Name: The Ransomware Report 2025: Dark Web Trends, Groups & Insights
Start: 2025-01-30T15:00:00Z
End: 2025-01-30T15:00:45.000Z
Location: BrightTALK
Rating: 0

Searchlight Cyber provides organizations with relevant and actionable dark web intelligence, to help them identify and prevent criminal activity. Founded in 2017 with a mission to stop criminals acting with impunity on the dark web, we have been involved in some of the world’s largest dark web investigations and have the most comprehensive dataset based on proprietary techniques and ground-breaking academic research. Today we help government and law enforcement, enterprises, and managed security services providers around the world to illuminate deep and dark web threats and prevent attacks.

Cybercrime is a growing trillion-dollar industry, driven by the recent proliferation of infostealers and the increasing accessibility of AI tools. Despite years of countermeasures, threats continue to outpace defenses, leaving organizations vulnerable to attacks. In this webinar, Caleb Barlow, CEO of Cyberbit and former IBM X-Force leader, dives into the roots of cybercrime and draws insights from his 2016 TED talk, which has been viewed over 1.7 million times, to explain what has changed in the past decade (and what hasn’t). Join us to learn:

- Why cybercrime remains so profitable
- The rise of infostealers and their off-the-shelf availability
- How to make your organization a harder target for criminals
- The critical role of threat intelligence sharing in disrupting attacks

With crime increasingly shifting to the dark web, Caleb will also give insights on why security teams need access to this intelligence source and how without reliable access to this critical data, you have a massive blind spot in your operations - leaving you blind to criminality being planned on the dark web - including ransomware attacks, targeting of your VIPs and executives, and the trafficking of illicit goods and sensitive information.

Where is cybercrime coming from in 2025?

The same threats posed by the dark web to businesses and individual create opportunities for cybersecurity and investigation teams. In this final episode in the series, we invite CEO and Co-Founder, Ben Jones back to talk about why he founded Searchlight Cyber and explain how monitoring the dark web for attributes linked to your external threat surface, such as domains, IP addresses, and employee credentials, can help you spot the earliest signs of criminals targeting your business and resolve risks before they turn into costly incidents.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

How can businesses protect themselves from dark web threats?

What are the challenges with crawling and scraping data from the dark web to capture sensitive information, such as the auctioning of vulnerabilities or employees advertising insider access on forums - ideally before threat actors erase the evidence? We speak with Head of Product at Searchlight Cyber, Dave Osler and Lead Data Engineer, David Andreas, to understand the pros and cons of the different approaches security and investigation teams can leverage to defend themselves against threats on the dark web.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

How does Searchlight gather data from the dark web?

Given that the dark web is primarily used to facilitate illicit activities (according to research, 65% of searches on the dark web are for explicitly illegal content), you might wonder why can't we simply shut it down? While this may seem like a straightforward solution to tackle the rampant sales of illegal goods, data, and organized crime, the answer isn’t so simple. Over to Dr. Gareth Owenson, Co-Founder and CTO of Searchlight Cyber, to explain more.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

Why can't law enforcement just close the dark web for good?

Are dark web purchases guaranteed? How anonymous are cryptocurrency transactions in these shadowy corners of the internet? And how do criminals turn digital coins into spendable cash? (after all, you can’t buy a sports car with crypto – yet.) To tackle these questions, we’ve invited back Searchlight Cyber’s Head of Threat Intelligence to break down the dark web’s underground economy.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

What role does cryptocurrency play on the dark web?

There’s ‘no honour among thieves’, so how do cybercriminals monetize their illicit activities while evading detection from law enforcement on the dark web? Joe Honey, Threat Intelligence Engineer at Searchlight Cyber joins us to explain how hackers use the dark web, master their ‘craft’, and how security teams, can investigate and defend against the attacks from these threat actors.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

How do hackers use the dark web?

The dark web is home to many such digital black markets that operate largely in the same way to e-commerce sites we use everyday. However, unlike these familiare sites, the dark web is far more volatile, with new markets closing and opening all the time. In this webinar, Luke Donovan, Head of Threat Intelligence at Searchlight Cyber, guides us through some of the autoshops and escrow marketplaces you should be monitoring.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

Where are items bought and sold on the dark web?

Despite its recent rise in popularity, I2P has existed as long as Tor. In this webinar, Dr. Gareth Owenson, CTO and Co-Founder of Searchlight Cyber, breaks down the differences between I2P, Tor, Lokinet, Zeronet, and the multiverse of anonymity networks that exist – and shares why certain darknets rise to prominence while others remain in the shadows.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

What’s the difference between I2P and Tor? Are there other dark webs?

