Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Use Dark Web Monitoring to Detect Stolen Credentials
Transcript
- Luna: How worried should the average enterprise be about credentials ending up on the dark web? Lucas: Very worried. And I mean that specifically—we're not talking about some nebulous hacker boogeyman. The data is concrete. In 2024, researchers tracked over 5 billion credentials leaked or stolen. That's not a typo. Billion with a B. And a huge chunk of those ended up on dark web marketplaces or Telegram channels within hours of the initial breach. Luna: Five billion. That's almost two credentials for every adult on the planet. And I know a lot of those are duplicates, but still—the sheer volume means that for any company with more than a few hundred employees, it's almost certain some employee credentials are floating out there. Lucas: Right. And that's why dark web monitoring has become a standard layer in enterprise security. It's not just about intelligence gathering for nation-state threats anymore. It's a practical, operational tool. Security teams now run automated scans across known criminal forums, paste sites, Telegram channels, and even invite-only marketplaces to find mentions of their corporate domains or specific employee email addresses. Luna: So how does that actually work? Is it just a search engine for the dark web, or is there more to it? Lucas: It's more sophisticated than just indexing. The commercial platforms—companies like SpyCloud, Flare, Digital Shadows, now part of ReliaQuest—they maintain crawlers that can access Tor hidden services, IRC channels, and encrypted messaging apps. They parse the data, check for corporate email addresses, and then alert the client. But the critical piece is speed. A credential posted on a forum at 10 AM could be used in a credential-stuffing attack by 10:15. Your monitoring window is minutes, not days. Luna: And that's exactly what happened in the Snowflake breach in 2024. Attackers used credentials stolen via infostealers—malware that scrapes browser cookies and saved passwords—to break into Snowflake customer environments. The credentials were available on criminal markets well before the breach was disclosed. Lucas: Exactly. That campaign really woke a lot of CISOs up to the fact that credential exposure is a supply chain problem. It's not just your own employees. It's your vendors, your contractors, your partners. If a janitorial contractor uses the same password for their Snowflake admin account as they do for their personal Netflix, and that password leaks, you're at risk. Dark web monitoring for third-party domains became a priority after that. Luna: And it's not just about credentials. Monitoring also catches leaked source code, internal documents, or sensitive config files. Sometimes attackers post samples as proof of a breach before they even try to extort the company. Lucas: That's a huge point. In some cases, security teams find out about their own breach from a dark web monitoring alert before their internal detection tools catch it. The attacker posts a small sample to a forum to build credibility, and the monitoring tool picks it up. That gives the defender a head start—hours, sometimes days—before the attacker moves to the extortion phase. Luna: But there's a challenge here: noise. A typical enterprise might get hundreds of alerts per week. Employee credentials show up from old breaches of unrelated services. How do you filter signal from noise? Lucas: That's the hard part. Most platforms use a combination of automated classification and human analysts. They look for context—is the credential being actively traded? Is it fresh? Did it just appear in a new stealer log dump? And they enrich it with other signals: Has the password been hashed? Is the hash crackable? Is the email address a high-value target, like a C-suite or IT admin? The goal is to surface only the alerts that require immediate action, like forcing a password reset. Luna: And then there's the question of legality and ethics. Some monitoring goes beyond scraping public forums—it involves infiltrating private Telegram groups or even engaging with threat actors. Where's the line? Lucas: The line is usually drawn at active engagement. Most commercial services stick to passive collection: accessing publicly available content, even if it's on the dark web. But some threat intelligence firms do go further—they'll pose as buyers or sellers in closed markets. That's a gray area. It's legal in most jurisdictions if you're not committing a crime, but it's ethically tricky. You're essentially interacting with criminals. And if you're a corporate security team, you have to ask: is that worth the risk? Most decide it's not, and they rely on specialized vendors who have the expertise and legal cover. Luna: So how does a company actually start with dark web monitoring? Do they build in-house or buy? Lucas: Almost always buy. Building