International law enforcement just delivered one of the largest coordinated blows to dark web commerce in recent memory: 354 suspects arrested in a joint operation targeting vendors and buyers active on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom marketplaces. This follows the June 2025 takedown of Archetyp — one of the longest-running and most prolific drug and cybercrime marketplaces on Tor — and signals that investigators are now working backward through seized infrastructure, transaction ledgers, and cryptocurrency trails to identify the human beings behind the handles.
Why should your SOC care about a drug-marketplace bust? Three reasons. First, these platforms were not exclusively narcotics markets — they hosted vendors selling stolen credentials, access broker listings, malware, and fraud tooling, and the buyer/voter databases now in police hands will generate months of downstream investigations. Second, seized marketplace infrastructure historically produces a windfall of threat intelligence: vendor identities, wallet addresses, delivery data, and communication logs that defenders can pivot on. Third, this operation is a live demonstration that Tor anonymity is not immunity — and that lesson cuts both ways. If your organization has insiders using dark web markets from corporate assets, or if your stolen data was being sold there, you are now part of this story whether you know it or not.
This post breaks down the operation from a defender's perspective, then gives you concrete detection content for identifying dark web market access on your network and endpoints.
Technical Analysis
What Happened
The operation — coordinated across multiple jurisdictions with Europol involvement — targeted the user base of five major dark web marketplaces:
| Marketplace | Profile | Status |
|---|---|---|
| Archetyp | One of the longest-operating DNMs; ~600,000 users, thousands of vendors; drugs, fraud, and cybercrime-adjacent goods | Seized June 2025; backend infrastructure in law enforcement hands |
| Nemesis | Mid-tier market with narcotics and fraud sections | Disrupted; users targeted |
| Tor2Door | Established market with escrow services | Disrupted; users targeted |
| Bohemia | Long-running market that exit-scammed/degraded in late 2023–2024 | Historical user data in scope |
| Kingdom | Smaller market with vendor overlap from the others | Disrupted; users targeted |
The arrest count of 354 is notable because it includes buyers, not just vendors and administrators. That is a deliberate messaging choice by law enforcement: marketplace participation at any level now carries attribution risk.
How Attribution Worked — The Defender's Lesson
While the full investigative tradecraft isn't public, takedowns of this scale reliably rest on the same pillars, and understanding them matters for your own hunt operations:
- Backend seizure before frontend takedown. Archetyp's infrastructure was seized while the market was still live, giving investigators access to server-side databases: user accounts, PGP-encrypted message stores (often held in plaintext server-side), order histories, and withdrawal addresses.
- Cryptocurrency tracing. Monero dominance notwithstanding, a meaningful share of marketplace transactions still touch Bitcoin at on-ramps and off-ramps. Chain analysis against exchange KYC records converts pseudonymous wallets into names.
- Operational security failures. Vendor re-use of handles across clearnet forums, shipping metadata, and re-used PGP keys remain the top attribution vectors.
- Undercover purchases and controlled deliveries to build probable cause for physical arrests.
Why This Matters to Enterprise Defenders
- Insider risk: Employees purchasing drugs, fraud tools, or access credentials via Tor from corporate devices or networks create legal, counterintelligence, and compromise exposure. If your users appear in a seized marketplace database, expect law enforcement contact.
- Credential and access exposure: Initial access brokers and credential vendors operated across these ecosystems. Credentials stolen from your organization in infostealer campaigns (RedLine, Vidar, Lumma, StealC) frequently transit DNM-adjacent shops and Telegram channels. The intelligence fallout from these seizures will surface new corpora of stolen data — you need a process to ingest and act on it.
- Threat actor displacement: Every major takedown pushes vendors to successor markets and Telegram-based shops. Expect churn, rebrands, and short-lived replacement infrastructure — your dark web monitoring vendor's collection coverage should be re-validated now.
- Exploitation status: Not a vulnerability story — but the technique (Tor-based anonymized access from managed endpoints) is actively used in the wild by insiders, data thieves, and malware operators alike, and is directly observable by your telemetry.
Detection & Response
This is a technical threat from a detection standpoint: the observable behavior is Tor client execution and Tor network traffic from corporate assets. These detections are intentionally narrow — Tor has legitimate uses, but in most enterprise environments it has no business justification, and its presence warrants investigation rather than blanket blocking without context.
