You don’t need advanced technical skills to become a target or cause harm. Dark web listings, leaked data, and ready-made tools can lower the barrier to attack, while cyber mercenaries sell offensive capabilities to private buyers.
That is the warning behind David Bombal’s discussion with Colin Ellis, an onboarding engineering manager at ThreatLocker, who addresses cyber mercenaries selling offensive capabilities. Everyone knows enough to be dangerous, and malicious hackers often need only a believable message, reused passwords, or an unprotected account to get started. These are common security vulnerabilities that basic cybersecurity habits can help prevent.
Key Takeaways
- Dark web listings can make cybercrime appear accessible, but many offers are scams, traps, or criminal services with serious legal risks.
- Attackers often rely on reused passwords, leaked information, social engineering, and ready-made tools rather than advanced technical skills.
- Tor and Tails can reduce some tracking, but they do not make dark web activity safe, anonymous, or legal.
- Unique passwords, multi-factor authentication, software updates, careful handling of messages, and proper offboarding block common attack routes.
- Organizations that need security testing should use authorized ethical hackers with written permission and a defined scope.
Security matters because cybercrime has a marketplace
Colin Ellis works with ThreatLocker clients on product implementation and training. In the discussion, he breaks down cyber risk in terms that make sense to both technical teams and everyday users. You can also find Colin Ellis on LinkedIn.
He describes hackers for hire as a service model within the broader dark web economy. These darknet markets are criminal marketplaces, not ordinary e-commerce platforms, with buyers, tool users, and sellers offering different capabilities. Cyber mercenaries package offensive services for customers who lack the skills or time to attack directly.
For a cybersecurity audience, the demonstration uses three attacker profiles:
- A nontechnical person who wants to hire cyber mercenaries to attack a target through believable messages or social engineering.
- A “script kiddie” who can deploy tools created by others, including tools offered by cyber mercenaries.
- A programmer who can build malicious code but needs a list of targets.
Each profile reaches the same conclusion: attackers don’t always need to write sophisticated code themselves. They can buy services from cyber mercenaries, reuse public tools, or exploit information that has already leaked.
The dark web is accessible, but it isn’t safe
Ransomware Live, a public tracking site, offers threat intelligence about reported ransomware attacks linked to dark web leak listings. Its listings can change frequently, and not every listing is independently verified. An organization shown on a leak site may not yet understand the incident’s full scope.
A compromise can become public before the victim understands what happened.
The video briefly showed parkerlitman.com as one listing on Ransomware Live, without claiming details about the incident. Reported cases can involve cyber mercenaries who exploit exposed organizations, but the video didn’t establish that here. The point was the pace of reported ransomware activity, not the status of any individual organization.
Criminal marketplaces and services offered by such actors are different from legitimate security research. Researchers can work in controlled environments and use digital forensics to assess public claims. Threat reporting may discuss advanced capabilities, including zero-day exploits, without providing operational details.
Commercial spyware is a separate, high-end category of surveillance technology, not a synonym for ordinary listings. Public reporting has associated NSO Group with Pegasus spyware. Reporting about Pegasus spyware isn’t evidence that any organization shown in the video used it, and it doesn’t connect those listings to commercial spyware.
Tor and Tails reduce tracking, not risk
The dark web is still part of the internet, although onion services require software such as Tor to access. Colin used Tails, a Linux-based operating system that can run from a USB drive and leave fewer traces on the computer after use.
Tails and Tor can help researchers separate sensitive browsing from their everyday system. Neither makes a person untouchable or anonymous in every circumstance. They also don’t remove risks posed by malicious sites or cyber mercenaries.
Onion addresses can disappear, move, or change without warning. Directories sometimes claim to collect current destinations, but easy to find does not mean safe or legal. Public directories may point toward darknet markets or anonymous marketplaces, but their visibility doesn’t make cyber mercenaries legitimate. A research-oriented reference such as Verified Tor Onion Links also shows why information about dark web sites can appear publicly online.
Hacker-for-hire listings make abuse look ordinary
The first persona is a person with harmful intent but little technical knowledge. They might be angry with an employer, looking to access a partner’s account, or trying to embarrass someone online. They may turn to cyber mercenaries or hackers for hire, making abuse look as simple as buying a service.