your own crawlers for the dark web is a huge engineering effort. You need to maintain Tor exit nodes, handle CAPTCHAs and anti-bot measures on forums, parse different data formats, and keep up with shifting marketplaces. It's a full-time job. Most enterprises buy a subscription to a platform like SpyCloud or Flare, and integrate it with their SIEM or SOAR. The platforms typically cost between $10,000 and $100,000 per year depending on the size of the organization and the number of domains monitored. Luna: And that's a small price compared to the cost of a breach. The IBM Cost of a Data Breach report for 2025 pegged the average cost at over $4.5 million. So even a six-figure monitoring subscription is cheap insurance. Lucas: Exactly. And I think that's the argument security teams are making to the board. They say: look, we can't prevent every credential theft. But we can detect exposure fast and rotate credentials before the attacker uses them. That's a measurable risk reduction. And it's one of the few security controls where you can point to a specific alert and say 'this prevented a breach.' Luna: And that kind of tangible outcome matters when you're trying to justify budget. It's not like 'we blocked X number of attacks'—it's concrete: we found 50 employee credentials being sold, we reset them, and none of those accounts were compromised. Lucas: Right. And these conversations we have on the show, about specific tools and tradecraft—they take time to research and produce. We do this because we think it's genuinely useful for people building and running security programs. A couple of dollars a month is genuinely what keeps these going—buy me a coffee dot com slash fexingo, if you've gotten something out of them. Luna: Yeah, it really makes a difference. And we keep the show ad-free because of it. Lucas: So back to the tactics. One emerging trend is the use of dark web monitoring to detect infostealer infections specifically. Infostealers are malware that logs keystrokes and steals browser data. They're often sold as a service on the dark web. The stealer logs—files containing thousands of credentials—are then traded or sold. Monitoring for these logs has become a priority. Luna: And that's where automation really helps. A platform can ingest a stealer log, extract all corporate email addresses, and automatically trigger password resets for those users. Some even check if the credentials are still valid against the company's identity provider. Lucas: That's a key capability. Because not all stolen credentials are active. The employee may have changed their password since the log was created. But if the credentials are still valid, you need to act immediately. And the best platforms can integrate directly with Azure AD or Okta to force a reset and even revoke sessions. That's a powerful automation. Luna: But there's a human element too. Analysts need to triage alerts, decide which are critical, and communicate with affected users. You don't want to automatically reset the CEO's password at 3 AM based on a false positive. Lucas: Right. So the workflow is usually: alert lands in the SIEM, a human analyst reviews the context—is this a high-value account? Is the credential recent? Was it hashed? Then they decide to force a reset or just flag it for awareness. That's where experience matters. A junior analyst might overreact to every hit, while a senior analyst knows that a credential from a 2018 LinkedIn breach is likely stale. So it's a blend of automation and judgment. Luna: And the landscape keeps evolving. Attackers are moving to even more obscure channels: encrypted messaging apps like Telegram and Signal, or invite-only Discord servers. Monitoring those is harder. Lucas: Much harder. Some platforms can join public Telegram groups and scrape messages, but private groups require an invite. And if you're invited, you're under scrutiny. So there's a cat and mouse game. But the basics—paste sites, public forums, Tor hidden services—still cover a huge amount of activity. Most attackers aren't sophisticated enough to hide completely. They want to sell their data, so they need some visibility. Luna: So for a mid-sized company just starting out, what's the first step? Lucas: Start with a free trial of a platform like Flare or SpyCloud. They'll scan for your domain and show you what's already out there. You'll probably be surprised. Then decide on a budget. For a company with 500 employees, you might spend $15,000 a year. Integrate the alerts into your existing security stack. And train your SOC team on how to triage. It's not a silver bullet, but it's a critical early warning system. Luna: And that early warning can be the difference between a credential being used and a breach. It's a good investment. Lucas: Absolutely. I think within the next few years, dark web monitoring will become as standard as antivirus or email filtering. The threat is too pervasive to ignore.