Sigma Rules
---
title: Tor Client Execution on Managed Endpoint
id: 3f8a1c24-7b2e-4d91-a6c3-9e5f2d8b1a47
status: experimental
description: Detects execution of the Tor client, Tor Browser, or common Tor proxies (obfs4, meek, snowflake bridges) on a Windows endpoint. In enterprise environments Tor usage is rarely sanctioned and may indicate insider dark web market access, data exfiltration staging, or malware C2.
references:
- https://attack.mitre.org/techniques/T1090/003/
- https://www.bleepingcomputer.com/news/security/police-arrest-354-vendors-buyers-in-global-cybercrime-crackdown/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.command_and_control
- attack.t1090.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\tor.exe'
- '\firefox.exe' # Tor Browser ships a firefox.exe under Tor Browser\Browser
- '\obfs4proxy.exe'
- '\snowflake-client.exe'
- '\meek-client.exe'
Image|contains:
- '\Tor Browser\'
- '\TorBrowser\'
- '\tor\data\'
selection_cli:
CommandLine|contains:
- 'SocksPort 9050'
- 'SocksPort 9150'
- 'obfs4 '
- 'meek_lite'
- '--transport-plugin'
- 'UseBridges 1'
condition: selection_img or selection_cli
falsepositives:
- Sanctioned privacy tooling on journalist, legal, or threat research workstations
- Firefox browser installed under a path containing 'Tor' (rare; validate full path)
level: high
---
title: Outbound Connection to Tor Network Ports
id: 8c2d5e91-4a6f-4b83-9d17-2e7a3c5f8b02
status: experimental
description: Detects outbound network connections to ports commonly used by the Tor network (directory/OR ports 9001, 9030 and SOCKS proxy ports 9050, 9051, 9150, 9151). Guard/relay traffic on 9001/443 is a strong indicator of active Tor usage from the endpoint.
references:
- https://attack.mitre.org/techniques/T1090/003/
- https://www.bleepingcomputer.com/news/security/police-arrest-354-vendors-buyers-in-global-cybercrime-crackdown/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.command_and_control
- attack.t1090.003
logsource:
category: network_connection
product: windows
detection:
selection_ports:
DestinationPort:
- 9001
- 9030
- 9050
- 9051
- 9150
- 9151
filter_localhost:
DestinationIp|startswith:
- '127.'
- '::1'
condition: selection_ports and not filter_localhost
falsepositives:
- Legitimate Tor relays hosted internally (extremely rare in enterprise)
- Sanctioned research infrastructure
level: medium
---
title: Tor Browser Bundle Installation Artifacts
id: 5b7e9a02-1d4c-4f68-8a35-6c1d9e2b7f53
status: experimental
description: Detects creation of Tor Browser installation and profile artifacts on Windows endpoints, indicating recent installation or first-run of the browser bundle. Useful for retro-hunting across the period during which the seized marketplaces were active.
references:
- https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.command_and_control
- attack.t1090.003
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\Tor Browser\Browser\TorBrowser\Data\Tor\torrc'
- '\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\places.sqlite'
- '\Desktop\Tor Browser\'
- '\Downloads\torbrowser-install'
- '\Downloads\TorBrowser-'
condition: selection
falsepositives:
- Threat research or OSINT analyst workstations (maintain an allowlist by host/user)
level: medium
KQL — Microsoft Sentinel / Defender
// Hunt: Tor client execution and Tor network traffic across the estate
// Covers both Defender endpoint telemetry and ingested syslog/CEF firewall logs
let tor_ports = dynamic([9001, 9030, 9050, 9051, 9150, 9151]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "tor.exe"
or ProcessCommandLine has_any ("SocksPort 9050", "SocksPort 9150", "obfs4", "meek_lite", "UseBridges")
or FolderPath has_any ("\\Tor Browser\\", "\\TorBrowser\\")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, Source="DefenderProcess"),
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemotePort in (tor_ports)
| where not(RemoteIP startswith "127.")
| summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, RemotePort
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, RemotePort, ConnectionCount, RemoteIPs, Source="DefenderNetwork"),
(CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationPort in (tor_ports)
| summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, DeviceVendor
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DestinationPort, ConnectionCount, DeviceVendor, Source="FirewallCEF")
| order by FirstSeen desc
Velociraptor VQL
-- Artifact: SecurityArsenal.TorUsageHunt
-- Hunts for live Tor processes, Tor SOCKS listeners, and Tor Browser install artifacts
-- Deploy across endpoints to identify assets used to access dark web marketplaces
SELECT * FROM {
-- Live Tor / pluggable-transport processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, "ProcessExecution" AS FindingType
FROM pslist()
WHERE Name =~ '(?i)(tor|obfs4proxy|snowflake-client|meek-client)\.exe$'
OR CommandLine =~ '(?i)(SocksPort 9050|SocksPort 9150|obfs4|UseBridges)'
OR Exe =~ '(?i)Tor Browser'
} UNION {
-- Listeners on Tor SOCKS ports
SELECT Pid, Name, Laddr AS LocalAddress, Lport AS LocalPort, Status,
"TorSOCKSListener" AS FindingType
FROM netstat()
WHERE Lport in (9050, 9051, 9150, 9151) AND Status = 'LISTEN'
} UNION {
-- Tor Browser installation and profile artifacts
SELECT FullPath, Mtime, Size, "InstallArtifact" AS FindingType
FROM glob(globs=[
'C:/Users/*/Desktop/Tor Browser/Browser/TorBrowser/Data/Tor/torrc',
'C:/Users/*/Downloads/torbrowser-install*.exe',
'C:/Users/*/Downloads/TorBrowser-*.exe',
'C:/Program Files*/Tor Browser/**/tor.exe'
])
