Posted on March 27, 2019 at 3:58 PM

DDoS Attacks or DEA? DreamMarket is Closing, But No-One Knows Why

It has been going for six years, but Dream Market is closing down according to admins who left a message telling people to go use a partner platform.

Dream Market, the Dark Web’s largest marketplace, is shutting down according to threat researchers from both IntSight and Flashpoint. The infamous Dark Web marketplace where people have been buying and selling illicit goods such as drugs, weapons and various hacking resources such as cracked databases, tools and tutorials, is scheduled to shut down on April 30th.

Threat actors on the DNM Avengers forum have stated that on the 26th of March, they received an unsigned message from the admins of Dream Market. The message stated that:

This market is shutting down on 04/30/2019 and is transferring its services to a partner company, onion address: weroidj*********.onion (currently offline, opening soon)

Many other threat actors reported that they had received a similar message, while there are others who denied having received anything at all. Incidentally, the alleged announcement came on the same day that Europol, the FBI, and the DEA announced that they had made tens of arrests and had successfully cracked down on web drug trafficking.

The message is a honeypot according to many

Chatter in Dark Web forums is speculating that the message was sent out to spread the word on a new website that would act as a honeypot for the police for a new round of arrests, in a move that could allow the police to embed themselves much deeper than they were before.

Others, however, believe that it could be fatigue from the admins. The constant security needed to keep the police away could simply have worn down the owners of Dream Market and some people in the community are of the opinion that the owner simply can’t take the constant pressure of six years at the top. The retirement route is something that is not afforded to many people who own Dark Web marketplaces.

Two other theories have gained much less ground. One is that the owners were setting up to go for a rebrand, though no one has been able to justify that position. The other theory is that a major international player with a lot of money wants to corner the market on illicit trafficking on the Dark Web.

Retirement theory is closest to reality

Ariel Ainhoren, the lead researcher for the Cyber Threat Intelligence Unit at IntSight, says that the manner in which the shutdown was announced makes it unlikely that the police are involved. He confirmed that the message went out to all members, as it seems the owner/s of the platform wanted to afford the members enough time to cash out in a more or less orderly fashion. This is very different from how law enforcement has worked these cases in the past, keeping the platform running to gain even more information.

However, he believes that the recent closures due to DDoS attacks on the Kickass and Torum forums have led to the Dream Market owners deciding to close up shop while they still have time. The Kickass and Torum forums were attacked repeatedly until shut down when notorious threat actor that goes by the monicker Thedarkoverlord. It is not known whether this is a group or an individual, but what is known is that as soon as they posted on those forums as a way to get in touch, those forums were shut down by repeated attacks.

In this instance, Ainhoren says, it makes sense that any prudent Dark Web platform, particularly one as high profile as Dream Market, would be wise to lay low for a while.