Headlines often shine a light on the criminal applications of the dark web, but is that the full story? Ben Jones, CEO and Co-Founder of the dark web intelligence company looks into the ethical applications for anonymous networks such as Tor – from providing safe and private spaces for whistleblowers to protecting those living under oppressive regimes.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

Who uses the dark web and why - are there any positive uses of the dark web?

Do ransomware groups operate like a business? That’s the question we ask Luke Donovan, Head of Threat Intelligence at Searchlight Cyber – helping us understand how ransomware groups use the dark web to plan attacks, communicate anonymously, profit from their stolen data,  and, in some cases, even maintain dedicated human resources teams.

How do ransomware groups operate on the dark web?

If your company’s information ends up on the dark web it’s more than just a data leak, it’s potentially an open door to a major cyber incident. To help us understand the risks of falling victim to breaches, leaks, and vulnerabilities – and how exposed data can be used to launch a cyber attack – we’re joined by Luke Donovan, Head of Threat Intelligence at Searchlight Cyber.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

What are the risks if your business’s information ends up on the dark web?

As the word “dark” hints at, the dark web refers to a part of the internet that is in the shadows and inaccessible through regular search engines or internet browsers. But how does it work? There’s no better person to answer this question than Dr. Gareth Owenson, CTO and Co-Founder of Searchlight Cyber and a world leader in Tor dark web research.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

How does the dark web work?

In the first video of our 12-part series, Searchlight Cyber’s CEO and Co-Founder explains what the dark web is and the threats posed by criminals operating in this hidden part of the internet – plus how it can also present opportunities for security and criminal investigation teams.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

What is the dark web (and why should cybersecurity professionals care about it)?

How do you identify threats to your business on the unindexed internet that is the dark web? That’s the question we answer on this webinar as we explore the practical techniques, tools, and search strategies to help cybersecurity teams proactively detect cybercriminal activity targeting your organization, from early signals of phishing as a service campaigns to real-time indicators that initial access brokers are listing VPN access to your network – sometimes for as little as $10.

Joining us will be the founder and director of managed security services provider Talanos, who will share insights and real-world examples on identifying both historical and real-time threats – and crucially, what action you should take once you’ve detected them.

In this cybersecurity webinar, we cover:

- Search queries, tools, and techniques to decipher initial access broker listings
- The importance of monitoring for phishing sites before they are weaponised
- How you can use dark web tools to take action once threats are identified

Even if you can’t join live, register now to receive a copy of the recording as soon as it’s available. We look forward to seeing you on the webinar soon.

How to identify criminals talking about your business on the dark web

A lot can change in six months in the world of ransomware - just ask LockBitSupp.

In this webinar, we looked at how the threat landscape has shifted in the first half of 2024. Through in-depth analysis of dark web data, we also revealed the most prolific ransomware groups seeking to fill the vacuum left following the disruption of ransomware group Lockbit. Additionally, we uncovered the emerging groups and regional threats, based on the data in our dark web investigation platform, Cerberus. Monitoring these trends is essential for adjusting your security strategy for the remainder of the year.

IN THIS RANSOMWARE WEBINAR WE COVERED:
- The most active groups in the first half of 2024 (H1 2024)
- What attacks by groups such as Qilin tell us about the ongoing threat of ransomware
- How recent law enforcement actions are changing the ransomware landscape
- How you can reduce the threat of ransomware with dark web intelligence

KEY MOMENTS OF THE WEBINAR
02:40 - How has the ransomware landscape changed since 2023?
04:02 - The number of ransomware victims in 2024 H1
05:25 - The 5 more prolific ransomware groups in 2024 H1
06:55 - What is ransomware as a service? (RaaS)
09:36 - New and emerging ransomware groups in 2024
11:35 - Who is RansomHub?
13:18 - Who is Qiulong Ransom?
15:32 - Who is DarkVault?
18:51 - Who is APT73?
21:05 - The evolution of ransomware group's TTPs
34:34 - NCSC recommendations: Learning from past breaches
36:46 - How you can prevent and detect ransomware
40:21 - Live demonstration: Ransomware dashboard for law enforcement and enterprise
43:38 - Live demonstration: Dark web search and investigation in Cerberus
46:09 - Live demonstration: Threat actor investigation in Cerberus
49:21 - Live demonstration: Enterprise security investigations in Cerberus
53:04 - Takeaways: How your organization can fight back against ransomware groups
54:54 - Live audience Q&A

Ransomware in H1 2024 - Dark Web Trends, Groups & Insights

Ever wondered what happens before and after a ransomware attack on your network? Watch our exclusive webinar with Dark Reading to discover the full picture with insights from the dark web.

