Cybercriminals are increasingly moving operations from the dark web to mainstream platforms like Telegram, Discord, and social media due to law enforcement pressure and the practicality of these accessible channels. This shift enables easier communication, recruitment, and data leakage, complicating threat detection for defenders. Consequently, threat intelligence strategies must adapt to monitor diverse platforms effectively, necessitating enhanced operational security, language skills, and automation tools for efficient surveillance. The evolution of cybercriminal behavior highlights that the dark web is no longer the primary hub of illegal activities.
https://sosintel.co.uk/beyond-the-dark-web-where-threat-actors-operate/