Beneath the Surface: Terrorist and Violent Extremist Use of the Dark Web and Cybercrime-as-a-Service - June 2024
The convergence of terrorism and violent extremism conducive to terrorism with cybercrime presents a formidable challenge. The United Nations Global Counter-Terrorism Strategy (A/RES/77/298), and its successive reviews, have expressed concern over the misuse of the Internet and other information and communications technologies by terrorist groups and individuals, yet the intricacies of the relationship between terrorism and violent extremism on the one hand and cybercriminality on the other remain nebulous – particularly in the darker corners of the Internet.
This report – a collaboration between the United Nations Counter-Terrorism Centre (UNCCT) at the Office of Counter-Terrorism (UNOCT) and the United Nations Interregional Crime and Justice Research Institute (UNICRI) – investigates the complex interplay between these two worlds, focusing in on the cybercrime-as-a-service phenomenon that has emerged on the dark web over the course of the past two decades.
A central theme of the report is the rise of cybercrime-as-a-service and its role in revolutionizing the cybercrime landscape. This model lowers the barriers to entry, enabling malicious actors to access a broad array of tools, resources, and expertise and facilitating them to conduct more complex cyber-attacks with greater ease. Cybercrime-as-a-service also facilitates collaboration among individuals and groups, increasing the scale and impact of cyber-attacks, while also making them harder to detect. The report posits that, in addition to transforming the cybercrime landscape, cybercrime-as-a-service represents a paradigm shift in terms of cyber-enabled terrorism. The advent and continued growth of cybercrime-as-a-service challenges the long-established belief that the threat of advanced cyber-enabled terrorist attacks is low because these groups and individuals possess limited cyber-attack capabilities.
The dark web is a crucial platform in terms of cybercrime-as-a-service and the entire cybercrime ecosystem, serving as a hub for the exchange of cybercrime services. The report, however, also emphasizes an expansion of this ecosystem, with malicious actors increasingly utilizing encrypted communications platforms to gather, communicate, sell unlawfully obtained assets, and acquire criminal services and products in what is perhaps best termed as a criminal or cybercrime underground.
This report, together with the findings and recommendations contained therein, is intended to inform strategic initiatives and strengthen counter-terrorism efforts, safeguarding cyberspace for present and future generations. It is tailored for a diverse audience, including policymakers, law enforcement, cybersecurity professionals, and researchers and is structured to allow these diverse readers to access the findings regardless of the their level of technical knowledge or understanding.
