Booming cybercrime economy sucks in recruits

Eastern European milk run


The underground economy is booming even as the rest of the economy lurches towards recession, according to a new study by Symantec.

The net security giant reports that the cybercrime economy has grown into an efficient, global marketplace to handle the trade in stolen goods and fraud-related services. It estimates the combined value of goods in underground forums at $276m for the 12 months prior to the end of June 2008.

Credit card data made up nearly a third (31 per cent) of the advertised sales logged, recorded the Symantec study. Purloined credit card numbers sold for between $0.10 to $25 per card, with the average advertised stolen credit card limit coming in at around $4,000. Credit card information is often sold to fraudsters in job lots, with discounts for large purchases.

Login details for online accounts were the subject of one in five sales and the second most commonly offered commodity in underground crooks bazaars. Stolen login details were offered for anything between $10 and $1,000, depending on the balance and location of compromised accounts. The average balance of these accounts was around 40,000.

Other items up for sale included email accounts and pirated computer games or application software.

Online currency accounts were by far most popular method of payment, used to settle 63 percent of the sales monitored by Symantec.

During the 12 month period it spied on underground forums, Symantec spotted 69,130 advertisers. Between these sellers and buyers a total 44,321,095 messages were posted to underground forums. The 10 most active advertisers collectively offered up stolen $16.3m worth of stolen credit card details and $2m in purloined login credentials. A mixture of loosely connected individuals and organised groups are involved in the illicit trade, Symantec reports.

Advertisers use techniques such as multi-coloured text, capitalising certain words and repeated sales pitches to help their sales offers to stand out from the crowd. Sometimes sellers post requests for particular goods and services, such as credit cards from a named country, Symantec adds. Crooks, who drain millions from the legitimate economy, commonly reinvest the profits from successful scams into other ever-more elaborate grifts.

Underground forums provide a thriving marketplace for all forms of hacking tools and service. Botnets - networks of compromised PCs - sold for an average of $225. Phishing scam hosting services cost anything between $2 and $80. Keystroke logger prices came in at around $23.

Site-specific exploits of financial sites fetched far more money, with an average price tag of $740, and prices ranging from $100 to $2,999.

Cybercrooks have developed sophisticated business models such that recognised job roles and specialisms have evolved in the "recession proof" digital underground. These roles, and job descriptions as defined by Syamntec, include:

  • Trojan creators – high quality malicious code writers wanted
  • Web exploiters – talented infectors sought
  • Exploit experts - tech geeks, programmers and researchers required
  • Traffic sellers - confident sales people required to market traffic
  • Fraudsters – ambitious, well connected crooks required to steal data
  • Outsourced rogue hosting companies – industry knowledge essential, must appear legitimate

Online fraudsters are making more use of outsourcing. Symantec found that organised crooks based in north America are using supplier in eastern Europe for goods and service including malware creation and ATM skimming kit.

The geographical location of cybercrime servers is constantly changed as crooks attempt to stay one step ahead of law enforcement efforts to shut them down. North America played host to 45 per cent of cybercrime servers, with Europe putting in a strong second place performance with 38 per cent of the total. Other crook-serving systems were scattered around the Asia-Pacific region (12 per cent) and Latin America (five per cent).

A summary of Symantec's study can be found here. The full report is here. ®

Broader topics


Other stories you might like

  • Symantec: More malware operators moving in to exploit Follina
    Meanwhile Microsoft still hasn't patched the fatal flaw

    While enterprises are still waiting for Microsoft to issue a fix for the critical "Follina" vulnerability in Windows, yet more malware operators are moving in to exploit it.

    Microsoft late last month acknowledged the remote code execution (RCE) vulnerability – tracked as CVE-2022-30190 – but has yet to deliver a patch for it. The company has outlined workarounds that can be used until a fix becomes available.

    In the meantime, reports of active exploits of the flaw continue to surface. Analysts with Proofpoint's Threat Insight team earlier this month tweeted about a phishing campaign, possibly aligned with a nation-state targeting US and European Union agencies, which uses Follina. The Proofpoint researchers said the malicious spam messages were sent to fewer than 10 Proofpoint product users.

    Continue reading
  • Voicemail phishing emails steal Microsoft credentials
    As always, check that O365 login page is actually O365

    Someone is trying to steal people's Microsoft 365 and Outlook credentials by sending them phishing emails disguised as voicemail notifications.

