Cyber Dispatch™️

ARTEX is a legitimate penetration testing tool hijacked for malicious purposes, meaning at least some of these instances were set up by threat actors. The story of ARTEX is similar to that of the now infamous Cobalt Strike. It was released by a developer called Autumn-27, who also authored ScopeSentry - a tool Censys describes as a “widely used Chinese asset-discovery and vulnerability-scanning platform”.

Around 1,500 malicious instances of ARTEX were found on the internet, available to anyone who knew where to look, experts have warned. Security researchers Censys said they identified 1,465 hosts running exposed ARTEX consoles. Of those, 155 (roughly 10%) were also running at least one tool commonly used in cyberattacks, including Cobalt Strike, Vshell, or Adaptix C2. They also found 32 publicly accessible directories on ARTEX hosts, some of which exposed exploit binaries, post-exploitation tools, and other sensitive files.

Hundreds of copies of Chinese-made ARTEX hacking tools leaked online for anyone to use in further attacks.

PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE.

German military drone operations disrupted by cyberattack.

Threat actor attribution and TTP tracking: Following ransomware leak sites and forum discussions helps defenders understand which groups are active, what negotiation channels are being used, and how stolen data is being monetized. The key insight for practitioners: raw data dumps are not intelligence. Effective use requires enrichment—asset ownership, recency, scope, credibility—and integration into existing security workflows, not a one-off "check the dark web" exercise. 9. Conclusion The Dark Web is a technical artifact of military research, a decentralized anonymity commons with concentrated chokepoints, and a contested criminal ecosystem—all simultaneously. Its origins lie in defensive cryptography funded by the U.S. government, not in any single intelligence agency's plot. Its architecture is genuinely resistant to wholesale takedown, but vulnerable to targeted compromise and operational error. For cybersecurity professionals, the Dark Web is neither myth nor monolith. It is an evolving attack surface, an intelligence source, and a case study in how anonymity technologies diffuse from the laboratory into the wild—and how the institutions that build them also try to break them. The most dangerous misconception is that the Dark Web is someone else's problem. It is a mirror of the internet's own complexity: funded by the state, built by idealists, exploited by criminals, and monitored by defenders. Understanding it requires holding all of those truths at once. The author is a cybersecurity researcher who studies anonymity networks and underground economies. Identity withheld by request. @TheGhostITM Disclaimer: This article is for educational and defensive cybersecurity purposes only. It does not endorse or facilitate illegal activity. #TGITM

The gap between 659,000 and 65,000 reflects a definitional divide: the higher figure counts all advertised descriptors, many of which are short-lived, unreachable, or automatically generated. The lower figure counts addresses with observable activity. Neither is "wrong"; both are incomplete. What matters operationally: the number of sites with meaningful content and traffic is orders of magnitude smaller than headline figures suggest. Even the 659,000 figure is roughly 0.005% of the indexed public web—a useful corrective to iceberg metaphors. 6. Participants: Power Players, Labor, and Concentration 6.1 Economic Power Players · Cybercriminal gangs and affiliates: Ransomware operators, malware developers, and their affiliates. · Initial Access Brokers (IABs): Specialists who breach networks and sell footholds. Pricing correlates strongly with victim revenue—access to a Fortune 500 network commands a premium, and "blitz" prices allow ransomware operators to lock in access before competitors. · Technical specialists: Exploit developers, bulletproof hosters, money launderers. · Hacktivists and nation-state actors: Ideologically or geopolitically motivated. · Malicious insiders: Employees selling credentials. 6.2 The Labor Market Kaspersky research (analyzing over 2,225 job-related posts from January 2023 to June 2025) found the underground job market skews young: median age 24, with significant teenage participation. 69% of job seekers do not specify a field and will take any paid work. Most-recruited roles: developers (17%), penetration testers (12%), money launderers (11%); reverse engineers command the highest average salaries. Notably, job seekers increasingly cite prior experience in the shadow economy, suggesting this is a persistent parallel labor market, not a temporary stopgap. 6.3 Extreme Concentration Academic market studies show that 5% of sellers generate 81% of revenue, and 5% of buyers account for 92% of spending. The Dark Web economy is not a flat marketplace; it is a winner-take-most system where reputation, uptime, and operational security determine survival. 7. Law Enforcement: Disruption, Not Elimination Any serious analysis must account for the state's response. Law enforcement has repeatedly demonstrated that the Dark Web is resilient but not invulnerable. Key operations include: · Operation Onymous (November 2014): A multinational takedown of dozens of hidden services, including Silk Road 2.0. Academic analysis of vendor populations shows measurable disruption followed by recovery. · Operation Bayonet (2017): The takedown of AlphaBay and Hansa. The latter was famously operated by Dutch police for weeks after the seizure, harvesting intelligence on users and vendors before shutdown. · Silk Road (2013): The arrest of Ross Ulbricht demonstrated that operational security failures—not protocol breaks—are the primary vector for deanonymization. The pattern is consistent: infrastructure attacks alone do not collapse the ecosystem. Markets re-form, vendors migrate, and the underlying demand persists. Effective disruption combines technical exploitation with human intelligence and undercover operations. 8. Defensive Value: How Practitioners Actually Use the Dark Web A professional briefing would be incomplete without addressing the defender's perspective. The Dark Web is not solely an attack surface; it is a continuous intelligence stream for organizations that know how to filter noise from signal. Credential and breach monitoring: Defenders search for leaked employee credentials, stealer logs, and session tokens, enabling password resets and MFA enforcement before attackers exploit them. Brand and infrastructure monitoring: Discussions of targeted brands, phishing kits impersonating customers, and sales of compromised infrastructure provide early warning of impending attacks. Supplier risk visibility: If a supplier suffers a ransomware incident, leaked data may surface on dark web forums. Organizations can monitor for exposure of their own data through third-party breaches.

