). Monitoring dark web forums also poses ethical questions.

For instance, should you continue to monitor forums despite knowing they host illegal transactions? Or should you inform law enforcement agencies and trust them to intervene?

These operational, legal, and ethical issues make clear policies about accessing the dark web are critically important. Security teams (and anyone else tasked with dark web access) should know how to do so safely – and how to report legal queries if they arise.

We would also advise consulting your legal team when writing dark web security policies. Legal advice ensures you stay on the right side of the law while benefiting from dark web threat monitoring.

 

Incident examples: When corporate data hits the dark web

The dark web is more than a distant threat hidden deep within the internet. As a couple of real-world examples show, it’s an active site for the preparation and monetization of cyber attacks.

AT&T’s unexpected dark web data breach

In March 2024, communications giant AT&T discovered that 76 million customer records were being sold via dark web marketplaces. The data included SSNs, home addresses, and login credentials of current and past clients.

Although a vast database was available for sale, the company stated that it had found no evidence of data breaches. This highlights the need for proactive monitoring that anticipates breaches, not waiting for the symptoms of cyber attacks.

LinkedIn: An entire social media ecosystem exposed on the dark web

Social media platforms have also suffered dark web data breaches. In 2021, LinkedIn disclosed the exposure of 700 million user records. The data included phone numbers, email addresses, and other personally identifiable information – a gold mine for phishers.

In this case, attackers leveraged code flaws in the platform’s API, allowing them to scrape confidential information about users and their connections.

Although the company has not disclosed details of the impact, the incident likely dented LinkedIn’s reputation as a trusted platform for networking and professional communication. It may also have influenced a gradual decline in ad revenue, harming the platform’s finances.

Colonial Pipeline: Using the dark web as a market for RaaS products

The 2021 Colonial Pipeline ransomware attack shut down a critical energy pipeline on the Eastern Seaboard, leading to a $4.4 million ransom payment. Attackers used stolen employee credentials to access an unused Virtual Private Network account that remained accessible and active.

The critical facts are that attackers used stolen credentials purchased on the dark web. Attackers also used a ransomware-as-a-service (RaaS) kit supplied by the DarkSide collective via dark web marketplaces.

Proactive threat intelligence gathering may have enabled Colonial Pipeline to detect attack planning and locate stolen credentials. However, the company relied on legacy security systems and did not account for dark web threats.

Final thoughts on managing deep and dark web exposure

The surface web is deceptive. Underneath lies a bottomless ocean of deep web content. And within that ocean, the protected dark web provides a secure refuge for illegal activities.

As we’ve learned, these illegal activities could target your company. Data from your employees or customers could be changing hands on dark web marketplaces while criminals build phishing profiles or plan data theft attacks.

Managing deep and dark web exposure is now a fundamental online safety requirement. Security teams should assume their data is available via onion sites and use monitoring platforms like NordStellar to verify the degree of exposure.

Dark web monitoring complements access controls, network segmentation, and intrusion detection and response tools. Dark web intelligence and endpoint protection protect against hidden threats, while employee training helps manage phishing risks.

Ready to strengthen your defenses against hidden online threats? Don’t wait for a breach to act – contact the NordStellar team today and proactively update your data security strategy.

 

About NordStellar
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.