}
Remediation & Hardening Script
# Security Arsenal — Tor Usage Audit & Egress Hardening
# Run elevated. Audits for Tor artifacts, optionally blocks Tor ports at the host firewall.
# Review audit output BEFORE enabling blocking — preserve evidence if IR is in play.
$AuditOnly = $true # Set to $false to enforce host firewall blocks
# --- 1. Audit: running Tor processes and SOCKS listeners ---
Write-Host "[+] Auditing running Tor processes..." -ForegroundColor Cyan
Get-Process | Where-Object { $_.Name -match '^(tor|obfs4proxy|snowflake-client|meek-client)$' -or $_.Path -match 'Tor Browser' } |
Select-Object Id, Name, Path, StartTime | Format-Table -AutoSize
Write-Host "[+] Checking for Tor SOCKS listeners (9050/9051/9150/9151)..." -ForegroundColor Cyan
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
Where-Object { $_.LocalPort -in 9050,9051,9150,9151 } |
Select-Object LocalAddress, LocalPort, OwningProcess,
@{N='ProcessName';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name}} |
Format-Table -AutoSize
# --- 2. Audit: Tor Browser installs per user profile ---
Write-Host "[+] Searching for Tor Browser installations..." -ForegroundColor Cyan
Get-ChildItem 'C:\Users\*\Desktop\Tor Browser','C:\Users\*\Downloads' -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match '(?i)tor' } | Select-Object FullName, LastWriteTime | Format-Table -AutoSize
# --- 3. Optional: host firewall egress block for Tor ports ---
if (-not $AuditOnly) {
Write-Host "[+] Creating egress firewall rules for Tor ports..." -ForegroundColor Yellow
$ports = 9001,9030,9050,9051,9150,9151
New-NetFirewallRule -DisplayName 'SecArsenal-Block-Tor-Outbound' -Direction Outbound `
-Protocol TCP -RemotePort $ports -Action Block -Profile Any -ErrorAction SilentlyContinue
Write-Host "[+] Rule 'SecArsenal-Block-Tor-Outbound' applied." -ForegroundColor Green
} else {
Write-Host "[i] AuditOnly mode — no firewall changes made. Set `$AuditOnly=`$false to enforce." -ForegroundColor Gray
}
# --- 4. Report summary for IR ticketing ---
Write-Host "[+] Audit complete. Export Get-WinEvent -LogName 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall' for block telemetry." -ForegroundColor Cyan
Remediation
There is no patch here — the remediation is organizational and architectural. Prioritized actions:
- Establish policy before you block. Tor has legitimate uses (journalism, research, whistleblowing). Define in writing who is authorized, on which assets, then enforce everywhere else. Undocumented blanket blocks generate shadow IT; documented exceptions generate accountability.
- Deploy the detections above and retro-hunt 12+ months. The seized marketplaces were active for years. If an insider was transacting from a corporate asset, you want to find it before law enforcement does. Preserve any hits as forensic evidence — do not remediate and destroy.
- Block Tor egress at the perimeter, not just the host. Host firewall rules are trivially bypassed by local admins. Enforce at the proxy/NGFW: block known Tor directory authorities and guard relays (commercial threat intel feeds and the public Tor relay list are consumable via API), and alert on TLS connections to non-standard ports without SNI — a common pluggable-transport fingerprint.
- Re-validate your dark web monitoring coverage now. Post-takedown vendor displacement means your monitoring provider's collection sources from Archetyp/Nemesis ecosystems just went dark. Confirm they've pivoted to successor markets and Telegram channels. If you do in-house collection, stand up new personas immediately — the first 90 days after a takedown is when stolen-data inventory gets re-listed elsewhere.
- Ingest the intelligence fallout. Seized-marketplace data leaks and law enforcement disclosures will surface credential corpora tied to these markets over the coming months. Ensure your credential-leak response pipeline (reset, revoke sessions, hunt for usage) is tested and fast. Have I Been Pwned domain search and your threat intel provider's DNM feeds should both be checked against your domains.
- Brief executives on insider exposure. If any employee was a buyer — on these markets specifically — and used corporate identity, email, devices, or network, your organization may receive law enforcement inquiries. Legal and HR should have a response plan before that call arrives.
- Hunt for the upstream problem: infostealers. Much of what transits these markets originates in infostealer infections on unmanaged or poorly managed endpoints. If you find Tor usage plus stealer artifacts on the same host, treat it as an active compromise, not a policy violation.
The Bottom Line
354 arrests across five marketplaces is not just a law enforcement press release — it's proof that dark web attribution at scale is now routine, and that years of "anonymous" activity is sitting in an evidence database. For defenders, the actionable surface is twofold: detect and govern anonymized-network access from your estate, and position your intelligence collection to absorb the displacement and data fallout that follows every takedown of this size. The organizations that treat this as a hunt trigger rather than a headline will be the ones that find their exposure first.
Related Resources
Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.