IntSights analysts presented a report on the most popular methods of communication on the darknet. The report includes all mentions of any means of communication mentioned on the pages of popular darknet resources for the period from June to July 2021.
The main conclusion made by the researchers: the use of instant messengers in the cybercriminal environment in general has increased 30 times. One would assume that this is due to the closure of large trading floors AlphaBay and Hansa Market, but this is not the case. Suffice it to recall that darknet markets went offline only at the end of July, that is, at the end of data collection. Thus, it turns out that the hacker underground has independently reoriented itself to using instant messengers.
According to the report, the most popular messenger among cybercriminals was unexpectedly Discord, whose developers generally refuse to use end-to-end encryption. Telegram and WhatsApp are in second and third places, with a large lag.
"This popularity of Discord is surprising, considering that it is a relatively small platform, which is used by only 45 million people," - write analysts IntSights.
Interestingly, in a similar study conducted by Flashpoint in the spring of 2017, Discord was not even mentioned. However, perhaps the whole point is in different approaches to collecting data for analysis. Thus, the IntSight report is focused on invites and links to group and private chats. The only thing that both companies agree on is that ICQ is still very popular on the darknet.
Also, IntSights experts note the growing popularity of ORBot, a Tor client for Android. The number of its installations increased from one million in 2014 to ten million in 2021. According to IntSight analysts, this is why criminals are not looking for encrypted messengers, instead they simply use Tor.
