The Dark Dive

In this episode of The Dark Dive we check in on the ransomware landscape, following major developments identified by the Searchlight Cyber threat intelligence team. Luke Donovan, Head of Threat Intelligence at Searchlight Cyber, shares trends that his team has identified from the dark web in 2025 including: an escalation in the number of ransomware attacks, more than 35 new ransomware groups emerg...

On May 7th, 2025 the notorious ransomware group LockBit’s dark web leak site displayed an unusual message: “Don’t do crime, crime is bad xoxo from Prague”. Alongside this text was the link to an archive file, containing data that appeared to have been stolen from the LockBit ransomware group itself. In this month's episode of The Dark Dive, members of the Searchlight Cyber threat intelligence team...

This month's episode of The Dark Dive revisits the topic of Attack Surface Management. In particular, how it relates to a relatively new cybersecurity term, CTEM: Continuous Threat Exposure Management. In a lively discussion, guests Michael Gianarakis and Ben Jones help define CTEM, a security process that has quickly gained traction thanks to being championed by the analyst firm Gartner. They deb...

This month's episode of The Dark Dive tackles the thorny issue of hacktivism: hackers that are driven by ideological - rather than financial - motivations. Threat intelligence experts Luke Donovan and Vlad join the podcast to discuss how hacktivism has evolved from the "digital utopia" era, to the anti-establishment antics of Anonymous, to the state-aligned activities we observe today. Along the w...

This bumper episode of The Dark Dive features no fewer than four co-founders, as the CEO and CTO of Searchlight Cyber (Ben Jones and Gareth Owenson) are joined by their counterparts from the Attack Surface Management company Assetnote (Michael Gianarakis and Shubham Shah). Together, we discuss the background of Assetnote and origins of its founders in the offensive security and bug bounty world, t...

In this episode of The Dark Dive we look at how specific individuals - Executives, VIPs, and high-net worths - are targeted by cybercriminals and on the dark web. Ahead of the launch of their Digital Footprint Review service, NCC Group's Matt Hull joins us to discuss the threats facing individuals - including social engineering and Business Email Compromise (BEC) - and how these can be mitigated b...

In the first episode back of the year we've assembled two of Searchlight Cyber's threat intelligence experts to give their take on what we can expect from the dark web in 2025. Louise Ferrett and Luke Donovan say what they think 2024 will be remembered for, choose one news story that might have gone under the radar, and (are forced into) making a prediction for a year ahead. Along the way we discu...

In this episode of The Dark Dive we're looking at a particular type of malware called Information Stealers or "infostealers". This malware is designed to (you guessed it!) steal information from infected devices. Threat Intelligence Engineers Rob Fitzsimons and Joe Honey discuss exactly how infostealers work, why this malware has become so prolific, and where it can be spotted on the dark web.&nbs...

This episode of The Dark Dive focuses on encrypted communication apps, including Telegram, Tox, Signal, Session, and Jabber. While not strictly speaking part of the "dark web", these apps are used by the same criminals to perpetrate many of the same crimes. We start with the "mainstream", taking a close look at the popular messaging app Telegram in the wake of the arrest of its CEO in August 2024....

In this episode of The Dark Dive we're joined by incident response heavyweight Caleb Barlow (former head of IBM X-Force and now CEO of Cyberbit) and Searchlight Cyber's Head of Threat Intelligence Luke Donovan to discuss the best ways to respond to a cyberattack. Caleb and Luke share war stories, talk about what progress has been made in the cybersecurity industry (and areas of improvement!), and...

Can you quantify the risk the dark web poses to organizations? In this episode of the podcast, we discuss a landmark study that has tried to do just that. We're joined by Scott Stransky, Managing Director and Head of the Marsh McLennan Cyber Risk Intelligence Center and Ben Jones, CEO of Searchlight Cyber and Scott unravel the findings of the report "The Correlation Between Dark Web Exposure and C...

This episode of the podcast looks at the Qilin ransomware group's attack on the UK's National Health Service. Or - more accurately - their ransomware attack against Synnovis, a third party pathology testing organization for a number of London hospitals. Guests Louise Ferrett and Joe Honey go through time timeline of the attack - discussing the group's history, whether to trust claims that the atta...

This episode of The Dark Dive takes a listener's question as a jumping off point to talk about the topic of data leaked on the dark web. Guests Luke Donovan and Adam Wilson discuss noteworthy data leaks from over the years - impacting organizations such as 23andMe, Ashley Madison, and Yahoo! - and bring things right up to the present day (June 2024) by looking at the data leaks on BreachForums imp...

In the first episode of season two, The Dark Dive takes a forensic look at Operation Cronos, the international law enforcement takedown of the notorious ransomware group LockBit. Dr. Gareth Owenson and Louise Ferrett give an overview of LockBit, explain how Operation Cronos has unfolded, and discuss why law enforcement has taken an unconventional approach (“the most epic trolling in cybersecurity...

In this first episode of The Dark Dive we start at the beginning, with the question: what is the dark web? Renowned dark web academic Dr. Gareth Owenson and threat intelligence expert Jim Simpson define exactly what the "dark web" is in relation to the "clear web" and the "deep web", how dark web networks like Tor work, and why it's relevant to law enforcement and cybersecurity professionals. They...

In this episode of The Dark Dive - the podcast that delves into the depths of the dark web - we take a forensic look at dark web markets. Guests Louise Ferrett and Dave Osler outline the different types of marketplaces that exist on the dark web, the illicit and criminal goods they sell, and the challenges they create for law enforcement. In the process, we discuss the difference between drug and...

We're joined by threat intelligence experts Joe Honey and Vlad to delve into dark web hacking forums. The conversation covers how dark web forums differ from regular internet forums, the topics that users are discussing, and how forums manage to have such longevity in comparison to criminal marketplaces. On the way our guests explain the "barrier to entry" to getting onto these forums, the blurry...

In this episode of The Dark Dive we look at how cyber defender's biggest nemeses - ransomware groups - use the dark web. Returning threat intelligence experts Jim Simpson and Louise Ferrett explain all of the functions of a ransomware leak site, how ransomware group members use dark web forums, and how monitoring this activity helps us understand how ransomware threat is evolving. We cover some of...

This episode of The Dark Dive looks at what host Aidan Murphy describes as "dark web service providers" - i.e. the services that keep dark web criminality ticking. In particular, threat intelligence experts Carlito Perschky and Rob Fitzsimons explain where cryptocurrency fits into the dark web, how it has enabled illegal marketplaces to flourish, and the methods criminals use to hide where their f...

The final episode of this limited series looks at how law enforcement and cybersecurity professionals can respond to the dark web criminality outlined in the previous five episodes. Returning guest Dr. Gareth Owenson is joined by Ben Jones, CEO of Searchlight Cyber, and Evan Blair, General Manager of North America, to discuss the actions that law enforcement agencies and private organizations are...

Introducing The Dark Dive, the podcast that demystifies the dark web.