Underground Forum.

What is an underground forum?

Europol’s Internet Organised Crime Threat Assessment for 2014 says the underground economy relies extensively on websites and forums. It describes them as market places and hubs where supply and demand meet. People use them to advertise, buy and sell products and services, to network, and to share experience and expertise.

What kinds of forums are there?

Europol says some forums are devoted to a particular topic, such as one product or a specialized service. Others are more general and cover a wide range of topics and products. The assessment says that such forums can serve the whole spectrum of cybercrime and supply the logistics needed to carry out offenses.

How do they work?

Europol says access is not always straightforward. Entry requirements escalate with the sophistication of the forum. More security-conscious communities often require new members to be vouched for by existing members.

Trust is built through reputation. Europol says a user’s reputation, and so their online nickname, is one of the most important factors in creating trust and in deciding whether to do business. For vendors, status typically requires providing samples to the moderators for review. Their products are then continuously reviewed and rated by customers.

Why does it matter?

Europol describes these forums as places where supply and demand meet, so they are one place where parts of the criminal economy meet. Reasoning cautiously, activity there can give defenders early signs of what criminals are selling or discussing. Because many forums use vouching and reputation, getting reliable information from them can take time and care.

How can defenders use this knowledge?

Defenders can treat forums as one source of threat intelligence, which means information about attackers and their methods. A forum mention is a lead to check, not proof. Because some forums require a vouch, a view of them can be incomplete.

Is an underground forum the same as the dark web?

No. An underground forum is a type of community. The dark web is part of the internet reached with special software. A forum may sit on the dark web, but this term describes what the community does, not where it is hosted.

Is an underground forum the same as a data leak site?

No. A forum is a shared community where many members trade and talk. A data leak site is a place where one criminal group posts stolen data from its victims.

See also

• Human intelligence (HUMINT)

Sources

• Europol: Underground economy relies on websites and forums; topic or general forums; vouching and entry requirements; reputation and vendor review.
• Krebs on Security: Reports the April 2022 seizure of RaidForums, whose Leaks Market described itself as a place to buy, sell and trade hacked databases, with paid membership tiers for greater access.