The Dark Web, AI Deepfakes, and the Business of Cybercrime

Cybercrime no longer resembles a loose collection of isolated actors and ad-hoc attacks. As discussed in a recent episode of Bourbon & Bytes, it operates as a mature underground economy—complete with specialization, marketplaces, service models, and increasingly sophisticated use of artificial intelligence.

In this episode, Terry McGraw, CEO of Cape Endeavors, sits down with Rebecca Taylor, Threat Intelligence Knowledge Manager and Researcher at Sophos, to unpack how cybercrime has evolved—and why defenders are increasingly under pressure to keep pace.

Cybercrime as an Underground Economy

One of the clearest takeaways from the conversation is that cybercrime now mirrors legitimate business ecosystems. Rather than doing everything themselves, threat actors increasingly rely on specialized roles and services, including:

• Ransomware-as-a-Service (RaaS) operators who develop and lease tooling

• Initial Access Brokers (IABs) who specialize in compromising networks and selling entry points

• Credential marketplaces offering massive volumes of stolen login data

• Affiliates who focus purely on execution and monetization

  
  

This division of labor lowers the barrier to entry and increases scale. As Taylor notes, navigating these ecosystems can feel less like hacking and more like shopping—with forums, marketplaces, reputation systems, and recruitment posts all readily available.

Human Intelligence from Inside the Dark Web

Taylor’s work in human intelligence research adds a critical dimension often missing from technical analysis. Contrary to popular perception, dark-web spaces are not uniformly chaotic or overtly hostile. They often function as communities, where participants converse casually, share interests, and build relationships alongside criminal activity.

This normalization matters. Anonymity and abstraction allow individuals to distance themselves from the real-world consequences of their actions. Victims remain invisible, while the social reinforcement of community reduces psychological friction. Taylor also highlights the presence of informal “rules” or moral boundaries within some forums—rules that are inconsistent, selectively enforced, and ultimately insufficient to prevent real harm.

The result is a space where severe criminal activity can coexist with mundane conversation, making participation feel less extreme than it truly is.

AI, Deepfakes, and the Acceleration of Fraud

A significant portion of the discussion focuses on how AI is already being operationalized by cybercriminals. This is not speculative or theoretical. According to Taylor, threat actors are actively:

• Using AI to design and test phishing campaigns

• Leveraging AI-driven tools to refine social-engineering techniques

• Experimenting with AI-powered search and automation within underground platforms

More concerning is the rise of deepfake-enabled fraud. The conversation outlines a near-term future where real-time voice and video impersonation—such as fake CEO calls during financial transactions—becomes commonplace. These attacks are convincing, scalable, and difficult to detect, particularly in organizations unprepared for identity-based deception.

As McGraw notes, defenders face an inherent disadvantage: ethical and operational constraints slow adoption, while criminals deploy new capabilities as soon as they work.

The Expanding Attack Surface Beyond the Dark Web

Another critical insight is that cybercriminal communication is no longer confined to traditional dark-web forums. Encrypted messaging platforms and mainstream social channels increasingly host conversations, coordination, and recruitment. End-to-end encryption protects privacy for legitimate users—but it also complicates law-enforcement efforts and enables criminal activity to blend into everyday digital spaces.

This migration further lowers barriers and broadens participation, especially among younger demographics.

Mentorship, Workforce Development, and Prevention

The episode closes by shifting from threat analysis to prevention. Both speakers emphasize that stopping cybercrime cannot rely solely on enforcement or technology. The growing involvement of young people in cybercriminal activity—drawn by economic incentives and accessibility—poses a long-term national and global challenge.

Taylor argues that mentorship, education, and inclusive career pathways are essential countermeasures. Providing legitimate opportunities, community support, and early intervention can redirect talent away from criminal ecosystems and toward defensive roles where skills are desperately needed.

Cybersecurity, in this framing, is not only a technical discipline—it is a human one, shaped by opportunity, community, and values.

A Business Problem, Not Just a Security Problem

The conversation makes one point unmistakably clear: cybercrime has matured into a business because the incentives support it. Combating it will require equally mature responses—combining threat intelligence, policy, technology, workforce development, and cross-sector collaboration.

Understanding the human dynamics behind cybercrime is no longer optional. It is foundational to any strategy that hopes to disrupt the business of cybercrime rather than merely react to it.