Dark Web Malware: How It Works (with demos)

Summary

David Bombal interviews Lindsay Kaye, author of Dissecting the Dark Web, about how the book connects dark-web criminal markets with practical malware reverse engineering. Each chapter introduces a tool, explains how criminals describe and trade it, then explores its technical behavior and indicators. The material is aimed at readers with basic programming knowledge, though Kaye says readers can still learn from the explanations without extensive coding experience.

Malware-analysis demonstrations

• SteelBit data-exfiltration tool: Kaye examines a tool supplied through the LockBit ransomware-as-a-service program. Its options include choosing what to collect, skipping files, limiting network activity, hiding its window, and self-deleting. The discussion also explains how data theft can precede encryption and support further extortion.
• Static and dynamic analysis: Using Ghidra to inspect and decompile code and x64dbg to run it, Kaye demonstrates how analysts can combine the two approaches. Few visible strings or imported functions can indicate that strings are obfuscated and functions are loaded at runtime. The demo follows function loading and string decryption, then connects command-line options to the tool’s behavior.
• Anti-analysis behavior: The SteelBit sample checks the Windows process environment block for a debugger and changes its behavior when one is detected. The demo shows how an analyst can modify the relevant value in a debugger to continue examining the sample.
• Detection from logs: SteelBit uses a named pipe for communication between instances. Kaye finds its “Steelbit Master Pipe” in Sysmon events and explains how such artifacts can inform detection rules, including Sigma rules. More broadly, reverse engineering can help defenders create practical detections.
• BlackMatter ransomware: The discussion covers affiliate recruitment, target requirements, and the group’s efforts to avoid law-enforcement attention. Kaye also analyzes how BlackMatter hashes command-line arguments instead of plainly comparing readable strings, and how documentation and testing can help map arguments to their functions.
• Ransomware features and evolution: The demo runs a sample in a virtual machine, showing file encryption, changed file extensions, and a ransom message. Other features include selecting paths, rebooting into safe mode, changing desktop wallpaper, and printing ransom notes on physical printers. Kaye describes these as product changes intended to increase visibility and pressure on victims. She also notes that ransomware families evolve through development cycles to attract affiliates.

Dark-web markets and learning advice

Kaye explains that access to some criminal forums requires referrals, payment, or a reputation built over time. Escrow and public dispute processes help establish trust within these markets. The interview also covers how ransomware operators recruit affiliates, specify target profiles, and offer versions for Windows, Linux, NAS systems, and other environments.

For beginners, Kaye recommends learning coding fundamentals and practicing by writing or studying small programs, compiling them, and examining the results in Ghidra. Familiar structures and concepts—such as functions, loops, and linked lists—provide a foundation before tackling malware-specific complications. She emphasizes patience and learning through repeated attempts.

Guide and product mentions

• Book: Dissecting the Dark Web combines criminal-market context with step-by-step reverse-engineering examples and practice exercises. The interview mentions examples involving banking Trojans, ransomware, and the Sodinokibi/REvil family.
• Tools: Ghidra is presented as a free reverse-engineering tool, while x64dbg is used for dynamic analysis. The examples show how the tools complement each other.
• Sponsor segment — Proton Pass: The sponsored segment describes unique password generation, end-to-end encrypted credential storage, automatic login filling, and email aliases intended to reduce exposure of a user’s real email address.

Main speakers and sources

• David Bombal — Host and interviewer.
• Lindsay Kaye — Guest, malware reverse engineer and author of Dissecting the Dark Web; identified in the interview as a threat-intelligence leader at Human Security.
• Tools and samples discussed — Ghidra, x64dbg, Sysmon, SteelBit, and BlackMatter ransomware.
• Sponsor mentioned — Proton Pass.