At any one moment in towns and cities across Russia, thousands of drug packages lie buried in the ground, attached by magnets to lamp-posts or taped underneath window sills, waiting to be picked up by their intended customers. They use pseudonymous wallets, privacy coins (like Monero), mixers, chain-hopping, and non-KYC platforms to obscure transaction trails. If you ever decide to explore the dark web, protecting your identity is crucial. Telegram channels supplement traditional onion sites, blurring lines between the dark web sites and more mainstream communication tools.
Getting To Know The Fleets
WizardShop has solidified its status as one of the best data stores in the dark web by providing an impressive quantity of quality data as well as providing a trustworthy, easy to use interface allowing criminals easy and secure buying and selling. Established in 2022, Torzon market is one of the biggest and most diverse marketplaces on the dark web. It is considered very secure thanks to strict user validations and transparent payment and vendor review procedures.
- The familiar cycle of DNM launch and growth followed by exit scams, law enforcement action, or voluntary withdrawal is likely to continue in 2023.
- They use pseudonymous wallets, privacy coins (like Monero), mixers, chain-hopping, and non-KYC platforms to obscure transaction trails.
- The nickname Zed is active across other hidden services, specifically moderating other well-known Tor carding forums.
- Moscow prosecutors said that the members of the criminal gang were not only involved in drug trafficking but also in the manufacturing of narcotics.
- This resulted in many vessels that were previously uninvolved in smuggling getting flagged.
Dark Fleet
- Hydra alone accounted for an estimated 80% of all darknet market-related cryptocurrency transactions in 2021.
- Wayaway topics have thousands of views and hundreds of comments indicating the forum serves as a high-volume resource for the Russian Tor community.
- Hydra has been an active darknet marketplace catering to the Russian Tor community since the Silk Road days.
- From 2015 to 2018, Hydra was one of the largest and most notorious darknet marketplaces, known for the trade of illegal goods and services, including drugs, stolen data, counterfeit currencies, and hacking tools.
- For many in the United States, it merely remains a novelty—a gateway into a shadowy underworld where contraband and taboo reign supreme.
Over the last year, “Alex,” the drug dealer from Moscow, said a new genre of content has been growing on Russian Telegram profiles. Even in the occupied territories of Ukraine, Russian troops entering Mariupol were closely followed by Telegram bots offering hash, mephedrone and alpha-PVP, peddling their wares even before the ruined city had running water returned. It’s not established yet how the drugs were brought to occupied Ukraine but the dealing network likely has some connection with Russian soldiers or non-combat staff. But amid the scramble for power and wealth, experts have told VICE World News that the huge profits being generated by these platforms are being fuelled by money from gangs involved in increasingly sinister crimes. The widely-mooted DNM decentralization is unlikely to materialize over the short term. The familiar cycle of DNM launch and growth followed by exit scams, law enforcement action, or voluntary withdrawal is likely to continue in 2023.
Drugs On The Front Line: The War In Ukraine Is Fuelling Drug Use Among Soldiers, Particularly Of Synthetic Substances
Apart from the dark web markets that are operating online today, some raided platforms influenced many markets. We don’t yet have confirmation of OMG offering money laundering services, but again, the on-chain data suggests it likely does. People in Russia and the U.S. were the source of over $284 million to illicit online marketplaces in 2020, blockchain research firm Chainalysis said in its latest report. “The volume of Russian cargoes carried by the gray fleet has increased 79 percent following the Russian invasion of Ukraine.

French Troops Board Oil Tanker Linked To Russian ‘shadow Fleet’
It is a hub for financial cybercrime and offers a wide range of illicit services and stolen data that cater to sophisticated cybercriminals. In April 2022, when law enforcement shut down Hydra, a major Russian-speaking DNM, a decline in the average daily revenue of all such markets was observed, dropping from $4.2 million before closing to $447,000 after its closure. If global efforts against Russian-language DNMs are combined, their impact would send shockwaves through the online illicit drug trade market. Both MEGA and Hydra hidden services emphasize trusted vendor-buyer relationships before the market will facilitate the crypto-transaction and goods exchange. For example, on Hydra, before an order from the buyer is processed, the vendor and buyer must communicate and trust each other.
US Treasury Department Takes Action Against Russian Darkmarket Entity As Latest Government Move Against Cybercrime
For the dark fleet, Russian cargo lifts have increased 30 percent compared to the pre-invasion period. The top five flags of dark fleet vessels are Panama, Liberia, Marshall Islands, Russia, and Malta (an EU country). Unsurprisingly, four of those countries are on the flags of convenience list and the fifth is Russia.
During 2018 and 2019, Interpol and the European Union brought together law enforcement agencies from 19 countries, leading to the identification of 247 high-value targets and the sharing of operational intelligence required for effective enforcement. Police crackdowns, as is the case for traditional drug markets, are not effective measures to lower the volume of sales on online illicit drug markets. Cryptomarket participants have been shown to have a minimal reaction, or one that is temporary, to overtly large shows of force and to have the ability to adapt through displacement techniques. Saheed Aremu passionately advocates for digital privacy and cybersecurity in the modern digital age.
Beacon Cybersecurity Newsletter