On the dark web, one listing claimed cyber mercenaries could remotely control and take over a phone for $700. The claim could resemble a commercial spyware service, but the advertisement was unverified. Another claimed access to Facebook, Instagram, and other social media accounts for about $500. Alongside the listed email and phone targets, that suggested account takeover as the advertised outcome. The offers may have been scams, traps, or law-enforcement operations, but they still marketed personal abuse as a transaction.
The discussion identified possible targets associated with these alleged cyber mercenaries, including:
- Facebook and Instagram accounts
- Private social media messages
- Mobile phones and email accounts
Searches for hackers for hire may lead to scams, law-enforcement operations, or criminal marketplaces. They may also expose buyers to malicious hackers offering unauthorized access, creating legal risk involving computer fraud. There is no reliable or legitimate shortcut to unauthorized access.
The price of long-term harm
A second listing claimed cyber mercenaries could “ruin someone’s life” for $1,700. Colin’s response was direct: harmful services should not be this easy to advertise or this practical to buy.
Another seller offered 30 days of full-time work for $7,500, but the price offered no proof of skill or legitimacy. Buyers had no dependable way to verify the seller, recover funds, or challenge fraud.
Anonymous dark web marketplaces, including darknet markets, aren’t reliable providers and offer little buyer protection. A marketplace can vanish after accepting cryptocurrency transactions, a seller can lie about their skills, and an apparent service can be a trap. Tor may obscure some information, but it doesn’t make buyers impossible to trace.
Ready-made tools can turn trust into an attack path
The video compares some dark web criminal marketplaces with ordinary e-commerce sites. Categories, prices, descriptions, reviews, and support processes make hackers for hire and cyber mercenaries look like ordinary paid services.
One marketplace example, We the North, displayed categories related to social media, email, mobile phones, and servers. Some social-media and phone listings appeared to suggest account takeover, but the demonstration did not verify their effectiveness. It also used CAPTCHAs and measures against distributed denial of service attacks. This reminds us that criminal operators often try to protect their own infrastructure.
Packaged tools from cyber mercenaries are not all equivalent. Commodity tools may be repurposed, commercial spyware supports surveillance, and legitimate security products support defense.
Public reporting has associated NSO Group with Pegasus spyware, a high-end surveillance capability. Public reports describe Pegasus spyware as a high-end example of how commercial spyware can package sophisticated surveillance capabilities. The demonstration did not establish any connection between that reporting and the marketplace shown.
You do not need to build the tool to misuse it. That is the risk behind the script-kiddie profile, where cyber mercenaries can make basic campaigns accessible to low-skill users. Someone with basic technical knowledge may deploy an existing payload or run a purchased campaign without understanding the underlying technology. That differs from advanced capabilities such as zero-day exploits.
WhatsApp messages can exploit familiar relationships
A WhatsApp-related offering in the demonstration appeared to cost about CAD $9.90 to begin. The concern isn’t the price alone, and the listing shouldn’t be conflated with commercial spyware such as Pegasus spyware. Family chats, forwarded images, old photos, and familiar TV references can make a malicious message feel trustworthy.
Colin described receiving a message tied to Passions, a television show he watched with his mother. That is social engineering. A real memory can lower a recipient’s guard, especially when the message appears to come from someone they know.
That pattern can spread quickly:
trusted contact -> believable message -> link or attachment -> possible compromise
That pattern resembles phishing emails, but the channel here is a familiar messaging app.
Attackers can also use Facebook, Instagram, LinkedIn, email, and WhatsApp to research a target’s relationships. They may seek relationship or login information through credential harvesting.
Social engineering succeeds because people trust colleagues, relatives, and former employers. That is a cybersecurity concern because familiar channels can expose security vulnerabilities in both people and systems.
Trust-based abuse can let cyber mercenaries misuse familiar relationships, while commercial spyware can create more serious surveillance risks. Public reporting about NSO Group and Pegasus spyware shouldn’t be treated as evidence that either was involved here.
Ransomware groups use stolen data as pressure
Data breaches can create secondary risk when exposed records travel beyond the original organization.
The discussion also examined Clop, a ransomware group reported to publish a “wall of shame” naming alleged victims. The alleged dark web activity illustrates how ransomware attacks can use public exposure. Cyber mercenaries may support the wider criminal ecosystem, but Clop’s leak-site claims aren’t independently verified here.
The University of Miami appeared as an example of how leaked organizational information can provide target lists for cyber mercenaries and other operators. That example doesn’t establish that the university was targeted or that any particular incident occurred.
