New Cyber Threat Discovery from Darknet Marketplaces

Recently, cyber threats are growing in frequency and severity. A majority of them leave their digital traces in the darknet long time before they are disclosed and cause damage publicly. In this paper, we introduce a lightweight framework for discovering new cyber threats in darknet marketplaces by filtering out newly discovered terms related to cybersecurity, aiming at warning to related authorities and leaving enough time for making patchworks or other countermeasures, to prevent possible cyber attacks or at least reduce losses. Our framework leverages the items and the text in their titles and descriptions in the darknet marketplaces, and employ machine learning and data mining techniques. Currently, our framework generates 143 warnings, of which 35 are considered as new threats, including new hacking tools (e.g. raior) and variants of existing threats (e.g. GozNym 2.0 and AlienSpy RAT 5.0).