A coalition of law enforcement agencies across the world announced the results of a coordinated operation known as DisrupTor which targeted vendors and buyers of illicit goods on the dark web.

This operation follows the takedown in May of last year of Wall Street Market, the world’s then second largest illegal online market in the dark web. Led by the German Federal Criminal Police (Bundeskriminalamt) with the support of the Dutch National Police (Politie) Europol, Eurojust and various US government agencies, this takedown provided investigators with quantitative data and materials to identify suspects behind dark web accounts used for illegal activity. 

As a result, 179 vendors who engaged in tens of thousands of sales of illicit good were arrested across Europe and the United States. Over $6.5 million were seized in both cash and virtual currencies, alongside some 500 kilograms of drugs, including fentanyl, oxycodone, hydrocodone, methamphetamine, heroin, cocaine, ecstasy, MDMA, and medicine containing addictive substances; and 64 firearms.

The arrests were carried out in the United States (121), Germany (42), the Netherlands (8), United Kingdom (4), Austria (3), and Sweden (1). A number of investigations are still ongoing to identify the individuals behind dark web accounts. 

Operation DisrupTor was composed of a series of separate but complementary joint operations coordinated by Europol and Eurojust, all aimed at making a global impact on the sale of illicit goods on the dark web.

This operation was the result of a collaborative effort between the law enforcement and judicial authorities of Austria, Cyprus, Germany, the Netherlands, Sweden, Australia, Canada, the United Kingdom and the United States. 

Commenting on this operation, the Head of Europol’s European Cybercrime Centre (EC3), Edvardas Šileris, said, "Law enforcement is most effective when working together, and today’s announcement sends a strong message to criminals selling or buying illicit goods on the dark web: the hidden internet is no longer hidden, and your anonymous activity is not anonymous. Law enforcement is committed to tracking down criminals, no matter where they operate – be it on the streets or behind a computer screen."

Kacey Clark, Threat Researcher at Digital Shadows, a San Francisco-based provider of digital risk protection solutions, notes that the significance of law enforcement coalitions tackling cybercriminal vendors on marketplaces, and their ability to track down vendors, may encourage marketplace administrative teams to take more security-aware approaches.

"Throughout our research, we've touched on the volatility of criminal marketplaces and forums, and a crucial part of this ecosystem is trust. Marketplaces can be vulnerable to attacks, law enforcement can take down the site, and technological problems can disrupt the marketplace's flow. Trust is weaved into all of this; buyers wonder, "can I get the drugs, will I get the cards?" while vendors are curious if they'll get their money.  Vendors will still need to advertise to an open platform to acquire as many buyers as they can. Recent law enforcement takedowns may force vendors to use markets that enable additional security features, such as PGP encryption, two-factor authentication (2FA), and the use of Monero (XMR) to avoid tracking," adds Clark.  "This is another further blow to organized cybercrime. The operation which took down the AlphaBay and Hansa marketplaces three years ago spooked cyber criminals since it resulted in many follow up prosecutions as law enforcement pieced evidence together often many months later. Wall Street market emerged from these ashes and was the most significant one in existence at the time. It would appear that law enforcement have followed the same pattern and that is why we are seeing arrests today. There is now very limited trust amongst cyber criminals who rightly remain paranoid about law enforcement action but also from their follow cohort since many marketplaces also collapse from so-called ‘cash out’ scams where administrators run off with cash held in escrow accounts."

Clark says, "The most innovation from these criminal networks come from trust. They're created, disrupted, then built up again – it's a constant evolution. Law enforcement can take something down; there's a ripple of destruction on trust, then another marketplace comes up. Ultimately, cybercriminal marketplaces still have a purpose; it just might be in a different guise as to what it is now. While this may be the end of the golden era of marketplaces as we currently know them, it may be the beginning of a more security-savvy format - we will only know in time.”