SOCRadar’s First Year-End Report: What Happened on the Deep Web in 2021?

In 2021, we saw that deep web monitoring and cybersecurity are essential to large corporations, governments, and ordinary people. While the Log4j vulnerability allowed threat actors to attack all java-based web servers, resounding attacks such as the Colonial Pipeline ransomware attack showed that there could be problems with the supply of essential products we need most in daily life, such as gasoline.

Another large-scale attack was the SolarWinds attack. Threat actors in the US and other countries are estimated to have caused around $20 billion in total damage. The attacks that occurred in 2021 allowed 2022 to start with operations. Russia’s Federal Security Service raided 25 sites allegedly associated with threat actors and arrested 14 members of the REvil gang.

Read our full report to find out what you can do to secure all your digital assets and potential vulnerabilities.

13,000 Dark Web Posts Inspected

The SOCRadar Research Team analyzed over 13,000 posts on darknet and deep web forums and networks like Discord and Telegram. It found that the activity of threat actors increased excessively in the last quarter of 2021.

As can be seen in the chart below, while 19% of the activities took place in the first quarter, it reached 32% in the last quarter.

(Graph showing the increasing activity of threat actors. Source: SOCRadar)

While the most targeted sectors on a global basis were Information Technologies, Government, E-commerce, and Banking, the other sectors were:

Media & Entertainment
Cyber Security
Cryptocurrency
Education
Healthcare

USA: Most Targeted Country in 2021

Here are the countries most mentioned in dark web posts and hacker channels that revealed in SOCRadar’s deep scans:

United States
United Kingdom
India
Russian Federation
France
Germany
Canada
Brazil
China
Italy

The forums and channels monitored, showed that threat actors have different trends by region. For example, in North and South America, the threats were predominantly ransomware, while differences were detected in other regions.

While data share, data sale, and ransomware go hand in hand in Europe, data sale and data share constitute half of the total threats in APAC countries. In MEA countries, the data sale trend is higher.

IT and E-commerce Sectors Most Targeted by Phishing Attacks

Phishing was also one of the most common methods threat actors used in 2021. SOCRadar has detected around 700,000 phishing attempts worldwide. The trend of these attacks, which aim to infiltrate companies’ networks by stealing people’s identity information, remained the same throughout the year.

Top 10 countries most targeted by phishing attacks:

United States
Turkey
Russia
Germany
Canada
Netherlands
Singapore
United Kingdom
France
Hong Kong

The threat actors’ most used domains in the attacks had extensions such as .com, .org, .net, and .ru, it was found that threat actors preferred domain names with SSL certificates to be credible.

The sectors most targeted by phishing attacks are also in harmony with the most mentioned sectors on the deep/dark web. IT, e-commerce, banking, and government are taking the lead. Other most targeted sectors are the defense industry, telecommunications, and cryptocurrency.

37% of Businesses and Organizations Attacked by Ransomware

With the prevalence of the ransomware-as-a-service (Raas) business model, it has become easier for even people with no technical knowledge to carry out ransomware attacks. The use of double-extortion tactics by threat actors also increased the victimization of companies. Ransomware gangs, not just encrypting data, are now putting pressure on companies by threatening to release data.

Research shows that in 2021, 37% of all businesses and organizations were attacked by ransomware. While 32% of victims pay the ransom, they only get 65% of their data back. The most important reason for this is that they are deprived of an adequate backup system.

SOCRadar’s Extended Threat Intelligence solution offers the holistic understanding you need to stay one step ahead of global cyberattack threats. SOCRadar prepared a global deep web report for the first time by addressing the issues on the agenda throughout the year with the data compiled from the platform.