Discord Tops the List of Messengers Used by Cybercriminals

Analysts from IntSights have released a report focused on the most popular communication methods in the dark web. The report includes all mentions of communication tools found on popular dark web resources from June to July 2017.

The main finding: the use of messengers in the cybercriminal community has increased thirtyfold. While one might assume this is due to the shutdown of major marketplaces like AlphaBay and Hansa Market, that’s not the case. These dark web markets only went offline at the end of July, near the end of the data collection period. This means the hacker underground independently shifted toward using messengers.

Discord Leads, Surpassing Telegram and WhatsApp

According to the report, the most popular messenger among cybercriminals is, surprisingly, Discord. This is notable because Discord’s developers have refused to implement end-to-end encryption. Telegram and WhatsApp came in second and third, but with a significant gap behind Discord.

“Discord’s popularity is surprising, considering it’s a relatively small platform with only 45 million users,” IntSights analysts wrote.

Interestingly, in a similar study conducted by Flashpoint in spring 2017, Discord wasn’t even mentioned. This may be due to different data collection methods. The IntSights report focused on invites and links to group and private chats. Both companies, however, agree that ICQ remains popular on the dark web.

Other Trends: ORBot and Tor Usage on the Rise

IntSights experts also noted the growing popularity of ORBot, the Tor client for Android. Its installations increased from one million in 2014 to ten million in 2016. According to IntSights analysts, this is why criminals aren’t seeking messengers with built-in encryption—they simply use Tor instead.