While the NRL built the technology, the National Security Agency (NSA) took a different posture. A leaked June 2012 presentation, internally titled "Tor Stinks," documents NSA and GCHQ efforts to deanonymize Tor users through traffic correlation, cookie leakage exploitation ("QUANTUMCOOKIE"), and discussions of flooding the network with slow relays to degrade stability. The document's own conclusion is an admission of limitation: the agency would "never be able to de-anonymize all Tor users all of the time," achieving only limited success through manual analysis of a small fraction of users. The factual record is therefore straightforward: the U.S. military's Naval Research Laboratory built the underlying technology; the NSA attempts to break it. 3. Architecture: How Onion Services Actually Route Most explanations of Tor stop at "three hops." That is the client-to-surface-web circuit: client → entry guard → middle relay → exit relay → website. This is not how .onion services work. A hidden service circuit involves six hops and a rendezvous point. The client builds a circuit to a rendezvous point (chosen by the client). The hidden service independently builds a circuit to the same rendezvous point. The rendezvous point glues the two circuits together. The full path: Client → Guard → Middle → Rendezvous ← Middle ← Guard ← Service**. The starred relays are chosen by the service, providing mutual anonymity. All traffic between the client and service is end-to-end encrypted; no relay—including the rendezvous point—can read content or identify both endpoints. This is why law enforcement cannot simply "tap" an onion service. Disruption requires either compromising the service's operational security (human error, server misconfiguration) or exploiting traffic correlation across enough global adversaries to deanonymize both ends simultaneously. Modern Tor defaults to v3 onion services, which use stronger cryptography and longer addresses than the deprecated v2 protocol. 4. Ownership: A Decentralized Commons with Concentrated Dependencies No single entity owns the Dark Web. The Tor network runs on approximately 10,000 volunteer-operated nodes distributed globally, based on recent census data. The Tor Project (a U.S. non-profit) maintains the software but does not control routing or content. However, "decentralized" does not mean "evenly distributed." Three concentration points matter: 1. Software maintenance: The Tor Project is the primary codebase steward. A compromise of its development process would be catastrophic—which is why its open-source nature and public funding disclosures are security-relevant, not just political trivia. 2. Directory authorities: A small set of trusted servers vote on the network consensus. Compromising a majority would enable certain attacks. 3. Entry guards: Clients pin a small number of entry guards for months. An adversary controlling a popular guard relay gains a durable observation point. The Dark Web is therefore best described as a commons with concentrated technical chokepoints—resilient to takedown but vulnerable to targeted compromise. 5. Scale: How Many Sites Exist? Quantifying the Dark Web is inherently imprecise. Recent estimates vary by methodology: · Tor Metrics (2026): approximately 659,000 unique v3 onion addresses observed per day, averaged over a recent 30-day window. This counts addresses in published descriptors, not functioning websites. The Tor Project itself cautions that the scaling method "is not entirely accurate" and that each reporting relay randomizes its numbers. · Tor community estimates (2026): 65,000+ unique .onion addresses—a far more conservative count likely reflecting addresses observed in active use. · Historical peak: monthly averages reached over 1.1 million addresses in March 2026, before a sudden step-down in May 2026 that Tor Metrics has not explained.

