Shifts in the way online spaces are used and structured are influencing offender behaviour and enabling new forms of criminal activity. The increasing use of online platforms to facilitate daily living continues to expand the influence and role of online enablers in SOC. This is reducing barriers to offending and enhancing offender capabilities. 

Online criminality crosses international and jurisdictional boundaries, providing offenders with access to victims on a global scale. The international nexus of online offending, combined with obfuscation and encryption in online environments, creates difficulties determining the origin and scale of SOC threats. It is increasingly difficult to determine whether offenders are operating individually, in loosely or highly organised groups, or occasionally as state-proxies.

The audience reach, accessibility, perceived anonymity, and abundance of information available online makes popular online networking and communication platforms attractive to offenders, providing an ideal medium for: 

• victim identification and targeting; 
• advertising illicit goods and services; and
• offender networking, research, planning, and upskilling.

Offenders demonstrate a sophisticated understanding of victim and customer targeting opportunities online. Typically, popular networking platforms act as the initial medium for identification and contact between offenders, victims, and/or customers. Further engagement often occurs via an application’s private chat function, or secure messaging applications, which are often end-to-end encrypted, and perceived to offer greater privacy and security.

It is likely that platform algorithms play a significant and increasing role in facilitating SOC. Algorithms increase reach by connecting audiences with criminal service providers, and radicalise and connect offenders through the reinforcement, normalisation, and signposting of harmful interests and behaviours.

Offenders employ tradecraft to obscure their online activities from law enforcement, such as the use of virtual private networks and other IP obfuscation technologies. Platforms with limited controls, particularly those that do not require identifiable data to register accounts, have weak or no moderation capabilities, and platforms that are based in challenging jurisdictions are also attractive to offenders seeking to obscure their activities from law enforcement.

Tor remains the primary system used by offenders in 2025 to access the dark web, which is used to buy and sell illicit goods and services, for offender-offender networking, and viewing and exchanging child sexual abuse material. It is highly likely that Tor use by offenders has decreased in 2025, with the enhanced accessibility and functionality of clear web platforms driving a reduction in offender reliance on the dark web. Many clear web platforms now have end-to-end encryption as standard, require less technical knowledge to access and use, are more stable, and are used legitimately by millions.

Online Advertisements and Criminal Marketplaces

Illicit online marketplaces and advertisements on both the clear and dark web continue to facilitate the purchase of individual and wholesale quantities of illicit goods and services, increasing the profitability of organised crime group operations through the expansion of audience reach. Offenders demonstrate a good understanding of how to maximise platform features to increase audience engagement and sales. 

It is likely that social media enabled the facilitation of at least 33,000 irregular migrants entering the UK via small boats in 2025. An estimated 80% of migrants facilitated via small boats used social media to locate an agent or communicate with an agent working as part of an organised crime group at some stage in their journey. Organised immigration crime facilitators and fraudulent document suppliers use online platforms to provide further instructions, such as tactics to avoid detection, logistics, transport details, and meeting points for migrants.

It is likely that online adverts and marketplaces facilitate the sale of a growing proportion of illicit goods and services in line with wider societal trends in online purchasing. Illicit marketplaces continue to offer child sexual abuse material, drugs, firearms, and stolen goods. Illegal substances and prescription-only medication such as benzodiazepines, cannabis, cocaine, GHB, heroin, ketamine, methamphetamine, and opioids have all been identified for sale in online drugs marketplaces.

Cybercrime and fraud-enabling tools such as ransomware and malware strains, compromised credentials, stolen datasets, and phishing kits purchased from Tor marketplaces and clear web platforms, facilitate the financial exploitation of individuals and organisations. Adverts featuring fraud-enabling products are increasingly being identified on Telegram channels.

Online spaces also facilitate the advertisement of services of victims of modern slavery and human trafficking, particularly adult services websites, which enable sexual exploitation. 

Offender Networking and Upskilling

Online spaces encourage like-minded individuals to identify and connect with each other. This is exploited by offenders to create spaces dedicated to illegal shared interests such as child sexual abuse, which highly likely contributes to the normalisation of sexual offending against children and encourages offending. 

Networking and communication platforms enhance offender capabilities through the online crowdsourcing of knowledge and tradecraft. Clear and dark web networking sites, message boards, and forums facilitate offender networking and upskilling across SOC, enabling a small number of capable and influential offenders to cause disproportionate harm. These offenders use their technical knowledge and capabilities to offend, and either share their knowledge or provide their services to other offenders. This accelerates the pace of uptake, adaptation, and innovation in SOC offending, and encourages the convergence of offending across SOC threats.

Online platforms are used by offenders to portray ‘easy money’ and a glamorous lifestyle to recruit others into offending. Cash and other high-value items are displayed to entice individuals to engage in criminal activity such as county lines offending, drug and illicit cash smuggling, money muling, and violence-as-a-service.