The Wordfence Threat Intelligence team has recently concluded an investigation of online marketplaces, colloquially known as “shops” by threat actors, selling access to compromised services. While contemporary threat actors primarily coordinate and conduct business through Telegram channels, compromised services and accounts are effectively a commodity, and access to them has become fundamental to the operation of many illicit online activities. As a result, “shops” offering these commodities have proliferated. Many of the shops in question make no effort to hide their purpose or discourage indexing by search engines and as such are technically on the “clearnet”. Many shops even use legitimate CDN and CAPTCHA providers.