    This email campaign was detected in May and is ongoing, according to researchers at Zscaler's ThreatLabz, and is similar to phishing messages sent a couple of years ago.

    This latest wave is aimed at US entities in a broad array of sectors, including software security, security solution providers, the military, healthcare and pharmaceuticals, and the manufacturing and shipping supply chain, the researchers wrote this month.

    Continue reading
  • Emotet malware gang re-emerges with Chrome-based credit card heistware
    Crimeware groups are re-inventing themselves

    The criminals behind the Emotet botnet – which rose to fame as a banking trojan before evolving into spamming and malware delivery – are now using it to target credit card information stored in the Chrome web browser.

    Once the data – including the user's name, the card's numbers and expiration information – is exfiltrated, the malware will send it to command-and-control (C2) servers that are different than the one that the card stealer module uses, according to researchers with cybersecurity vendor Proofpoint's Threat Insight team.

    The new card information module is the latest illustration of Emotet's Lazarus-like return. It's been more than a year since Europol and law enforcement from countries including the United States, the UK and Ukraine tore down the Emotet actors' infrastructure in January 2021 and – they hoped – put the malware threat to rest.

    Continue reading
  • Zscaler bulks up AI, cloud, IoT in its zero-trust systems
    Focus emerges on workload security during its Zenith 2022 shindig

    Zscaler is growing the machine-learning capabilities of its zero-trust platform and expanding it into the public cloud and network edge, CEO Jay Chaudhry told devotees at a conference in Las Vegas today.

    Along with the AI advancements, Zscaler at its Zenith 2022 show in Sin City also announced greater integration of its technologies with Amazon Web Services, and a security management offering designed to enable infosec teams and developers to better detect risks in cloud-native applications.

    In addition, the biz also is putting a focus on the Internet of Things (IoT) and operational technology (OT) control systems as it addresses the security side of the network edge. Zscaler, for those not aware, makes products that securely connect devices, networks, and backend systems together, and provides the monitoring, controls, and cloud services an organization might need to manage all that.

    Continue reading
  • Now Windows Follina zero-day exploited to infect PCs with Qbot
    Data-stealing malware also paired with Black Basta ransomware gang

    Miscreants are reportedly exploiting the recently disclosed critical Windows Follina zero-day flaw to infect PCs with Qbot, thus aggressively expanding their reach.

    The bot's operators are also working with the Black Basta gang to spread ransomware in yet another partnership in the underground world of cyber-crime, it is claimed.

    This combination of Follina exploitation and its use to extort organizations makes the malware an even larger threat for enterprises. Qbot started off as a software nasty that raided people's online bank accounts, and evolved to snoop on user keystrokes and steal sensitive information from machines. It can also deliver other malware payloads, such as backdoors and ransomware, onto infected Windows systems, and forms a remote-controllable botnet.

    Continue reading
  • HelloXD ransomware bulked up with better encryption, nastier payload
    Russian-based group doubles the extortion by exfiltrating the corporate data before encrypting it.

    Windows and Linux systems are coming under attack by new variants of the HelloXD ransomware that includes stronger encryption, improved obfuscation and an additional payload that enables threat groups to modify compromised systems, exfiltrate files and execute commands.

    The new capabilities make the ransomware, first detected in November 2021 - and the developer behind it even more dangerous - according to researchers with Palo Alto Networks' Unit 42 threat intelligence group. Unit 42 said the HelloXD ransomware family is in its initial stages but it's working to track down the author.

    "While the ransomware functionality is nothing new, during our research, following the lines, we found out the ransomware is most likely developed by a threat actor named x4k," the researchers wrote in a blog post.

    Continue reading
  • AMD targeted by RansomHouse, attackers claim to have '450Gb' in stolen data
    Relative cybercrime newbies not clear on whether they're alleging to have gigabits or gigabytes of chip biz files

    If claims hold true, AMD has been targeted by the extortion group RansomHouse, which says it is sitting on a trove of data stolen from the processor designer following an alleged security breach earlier this year.

    RansomHouse says it obtained the files from an intrusion into AMD's network on January 5, 2022, and that this isn't material from a previous leak of its intellectual property.

    This relatively new crew also says it doesn't breach the security of systems itself, nor develop or use ransomware. Instead, it acts as a "mediator" between attackers and victims to ensure payment is made for purloined data.

    Continue reading

Biting the hand that feeds IT © 1998–2022