The Dark Web: A Technical and Historical Analysis of Its Origins, Architecture, and Ecosystem By Anonymous Contributor (#TGITM) Abstract The "Dark Web" is among the most misunderstood terms in modern cybersecurity discourse. It is neither a single network nor a monolithic entity, but rather an ecosystem of overlay networks, anonymity protocols, and decentralized services built atop the public internet. This article provides a technical and historical examination of the Dark Web's origins—tracing its roots to U.S. military research on onion routing—and analyzes its architecture, ownership model, scale, and participant demographics. It also situates the ecosystem within the broader context of law enforcement disruption, underground labor economics, and defensive intelligence value. 1. Introduction: Defining the Dark Web Technically, the internet is layered. The Surface Web is indexed by search engines. The Deep Web is unindexed content requiring authentication or direct access. The Dark Web is a subset of the deep web accessible only through overlay networks that anonymize traffic—most notably Tor (The Onion Router), but also I2P and Freenet. The Dark Web is not a place but a protocol-enabled space. It exists because of cryptographic routing, not because of any central authority. This distinction matters: it explains why the network cannot be "shut down" in any conventional sense, and why law enforcement strategy has evolved from infrastructure attacks toward targeted infiltration and market disruption. 2. Technical Origins: Onion Routing and the Tor Network 2.1 The Birth of Onion Routing (1995–1996) The foundational technology—onion routing—was conceived in 1995 at the U.S. Naval Research Laboratory (NRL) by David Goldschlag, Michael Reed, and Paul Syverson. Their objective was defensive: to protect U.S. intelligence communications by layering encryption across multiple relays, so that no single node could link sender and receiver. The first public paper, "Hiding Routing Information," was published in 1996. 2.2 From Research to Deployment (2002–2006) In 2002, Roger Dingledine and Nick Mathewson, alongside Syverson, deployed the alpha version of Tor. The code was released as open source in 2003, and in 2006 the non-profit Tor Project was established to maintain it. This transition from military research to open-source civilian infrastructure is critical: it decentralized control and made anonymity accessible to journalists, activists, and—inevitably—criminals. 2.3 The Funding Controversy: "Almost 100% U.S. Government Funded" A technically complete account must address a fact often omitted from mainstream explainers: the Tor Project has historically been funded almost entirely by the U.S. government. Tor mailing list discussions from 2014 and 2018 acknowledge that "almost everyone involved in developing Tor was (or is) funded by the US government," primarily through the NRL and MIT, with most U.S. research funding at the time flowing through defense budgets. The Tor Project has never hidden its sponsors. This creates an apparent paradox: the same government that funds Tor's development also funds efforts to break it. The resolution lies in dual-use design. Tor was built to protect U.S. intelligence communications abroad while simultaneously providing anonymity to dissidents under authoritarian regimes. The architecture is deliberately poly-use, serving conflicting constituencies by design. The funding source does not imply a backdoor; it reflects a strategic bet on anonymity infrastructure as a net positive for U.S. interests—a bet that remains contested. 2.4 Early Anonymous Networks (1999) Parallel to Tor's development, Freenet was created in 1999 by Ian Clarke, a decentralized peer-to-peer network for anonymous publishing. I2P followed later, offering another garlic-routing-based anonymity layer. These networks collectively form the broader Dark Web ecosystem. 2.5 The NSA's Relationship with Tor

The operation highlighted the evolving resilience of dark web marketplaces, which continue to adapt despite takedowns. They seized over €60 million ($66 million) in cash and cryptocurrency, 950 kilograms of illicit drugs (including amphetamines, cocaine, ketamine, psilocybin mushrooms, MDMA, and cannabis), and 57 firearms in Europe. Law enforcement authorities also seized more than 4.8 metric tonnes of illicit drugs, 152 firearms, and over €150 million ($166 million) in the United States.

Authorities arrested 354 suspects in a joint international operation targeting vendors and buyers on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom dark web marketplaces. Codenamed 'Operation TorNado,' this law enforcement action ran from May 2025 to October 2026 and involved agencies from 14 countries.

Meta Fined $887 Million in Italy Over Android Gallery Photos and Videos on Facebook.

Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France.

Cyberattack Hits German Military Drone Maker Quantum Systems    A suspected Russian attack exploited a malicious update file for the QBase drone control software, prompting Germany to briefly ground the affected drones as a precaution.

AMD SEV-SNP Confidential VMs Vulnerable to Mior and Skyfall Attacks    Researchers demonstrated two attacks that can break AMD EPYC processor protections, potentially allowing attackers to read or modify data in confidential virtual machines and even extract disk encryption keys.

University of Texas at Arlington Confirms Student and Staff Data Theft    The Qilin ransomware group claimed responsibility for a breach that exposed personal information, forcing the university to take its MachForms portal offline during the investigation.

GAO Warned of Aviation Communication Vulnerabilities Before US Flight Disruption    A government report highlighted that the FAA lacked real-time monitoring tools for GPS spoofing and jamming threats, weaknesses underscored by a recent widespread aviation communication outage.

Lazarus-Linked Hackers Target 30 South Korean Servers   

South Korean Real Estate Platform Peter Pan Suffers Data Leak     Unauthorized access to the platform resulted in the exposure of some users’ names, phone numbers, emails, and member IDs, though the operator stated the entire database was not compromised.

Check Point Firewalls Exploited to Breach Israeli Organizations     Attackers used PHP2Shell vulnerabilities to gain initial access, deployed TSGA backdoors, and in some cases used a wiper named destroy_v6 on VMware ESXi hosts; tools showed possible links to a China-associated group. #TGITM