Most cybercriminals are not sophisticated. They do not need to be — the platforms they use are. Understanding how cybercrime actually operates, from the attacker’s perspective, changes how you design defenses entirely. Brett Johnson, former US Most Wanted cybercriminal and the person the United States Secret Service called “the original Internet Godfather,” built and ran Shadow Crew — the first organized cybercrime community and precursor to today’s darknet markets. Convicted of 39 felonies, he escaped from prison before ultimately turning his life around with help from the FBI. Today he consults with Fortune 500 companies on cybercrime defense. In this episode, he explains how the dark web has evolved, why credential stuffing remains devastating, and what a basic security checklist should look like from someone who spent decades on the other side.
You can read the complete transcript of the episode here >
What is the dark web and how has it evolved?
Brett breaks the internet into three layers: the surface web (about 4% — anything Google can find), the deep web (95-96% — content behind paywalls, emails, bank statements), and the dark web (somewhere within the deep web, potentially up to 15% of the entire internet by some estimates).
The dark web started with the US Navy creating the Tor browser so intelligence operatives could communicate without identification. When it was made open source — to help people behind restrictive firewalls and whistleblowers — criminals became the first adopters, because the technology enabled anonymity and money laundering.
How it has evolved:
- Traditional dark web markets are dying. Law enforcement has gotten effective at shutting them down. Criminal actors launch DDoS attacks against each other. Tor requires significant technical skill to use safely.
- Telegram is the new dark web. It has become the Wild West of cybercrime communication. Previously, Telegram attracted only unsophisticated newcomers. But the Ukrainian-Russian conflict has pushed sophisticated actors from non-English-speaking forums onto Telegram as well.
- An English-speaking cybercrime renaissance is underway. Non-English-speaking criminal forums are dying due to the conflict. Those criminals are not retiring — they are transitioning to English-speaking environments. The next few years will see significant damage from this convergence.
The operational model remains consistent: criminals gather data (often purchased from dark web marketplaces), commit the crime on the surface web (account takeovers, credit card fraud), and cash out.
What are the key cybercrime trends organizations should prepare for?
Brett’s predictions are blunt: the same as last year, only more. But two specific evolutions stand out:
- Session hijacking bypasses MFA entirely. Evil Proxy is a reverse proxy attack that sits in the middle of a login session, captures the session cookie after the user completes MFA authentication, then injects that cookie into the attacker’s browser. No password needed. No MFA prompt. The criminal walks straight in. This represents the criminal response to the industry push toward passwordless authentication.
- Credential stuffing remains massive. Despite years of warnings, credential reuse across services means stolen credentials from one breach unlock accounts across dozens of platforms. This is not going away.
Brett’s recommended countermeasure: hardware security keys. He previously evangelized password managers but is now less confident given recent breaches in that space. Pass keys and hardware tokens represent a more resilient path forward for identity and access management.
What is Brett’s five-point security checklist?
From someone who spent decades exploiting organizations, the fundamentals matter most:
- Understand your cybercrime value. Every person and organization has a place in the cybercrime spectrum. A CEO gets targeted with business email compromise. A payroll administrator gets targeted for W-2 theft. A food service worker gets targeted with synthetic identity fraud. An organization with valuable data gets breached. An organization with operational dependency gets ransomed. Understanding what attackers want from you determines how you design defenses.
- Treat every update as a broadcast to criminals. An unpatched vulnerability is a door with a published address. Most people delay updates. Attackers know this. Install updates immediately — they are security holes announced to every criminal on the planet.
- Move past passwords. Pass keys and hardware security keys represent the direction forward. Password managers are better than reused passwords but are no longer the definitive answer given recent industry events.
- Train for the full online life, not just work. Remote workers blur the boundary between personal and professional environments. An attacker who compromises a personal account can pivot to business access. Security training must cover the employee’s entire digital life, especially around third-party risk.
- Develop situational awareness online. In physical life, people notice when something in their environment feels wrong. That same instinct needs to be cultivated for digital interactions. Trust but verify. Understand that predators exist in digital spaces just as they do in physical ones.
Why is social engineering the key to almost all cybercrime?
Brett is unequivocal: without social engineering, cybercrime ultimately fails. The human is the weak link in every system because humans are designed by default to trust.
- Attackers need people to install malware, send money, or give access. Technical exploits get the attacker to the door. Social engineering gets them through it.
- 98-99% of cybercriminals are not sophisticated. They do not write their own tools. The sophistication lives in the platforms and products marketed to them — phishing kits, evil proxy services, credential marketplaces. The criminals themselves just need to convince a human to click.
- 90% of attacks use known exploits. Not zero-days, not unknown vulnerabilities — the things organizations have been warned about for years. SMB ports left open. Unicode domain business email compromise (known since at least 2010). The basics remain unaddressed because they are not “sexy” enough to sell.
The implication for organizations: fix the known problems first. Close the open ports. Patch the published CVEs. Train employees on phishing recognition. These basic actions eliminate the attack surface that the vast majority of criminals depend on.
Why is open security culture critical to defense?
Brett draws a direct parallel between how criminals innovate and how defenders should:
- Criminal communities brainstorm openly. They throw ideas at the wall without judgment. Some are ridiculous. Some do not work. But the environment of open experimentation means someone eventually has the breakthrough that succeeds.
- Many security teams have the opposite culture. People are afraid to speak up because they might look stupid. Management does not want to hear from the team. Ideas die before they are explored. This is the cultural anti-pattern that attackers exploit.
- The solution: encourage brainstorming without judgment. Create an environment where people are free to voice ideas, even bad ones. Cross-team collaboration — fraud teams welcoming input from customer service, engineering sharing with security — generates insights that siloed teams miss.
Brett extends this to inter-company collaboration: organizations refuse to share threat intelligence with competitors because of perceived competitive advantage. But criminals share freely with each other. Until defenders match that collaborative mindset, the industry will remain permanently reactive rather than proactive.
What is the biggest lie in cybersecurity?
“We can solve all your problems.”
No single tool, vendor, or platform can stop all cybercrime. You can mitigate significantly with layered defenses, good policies, and trained people — but a first-time criminal with nothing but luck can still get through. Anyone claiming otherwise is selling what Brett calls “cybersecurity pillow talk.”
A multilayered approach is non-negotiable: tools must mesh with each other, communicate with each other, and work together. A zero-trust architecture is one component of that layered strategy, but it is exactly that — one component among many.
