WeTheNorth: A New Canadian Dark Web Marketplace

This Summer, Insikt Group discovered a new Canada-focused darknet marketplace called WeTheNorth, a salute to the Toronto Raptors basketball team slogan. This localized criminal marketplace features a variety of illegal goods and services for sale, many of which pose a threat to local and global enterprises.

Insikt Group judges that with moderate confidence that WeTheNorth market was likely created to replace the now debunked The Canadian Headquarters, which shut down in July 2021.  Insikt Group’s Criminal Underground Team first discovered WeTheNorth in July 2021 in advertisements posted on open source forums such as Reddit. The new market appears similar in appearance to the now-debunked Empire market, Alpha Bay, and Torrez.  

What makes WeTheNorth unique is the lengths the administrators have gone to create a marketplace that is ostensibly geared toward protecting Canadian buyers and sellers and fostering a relatively safe place to complete transactions.

Their mission statement is “to provide a safe environment so that Canadians are able to purchase safely, scam-free and away from the street violence, drugs and other items that are more potent, cleaner and safer to use.”

The rules of the marketplace are geared towards reigning in what types of services can be sold, as well as being explicit about what is not allowed: sharing of third-party contact information, sales of weapons, and anything related to terrorism. 

Additional safeguards include mandatory two-factor authentication (2FA) for all vendors, when signing up users are given a unique token to protect their account, vendor fees are non-refundable to prevent scamming, and there are rules in place to prevent padding accounts with fake reviews. 

Like many darknet markets that operate in service of customers,  WeTheNorth offers 24/7 customer service in both English and French, and it’s open to anyone who uses the site. Vendors or buyers having trouble with the site can reach out and ask for assistance at any time, report technical issues, vendor problems, and scams. 

The types of transactions that occur on WeTheNorth are largely illegal and undermine any appearance of legitimacy. The most popular sales are drugs such as marijuana, cocaine, and party drugs, but WeTheNorth marketplace also allows the sale of digital products such as stolen credit cards, login credentials, accesses, software and hardware exploits, fraud tutorials, and more. 

Insikt Group researchers discovered issues with the policing and categorization of listings on WeTheNorth market. Many items are cross-posted and do not align with the category they are listed under. The administrator of the site, whose contact information is also associated with other darknet markets,  has not cracked down on cross-category posting and multiple listings, which could be an indicator that their attention is still focused elsewhere,  leaving WeTheNorth open to low-level drug sellers that wish to bypass market rules. 

WeTheNorth is a new Canadian dark web marketplace that appears to be hosting a semi-safe space for locals to sell illegal goods and services. There are strict rules in place and they have banned certain categories to help the site be more legitimate and not attract a certain clientele. 

Dark web markets like WeTheNorth serve as valuable sources of cyber threat intelligence for both private and public sector alike. Insikt Group has observed an increase in localized dark web markets and predicts with moderate confidence that criminal underground websites such as WeTheNorth will continue to increase as international criminals look to localize operations and avoid international law enforcement. As law enforcement cracks down on dark markets and threat actors move quickly to stand up replacement websites, it is imperative for information security teams to monitor these sources for fraud, theft, and targeting of employees, and be able to stop fraudsters and cybercriminals before they use these tools to move through the attack chain.  Recorded Future clients can access more information about WeTheNorth market and other darknet activity through Intelligence Cards in the Recorded Future platform.