Hackers who operate on the dark web hide their identities mainly by hiding their network location, separating their online personas from their real lives, and paying in ways that are hard to trace. The common tools are the Tor network, VPNs, compromised computers used as relays, privacy-focused cryptocurrencies and strict personal discipline. For a business, the practical lesson is simple: attackers are hard to identify and catch, so prevention matters far more than hoping to trace them afterwards.
What the dark web is
The dark web is a part of the internet that ordinary browsers and search engines cannot reach. The best-known part is made up of Tor onion services, websites whose addresses end in .onion and can only be opened with the Tor Browser. The dark web is used for legitimate purposes too, such as journalists protecting sources and people avoiding censorship. It also hosts criminal forums and marketplaces where stolen data, hacking tools and access to breached systems are traded.
Methods attackers use to stay anonymous
This is an overview of the general techniques, so that defenders understand why attribution is hard. It is not a how-to guide.
The Tor network
Tor sends traffic through several volunteer-run relays, wrapping it in layers of encryption. Each relay only knows the step before and after it, so no single relay knows both who you are and what you are visiting. Onion services go further and hide the location of the server as well as the visitor. This makes it hard to link a forum account or a marketplace to a real IP address.
VPNs and proxy chains
A VPN hides a user’s IP address from the sites they visit by routing traffic through the VPN provider’s servers. Attackers sometimes chain VPNs, proxies and Tor together, so that a trace has to pass through several providers, often in different countries.
Compromised machines and botnets
Many attacks are launched from computers, routers and servers that the attacker has already broken into. The attack appears to come from an innocent victim’s device. This is one reason a small business’s poorly secured server or website can end up being used against others.
Separate personas and operational security
Experienced criminals keep their online identities completely separate from their real ones. They use different usernames, writing styles and devices, and avoid sharing personal details. Some use operating systems designed to leave no trace on the computer after shutdown. Mistakes in this discipline, such as reusing a username or an email address, are one of the most common ways criminals are eventually identified.
Disposable accounts and encrypted messaging
Throwaway email addresses and accounts make it harder to connect activity over time. Encryption tools such as PGP are used to protect messages and to prove that a message comes from the same persona, without revealing who is behind it.
Privacy-focused payments
Bitcoin is not anonymous. Every transaction is recorded on a public ledger, and investigators regularly trace funds. Some criminals use cryptocurrencies designed to hide transaction details, such as Monero, or mixing services that try to break the link between payments.
Why anonymity is never complete
None of these methods is perfect. Law enforcement agencies have taken down major dark web markets and identified their operators. This is usually through human mistakes, seized servers, informants, undercover work or tracing payments. Still, for a business that has been attacked, finding and prosecuting the person responsible is slow and often not possible. Your time and money are better spent on making the attack fail.
What this means for your business
Because attackers can hide their location and switch identities easily, blocking a single IP address or country rarely solves anything. Focus on controls that work no matter who is attacking:
- Use multi-factor authentication on email, hosting control panels, WordPress admin and banking. Stolen passwords are among the most traded items on the dark web.
- Use unique passwords with a password manager, so one leaked password does not open every account.
- Check for leaked credentials with a breach notification service, and change passwords that appear.
- Keep software patched: websites, plugins, servers, routers and computers.
- Put a web application firewall in front of your site to filter malicious traffic and bots before it reaches the server.
- Protect endpoints with reputable antivirus and endpoint security.
- Keep backups that attackers cannot reach, and test that you can restore them.
- Train staff to spot phishing, which is still the easiest way into most organisations.
Frequently asked questions
Is it illegal to use Tor or the dark web?
In many countries, using Tor is legal and it has legitimate uses, including privacy and avoiding censorship. Buying stolen data, malware or other illegal goods is illegal wherever you are. Check the law in your country.
Can a hacked business find out who attacked it?
Sometimes, but rarely quickly. Logs may show where the traffic came from, but that is often a VPN, a Tor exit relay or another victim’s device. Report serious incidents to the relevant authorities, and focus on recovery and closing the gap that was used.
How do I know if my company’s data is on the dark web?
Breach notification services and some security products alert you when email addresses or credentials from your domain appear in known leaks. Treat any alert as a reason to reset passwords and turn on multi-factor authentication.
Next step
If you want help putting these controls in place, see Tremhost managed security, ESET endpoint protection and Tremhost Armor for Cloudflare protection configured and monitored for you. If your site has already been hacked, Armor SOS offers free same-day triage.
