U.S. Institutions and the Dark Web: What’s Being Sold and Who’s Buying?

This report surveys Dark Web marketplaces targeting U.S. institutions, detailing what is sold (PII, medical records, credit card dumps, VPN/RDP credentials, cloud/OAuth tokens, session cookies, intellectual property), who buys access (ransomware groups, fraud networks, nation-state linked actors, phishing operators), the most-targeted sectors (finance, technology/SaaS, government, healthcare), and recommended defensive measures (dark web monitoring, credential rotation, supply-chain risk monitoring). It emphasizes the industrialization of cybercrime—Initial Access Brokers, infostealers, and commoditized session cookies/tokens—creating high-value, rapidly monetizable access that amplifies risk to U.S. organizations.