According to the data from Bitfury’s data firm Crystal Blockchain, currently, Hydra’s bitcoin addresses hold more than 521 BTC, worth over $18 million. In August 2022, The New Statesman published an article about how the Russian invasion in Ukraine was “reshaping the dark web” and that “the geopolitical tensions that have changed the world are also changing the dark web” 3. Although this article was published during the first six months of the Russia-Ukraine conflict, the perception of geopolitical tensions transcending to the dark web is apparent. The Moscow Regional Court found Moiseyev and the 15 accomplices guilty of running or being part of an organized criminal group, as well as drug manufacturing and trafficking.
In certain prison camps, up to 80% of residents are confined under Article 228 of the Criminal Code – which bans certain narcotics – nicknamed “the peoples’ statute,” as more citizens are incarcerated for it than any other, many serving over ten year stints for first-time offenses. And yet, over 10,000 Russians keep dying from drug overdoses each year, a toll which has more than doubled since 2019. Killnet and Infinity – a dark forum recently launched by Killnet – have been largely silent about the takeover, instead focusing on an apparent Killnet hack of the US Internal Revenue Service (IRS). Meanwhile, many Kraken-affiliated vendor groups on the WayAway Forum have been vying to recruit former Solaris vendors of illicit goods and services. This year’s first “Friday the 13th” proved to be unlucky for some in the dark web ecosystem.
The Russian Anonymous Marketplace or RAMP was a Russian language forum with users selling a variety of drugs on the Dark Web. A complaint filed in the District of New Jersey was unsealed today charging Thalha Jubair, a United Kingdom national, with conspiracies to commit computer fraud, wire fraud, and money laundering… Users could search for vendors selling their desired type of identification document – for example, U.S. passports or drivers’ licenses – and filter or sort by the item’s price. Many vendors of false identification documents offered to customize the documents based on photographs or other information provided by the buyers.
Moreover, any person who engages in certain transactions with an Entity List person without such OFAC authorization may then find itself liable to similar sanctions in the future. In today’s digital era, where information is constantly on the move across all digital platforms, an… While Bitcoin is the most commonly used currency on the dark web, privacy-focused crypto coins like Monero are becoming popular because of their strong anonymity (mostly likely because all these currencies enable people hide their intentions alongside real identities). According to Check Point Research, schools and other educational institutions were the most targeted sectors, with attacks rising by 43% compared to 2021. The same report showed that cyberattacks on the healthcare industry grew by 86% in 2022 compared to the previous year.

According to the Tor Metrics data in Tables 1 and 2, Russia has accounted for upward of 20% to 35% of the bridge users by country since December 2021, when Moscow tightened the dark web/VPN restrictions. However, according to the same data, over the past year, another country ripe with internal conflict and social unrest has taken over as the top country for bridge users—Iran. In terms of destinations for these vessels, there has not been much change since new trading patterns established themselves post-invasion and since the EU price cap was put into place. India and China remain Russia’s top crude buyers, while Russian diesel goes to Turkey, Brazil and to a lesser extent North and West Africa,” said Mary Melton, Freight Analyst, Vortexa. There was a 22 percent increase in the monthly average of BPD carried by the dark fleet after the start of the war. There has been an increase in the percentage of oil products tankers since our first issuing of this report that may be connected to the oil products sanctions that have since emerged.
Russians On The Darknet Part II: Marketplaces & Forums

This method was seen as less risky for buyers and sellers fearful of the heavy prison sentences handed out in Russia for drug crimes. Even so, opioids such as black market methadone are still being bought outside of darknet markets, predominantly either hand-to-hand or via the many human and automated drug dealers selling their wares on the encrypted messaging platform Telegram. Also known as cryptomarkets, DNMs are multi-vendor online illicit global commerce platforms that mainly specialize in the sale of illicit drugs. An established form of transnational organized crime, DNMs combine anonymisation networks and cryptocurrencies with encryption technologies. They are distinct from independent single-vendor shops that also sell illicit drugs, and from other types of fraud stores. Since Russia’s invasion of Ukraine, the dark fleet of old vessels that lack proper insurance, have opaque ownership, and “flag hop” between different permissive ship registries has grown explosively, to an estimated 1,400 ships.