The dark web still offers a safe haven for criminal activity – especially those sites operating outside the reach of Western law enforcement. Much of the dark web is devoted to cybercrime, from sharing techniques and tools to selling stolen data and credentials. Having an ear to the ground in this shadowy underworld can give organisations an edge in identifying and defending against threats, from new trends to attacks specifically targeting them. But acquiring access to these secrets is no easy feat, explains Ziv Mador of Trustwave. “The golden age of the dark web marketplace is over”. So declared Europol in September 2020, after the triumphant announcement of operation ‘DisrupTOR’, a sting that led to the arrest of 179 criminals selling drugs and weapons.1 The operation, which saw co-ordination between Europol and law agencies across the world, is the latest strike against the virtual marketplaces that are the beating heart of the criminal underworld today. © 2021 Elsevier Ltd