The Biggest Lie You’ve Been Told About the Dark Web, Shay Maman Explains
The internet most of us know is deceptively small. News sites, shopping platforms, TikTok feeds and Instagram reels form only the surface. Beneath lies a vast hidden ecosystem, places where criminal markets, extremist propaganda and anonymous dissent intersect. This is the world that intelligence researcher Shay Maman has spent his career investigating.
Maman’s path into intelligence was not straightforward. After serving in the Israeli army, he first imagined becoming a penetration tester, “the good hackers,” as he describes them, probing vulnerabilities in systems before malicious actors can exploit them. But his curiosity soon shifted. “I understood my interest was not in penetration testing itself,” he recalls, “but where those cyber criminals are hiding and what they’re doing.” That curiosity led him into the reconnaissance phase of what cyber professionals call the kill chain, and into the broader world of intelligence gathering.
To explain the hidden internet, Maman offers a simple analogy. Criminals in the physical world rarely commit crimes in the middle of the street; they operate behind closed doors, in garages or secluded spaces. The same logic applies online. Encrypted forums, invitation-only chatrooms and darknet markets provide the cover. Yet, as he stresses, the dark web itself is not inherently malign. It can also serve as a refuge. Citizens in repressive states such as Iran use it to speak freely, shielded from surveillance and persecution.
What surprised Maman most was the ordinariness of many who inhabit these spaces. When authorities arrested Pompompurin, the administrator of BreachForums, they discovered not a shadowy cartel leader but a teenager. The hacking group Lapsus, too, was largely made up of young people. “We’re not talking about Pablo Escobar-type figures,” Maman notes. “In most cases it’s students in their parents’ garage, or someone looking for extra cash to pay rent.” More disturbing still was his exposure to child sexual abuse material. The perpetrators, he says, were often “normal individuals, people with families, jobs, even children of their own.”
Recruitment into extremist groups has also evolved. Where once radicalisation in Afghanistan took place through mosques and small gatherings, today much of it happens online. Telegram and encrypted messengers are hubs, but the gateway is often mainstream platforms. “The most advanced way is TikTok and Instagram Reels,” Maman says. Content packaged as memes or trending songs reaches teenagers — those “weak minds,” as he cautiously phrases it, struggling with identity and belonging. State actors like Iran and Russia exploit the same tools, seeding propaganda into feeds. The result is lone-wolf attackers who may never have met a recruiter in person yet leave behind digital trails of manifestos and extremist content.
Governments have spent millions dismantling dark-net markets such as Silk Road and AlphaBay, but replacements quickly emerge. “It’s a cat and mouse game,” Maman says. Operationally savvy groups adapt, investing in infrastructure and avoiding rookie mistakes. What gives investigators an edge are the small errors: a reused username, an old email address, a careless post. These fragments, gathered through open-source intelligence, can be cross-referenced to unmask identities.
Still, Maman cautions, OSINT has limits. At some point, only human intelligence—someone closer to the inner circle—can close the gap. For everyone else, his advice is pragmatic. Keep basic online hygiene, avoid suspicious spaces, and the darker corners of the internet will remain just that: out of sight.
