China's National Computer Virus Emergency Response Center has published the Dark Web Monitoring 2025 Annual Report, compiled jointly by 17 organizations including regulators, universities, critical infrastructure operators, and security vendors. The report draws on dynamic monitoring of more than 100,000 dark web nodes and records 1.01 million threat incidents, providing one of the largest datasets of its kind.
The most striking finding is the August 2025 launch of DarkAgent V3.0, the first commercial AI attack agent offered for sale on dark web marketplaces. Powered by multimodal large language models and autonomous planning capabilities, the tool executes the entire attack lifecycle—asset mapping, vulnerability discovery, WAF evasion, exploitation, and data theft—without human intervention.
Performance data shows that tasks previously requiring two weeks of skilled red-team effort now complete in an average of 2.8 days, shortening the attack chain by approximately 85 percent. The report describes this development as “attack democratization,” lowering the barrier so that even operators with minimal technical skills can launch sophisticated campaigns previously reserved for professional teams.
Defense implications are severe because DarkAgent V3.0 adapts dynamically to each target environment, generating unique behaviors that defeat signature-based detection. Traditional attack-pattern libraries compiled over years may require wholesale revision.
The report also documents a December 2025 breach at the European Space Agency in which roughly 700 GB of sensitive data—including low-Earth-orbit satellite telemetry parameters, aerospace protocol specifications, and supplier contracts—were stolen and later traded on dark web forums. Attackers reached core systems by compromising a third-party software vendor, illustrating a complete supply-chain loop: vendor compromise, core-asset exfiltration, dark-web dissemination, and subsequent targeted operations by multiple APT groups.
Additional findings indicate growing convergence between dark-web criminal services and state-sponsored operations. AI tooling now allows nation-state actors to outsource penetration tasks, complicating attribution. Early research tools targeting post-quantum cryptography have also appeared for pre-sale, underscoring that cryptographic migration planning can no longer be deferred.
