3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
Hansa Market

Hansa Market

ID: 18f38007daf653aba9eff0fc1faa1d4e82424
Darkweb Market/Service Counterfeit Documents
Threat types: Fake IDs, Passports, KYC Bypass
Unknown UNKNOWN
Updated: 2026-02-18
Created: 2025-10-24
Progress: 64% Completeness: 61% Freshness: 70%
Operation zone: UNKNOWN
Aliases Limited alias preview
No aliases registered.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

Hansa Market was a Tor hidden-service darknet marketplace enabling illicit trade. It was covertly taken over and then seized in July 2017 during Operation Bayonet. This mapping reflects platform enablement behaviors (anonymization/encryption) rather than a discrete intrusion actor.


Technique Technique name Tactics Evidence
T1090 Proxy TA0011
  • 2017-07-20 — Hansa described as operating as a Tor hidden service, implying proxy/anonymization infrastructure use. · ref
  • 2017-07-20 — Coordinated takedown of darknet markets (Hansa/AlphaBay) described by Europol; darknet markets commonly operated over Tor. · ref
T1573 Encrypted Channel TA0011
  • 2018-03-08 — Reporting describes PGP-encrypted messaging between users and platform-side handling prior to encryption during undercover control. · ref
Strategic Intelligence
Limited preview
Last updated: 2026-02-18T18:55:53+00:00

Hansa Market — Darknet marketplace (Tor hidden service) seized in Operation Bayonet

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for Decision Makers — Hansa Market

Classification: Unclassified / OSINT — TLP:WHITE

Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — Hansa Market (Darknet Marketplace Enablement Patterns)

Priority: MEDIUM (ecosystem monitoring). Hansa Market is offline (seized 2017), but the underlying patterns—darknet marketplace exposure, credential reuse, and illicit supply-chain enablement—remain relevant for fraud, insider risk, and data-leak response.

Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-02-18T18:51:05+00:00

IOC Appendix (TLP:WHITE) — Hansa Market

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-02-18T18:54:12+00:00

OSINT Library — Hansa Market


2017-07-20 — Europol — “Massive blow to criminal Dark Web activities after globally coordinated operation”

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/0
No social links registered for this profile.
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
No images found for this threat.