

This includes activity on deep and dark web channels, as well as open-source intelligence (OSINT). But the threat landscape has expanded due to the proliferation of chat services, closed and curated communities, and other secure forms of communication. Traditionally, cyber threat actors have operated on to the dark web, on onion sources. In order to better understand threat actor tactics, techniques, and procedures (TTPs), it’s vital to monitor all relevant channels where malicious activity seeds.

It’s incumbent on security teams to push their threat intelligence programs in parallel with-and ideally ahead of-widening risk apertures. Threat intel: Deep and dark, but only half the picture

Sophisticated technology has become more accessible, thereby narrowing barriers to entry, reducing levels of friction to stand up a new channel, and making peer-to-peer interaction easier-in real time, from anywhere. But the adoption of chat services and other open-web sources has reframed the conversation about the boundaries of intelligence gathering and the threat actor landscape. Traditionally, the term “deep and dark web,” or DDW, is used to describe the digital underground where threat actors operate. In order to identify emerging cyber and physical threats, fraud, and other malicious activity, CTI and SOC teams must monitor the total threat landscape.