Malicious hackers and cyber mercenaries can cross-reference names with LinkedIn profiles, prior employers, old accounts, and reused passwords. Those connections can make phishing emails and social engineering more convincing, even when the original records seem incomplete.
Leaked records can support several kinds of operators, including commercial spyware actors, without proving that any named organization was targeted. Public reporting about NSO Group describes Pegasus spyware as a high-end surveillance capability. That reporting distinguishes Pegasus spyware from ransomware groups and the alleged Clop activity. Reports about NSO Group don’t establish that the University of Miami was targeted.
Data breaches can therefore affect former employees, customers, suppliers, and family members. Former employees may retain knowledge of old accounts, creating insider threats, while exposed contacts face more convincing manipulation. Organizations should combine notification duties, privacy obligations, regulatory compliance, and a documented incident response.
That broader cybersecurity risk extends beyond the original organization. Cyber mercenaries may use exposed records for other purposes. Commercial spyware operations, discussed in reporting about Pegasus spyware, represent another possible downstream use. These examples should not be conflated with Pegasus spyware or that separate reporting.
Basic digital hygiene blocks common attack routes
Password practices and account management remain central to cybersecurity. Ransomware groups and cyber mercenaries often exploit familiar security vulnerabilities. These include reused credentials, old accounts, missing MFA, and poor offboarding.
A stronger baseline for security hardening includes:
- Use a unique password for every account, especially work systems, to limit the impact of data breaches.
- Choose long, complex credentials and store them in a reputable password manager.
- Disable former employees’ accounts and remove unnecessary local access during offboarding.
- Treat unexpected links, attachments, phishing emails, and login prompts as possible social engineering.
- Turn on multi-factor authentication for email, social accounts, work tools, and financial services to reduce account takeover risk.
- Keep devices and applications patched, and use application controls to reduce exposure to zero-day exploits.
Together, these controls frustrate common entry methods used by cyber mercenaries.
These controls reduce common risk, but they don’t prove that every advanced threat has been eliminated. Commercial spyware, including Pegasus spyware linked to NSO Group, may require specialized endpoint protection and expert assessment.
Ethical hackers for hire conduct penetration testing with written authorization, a defined scope, and permission from the system owner. That authorized approach supports regulatory compliance, unlike criminal ads promising unauthorized access by cyber mercenaries. If an organization wants to assess defenses legally, it should use qualified security professionals and documented testing agreements, not anonymous listings.
Strong cybersecurity requires layered defenses. MFA alone does not address every advanced surveillance capability, including Pegasus spyware.
ThreatLocker sponsored the video and offers a ThreatLocker free trial for organizations evaluating security controls. MFA should not be a debate; it is necessary.
Frequently Asked Questions
Are hackers for hire on the dark web legitimate?
Dark web listings are not reliable or legitimate providers of unauthorized access. They may be scams, law-enforcement operations, or criminal services that expose buyers to fraud, malware, and legal consequences.
Does Tor or Tails make dark web activity anonymous?
Tor and Tails can help separate sensitive browsing from an everyday system and reduce some tracking. Neither makes a person untouchable, removes malicious-site risks, or makes illegal activity safe.
How do attackers use social engineering?
Attackers use familiar names, relationships, messages, links, and attachments to make a request seem trustworthy. A believable message can lead to credential theft, malware infection, or account takeover.
What can people do to reduce the risk?
Use a unique password for every account, store credentials in a reputable password manager, enable multi-factor authentication, and keep devices patched. Treat unexpected messages and login prompts cautiously, and remove access that former employees or unused accounts no longer need.
How can an organization test its defenses legally?
Organizations should hire qualified ethical hackers or penetration testers under written authorization, a defined scope, and documented rules of engagement. Anonymous dark web listings are not a safe substitute for authorized security testing.
Protecting accounts is more important than chasing attackers
Dark web markets thrive when stolen credentials, exposed personal details, and weak account security give cyber mercenaries something to sell. Advertised prices and polished listings may look shocking, but basic defenses matter more. That remains true whether the concern is ordinary account failures, Pegasus spyware, or ransomware attacks.
Use unique passwords, remove old access, keep your digital profile limited, and enable MFA wherever it’s available. Authorized ethical hackers and penetration testing provide a legitimate alternative to anonymous criminal listings. Everyday cybersecurity habits reduce opportunities for cyber mercenaries to cause harm.