The dark web constitutes a stratified, operationally sophisticated cybercrime ecosystem whose threat dynamics are shaped by layered anonymity infrastructure, AI-augmented criminal tooling, and resilient financial obfuscation mechanisms. While existing literature provides valuable but fragmented analysis of individual components, few studies integrate these elements within a unified analytical framework. This paper addresses that gap through a hybrid analytical survey approach, advancing four primary contributions: (1) a six-dimension taxonomic model differentiating surface web, deep web, and dark web environments; (2) a Five-Layer Dark Web Threat Ecosystem Model characterising the functional architecture of criminal infrastructure; (3) a structured capability taxonomy of AI-augmented criminal tools (Dark LLMs); and (4) a proposed Cyber Threat Intelligence (CTI) extraction pipeline for dark web environments. Drawing on peer-reviewed literature spanning 2020–2025, operational intelligence from Europol IOCTA, Chainalysis Crypto Crime Reports, and FBI IC3 data, and documented threat actor behaviour, the paper analyses ransomware-as-a-service dynamics, cryptocurrency financial obfuscation, law enforcement response limitations, and post-Tor architectural evolution. Persistent research gaps in multilingual CTI extraction, post-Tor forensic methodology, and AI-threat detection are identified, with a structured research agenda proposed.