Historically, organizations could only gather intelligence on what a ransomware attacker did on their network - what came before and after was a mystery. However, the ability to gather intelligence from the dark web means that security teams can now see the actions of ransomware groups through the full kill chain, giving them far greater opportunity to identify and effectively mitigate an incident.

Luke Donovan, Head of Threat Intelligence at Searchlight Cyber, and Mo Ahddoud CISO, Chameleon Cyber Consultants combine their viewpoints of the Cyber Kill Chain to explain the entire process of a ransomware attack - including how threat intelligence can help security teams to be more prepared, spot attacks faster, and respond more effectively.

During the webinar you will:
- Learn from a real-life case study of a ransomware attack against a supply chain company for Formula 1 teams.
- Get intelligence on how different ransomware groups operate on the dark web.
- Find out how data gathered from the dark web can aid ransomware prevention and response.

Gaining Visibility of the Entire Ransomware Kill Chain – Dark Reading

Your company being discussed by criminals on the dark web is bad news. Who knew? Well, we all did, but now it’s official. In this webinar, we explore the official findings of Marsh McLennan's latest research - the first of its kind - on the correlation between dark web exposure and cybersecurity risk.

CEO and co-founder of Searchlight Cyber, Ben Jones, is joined by Marsh McLennan’s Scott Stransky, Managing Director and Head of the Cyber Risk Intelligence Center. Together, they dive into key intelligence sources such as dark web market listings, outgoing dark web traffic, and compromised users, and explain why they’ve proven to be such strong indicators of cyberattacks.

In this cybersecurity risk webinar, we cover:

- How dark web findings correlate with the increased likelihood of a breach
- The value of combining insurance and dark web data for the first time
- What organizations should do to lower their risk of cyber incidents

Watch today and learn how dark web intelligence can lower your risk and give you visibility into attacks before they happen.

Correlating cybersecurity risk and dark web exposure with Marsh McLennan

It’s time for the bi-annual state of ransomware on the dark web report. In this webinar, you’ll find out which groups are most prolific, the emerging groups to watch, and the tactics lookout for in 2025.

In this webinar, we’ll be joined by cybersecurity experts, including Searchlight Cyber’s Head of Threat Intelligence, Luke Donovan, for a statistical analysis and profiles on the groups who claimed the most victims in 2024 and look likely to remain active in 2025. Additionally, our experts will share a review of the impact law enforcement had on disrupting major groups and how this might change how ransomware gangs and cybercriminals conduct their operations this year. 

Register today for unique insights into:
- Profiles on the most prolific ransomware groups in 2024
- A look ahead to the groups to monitor and investigate in 2025
- See how security professionals can build profiles on ransomware groups

We’ll also cover the most common ransomware questions you’ve asked, ensuring we address your specific concerns. Register for the webinar and submit your questions to be answered live.

The Ransomware Report 2025: Dark Web Trends, Groups & Insights

Ransomware

Dark web

Cyber Security

Cyber Crime

Cyber Skills

Cyber Defence

Cyber Incident Response

Threat Hunting

Cyber Intelligence

Cyber Attacks

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The unexpected nature of natural disasters and other disruptive events means that preparation is key to managing disaster recovery and business continuity planning. Join the business continuity and disaster recovery community for live and recorded presentations discussing best practices for business continuity planning, disaster recovery programs and business continuity management. Learn from BCDR experts to develop your critical infrastructure and gain insight into tactical solutions to your BCDR issues.

Business Continuity / Disaster Recovery

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Internal audit and compliance professionals are facing increasingly stringent regulatory requirements when it comes to compliance reporting and internal control procedures. Join the audit and compliance community to learn best practices from thought leaders on topics such as regulatory compliance, internal audit checklists and audit program strategies.

Audit and Compliance

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

Finance

Leadership styles are continually evolving to incorporate new ways of thinking about employee satisfaction, motivation and performance. Find webinars and videos on the strategies, techniques and qualities that make an effective leader. By participating in this community you will gain insight into current leadership theories and how to optimize employee performance.

Leadership

In the business management community, commercial experts will be sharing webinars and videos on an array of subjects. From sales and marketing, to finance, productivity and growth, this content will help you stay up-to-date with the current economic environment and provide timely management insight to drive business growth.

The Ransomware Report 2025: Dark Web Trends, Groups & Insights

Presented by

About this talk

More from this channel