Obtaining Access
To begin a dark web is a network (often encrypted) which overlays the Internet but requires specialised software to access it. The Tor client, supplied within the Tor browser bundle, will connect to the Tor network and direct traffic through a triplet of nodes: entryNode --> relayNode --> exitNode. All three nodes will encrypt data transmitted with their public keys in the order:
- (entryNodePublicKey(relayNodePublicKey(exitNodePublicKey(data)))
Unless you have spyware loaded onto the host computers for the "important individuals" you will only see the entryNode IP address and encrypted traffic. Using this IP address you could confirm it belongs to the Tor network, as an induction node or guard node.
Because Tor is implemented for political activists, whistleblowers, oppressed dissidents, etc... it has built-in tools for censorship circumvention, OBFS4 bridges are among a few common methods, but another is using meek bridges. Meek bridges take advantage of AWS and Azure for domain fronting, this will make the Tor entryNode when performing DPI appear as an HTTPS amazon.com or microsoft.com connection; normal traffic. This method is deployed to circumvent the Great Firewall of China.
Equally other methods to conceal the entryNode connection include, but are not limited to:
- OpenVPN using AES encryption: most modern VPNs
- Proxy: HTTP, HTTPS, and SOCKS
- RDP (or any other remote access protocol, preferably encrypted)
The RDP idea will involve connecting to a remote computer and be using that to access the dark web, with or without the protection of VPN(s) or proxy(s).
Mentioning about circumventing censorship has relevance, as Vault 7 disclosures outlined CIA malware would use data centers as botnets and would prefer performing any connections over HTTPS (with modern ciphers) on port 443. This would draw much less attention to connection logs when reviewed by a SysAdmin.
With this information in mind, now we should consider without tremendous detail, the metadata and "noise" the attacker made when obtaining the confidential information. Questions include:
- Did they leave logs and metadata concerning the breach?
- Did they use someone else's access to access the confidential information, or use a zero day exploit?
- Do IP address logs belong to residential IP address(s) or recognised anonymising networks.
We have now built knowledge of when the confidential information was stolen. So, now we can see if the attacker had vulnerabilities within their OpSec that we can use to deanonymise them.
Selling the Information
This would be your second (and last) opportunity to identify the attacker. This also may not be possible, as it involves tracing the payment method, which could also employ money laundering.
This confidential information is now an asset to the attack. Presuming their goal is to profit from the attack, we will sell the information onto a buyer. A dark web marketplace would be a good start. Although, they could have been hired by a wealthy group to perform the attack. So, the information will be sold via either method:
- Dark web marketplace
- Closed auction (private)
The timing for selling this information would depend on the nature of the breach. Intellectual property with patents would not need a critical sell window, while a database of password hashes should be sold ASAP before the passwords are changed.
Payment would be your opportunity to trace the attacker. Payment could cover several forms:
- Dead drop bank account(s)
- PayPal
- Credit/Debit card(s)
- Cryptocurrencies
I cannot elaborate much further here, as money laundering is its own topic, and can be very broad. I can state that, the more judiciaries the IP addresses and payment cover, the more cumbersome and less likely you are to identify the attacker.