What Is the profile of the average dark web user?

Kaspersky Digital Footprint Intelligence has published a new report titled Inside the dark web job market: Their talent, our threat. According to the study, the first quarter of 2024 saw a doubling of resumes and job postings on “underground” forums compared to the same period in 2023, while the first quarter of 2025 maintained the same high levels. Overall, in 2025, resumes exceeded available positions, with a ratio of 55% to 45%, driven by global layoffs and the influx of younger candidates. The age distribution of applicants shows an average age of just 24, with a notable presence of teenagers.

Most jobs on the dark web are related to cybercrime or other illegal activities, although some legitimate roles exist. Kaspersky’s data reveals a parallel economy in which 69% of candidates do not specify a preferred sector, openly indicating they would accept any paid opportunity—from programming to fraud or high-risk cyber operations. The list of the most sought-after IT roles by dark web employers highlights the maturity of this criminal ecosystem:

• Developers (17% of postings): creating attack tools
• Penetration testers (12%): identifying network vulnerabilities
• Money launderers (11%): laundering money through complex, multi-layered transactions
• Carders (6%): stealing and using payment information
• Traffers (5%): directing victims to phishing websites or infected downloads

Gender trends are also evident in specialized roles. Female candidates primarily seek communication roles, such as customer support, call centers, and technical help. Male candidates more often target technical or financial crime roles, including developers, money mules, or coordinators of such networks.

Salary expectations vary widely by specialty. Reverse engineers earn the highest wages, exceeding $5,000 per month, followed by penetration testers at $4,000, and developers at around $2,000. Fraudsters are often paid a percentage of the group’s total earnings. Money launderers receive approximately 20%, while carders and traffers earn roughly 30% and 50%, respectively. These figures reflect the high value of rare, specialized skills within this dark ecosystem.

Young people considering dark web employment should understand that short-term gains come with irreversible legal consequences and reputational damage. Parents, educators, and communities are urged to report suspicious online approaches immediately. Children should be made aware of the many legal pathways for skill development and careers in technology, such as cybersecurity. Kaspersky’s special project What we should do with kids who hack focuses on guiding teenagers to redirect and creatively utilize their skills.

Recommended Kaspersky Security Practices

For individuals:

• Avoid links to suspicious websites. Never respond to unsolicited “easy money” offers, especially via Telegram or unknown forums. Verify the legitimacy of any posting through official channels.
• If you are a teenager, report suspicious posts to parents or authorities. No high salary is worth acquiring a criminal record.

For organizations:

• Train staff to recognize phishing attempts and suspicious links.
• Monitor the dark web for corporate information and resumes of former employees. Train HR teams to identify instances of informal experience (“shadow experience”) in candidates’ histories. Implement mandatory multi-layered fraud detection processes—money mules and carders are often entry-level roles in larger attack chains.
• Continuous monitoring of dark web sources significantly enhances risk coverage and allows organizations to detect trends and plans of threat actors. This type of monitoring is part of Kaspersky’s Digital Footprint Intelligence service.
• Use multiple Threat Intelligence sources (covering surface, deep, and dark web) to gain a complete understanding of the tactics and techniques employed by cybercriminals.