Dark and Underground Markets

CyberDefenses Academy



Available Upon Request



Delivery Method



Certification of Completion

Audience / Level



Analysis and Profiling


Laptop required. See Additional Information below.

Course Details

Program Introduction

Dark markets. Underground forums. Clandestine economics that allow for transactions in the shadows. They lurk behind the attacks on your company, playing a role in determining whether your data is valuable and advantageous to steal. Knowing a request for your data exists, means the opportunity to see an enemy before they strike. Discovering your data traded, means finding a breach you didn’t know about. Sleuthing the markets, investigating and finding what they can tell you is a key element of defense-in-depth—but only one part.

Knowing might be half the battle, but being able to do something with that knowledge is the other half. Working the data is where structured analysis opens the door to taking a deeper action than just resetting credentials or accepting the loss. Forming models allows you to make predictions on targets. Matrix and utility analysis can strengthen the accuracy of your forecast by understanding past data. Analyzing the markets can tell you where the demand for your data and information is being sourced and traded. Investigating the market players helps in designing the right controls to better protect the focus of their interest, and place controls in the way of their tools and tradecraft.

Course Objectives

Target Student


Monty St John
Monty St John is a computer science and information security expert, U.S. Navy and U.S. Air Force veteran, certified instructor, and author of dozens of classes for CyberDefenses. He has assisted numerous companies build and accredit laboratories, threat teams, and security operations centers. He’s also a prolific writer with two upcoming technical volumes set for 2018; Game Designer and Speaker. Learn more about Monty St John

Additional Information

  • Laptop required
  • Dedicated internet connection
  • Virtualization software (VMware or VirtualBox)
  • VPN (kill switch capability suggested)

Course Outline

  • Introduction
  • Dark Web review
  • Cryptocurrency review
  • Forums, Bazaars & Markets
    • Market locations
      • Clearnet & Deep-net
      • Darknet
      • Case Study: Market Comparisons
  • How do they work?
    • Who runs them?
    • Data for Sale
    • How does someone sell or buy?
      • Mode of payment
      • Escrow
    • Requests & solicitations for action
    • Vendors & Shops
    • Stalking the Money
  • Market Dynamics
    • SATs for market analysis
    • Forecast Demand
    • Predictive Modeling
      • What will be focused on next
      • What tools will be used