Story image

Cybercrime industry raking in $1.5 trillion profit - most from online markets

23 Apr 2018

How much are cybercriminals earning for their efforts? A new study by Bromium suggests that figure could be as much as US$2 million per job for those who are cybercriminal platform owners – although individual hackers can still walk away with US$30,000 per year.

The resulting cybercrime industry may be raking in as much as $1.5 trillion worth of illicit profits that are being acquired, laundered, spent, and reinvested. The industry is now an ‘interconnected Web of Profit’ – a self-sustaining system.

The study, conducted by the University of Surrey’s senior lecturer in criminology, Dr Michael McGuire, is based on conversations from the UK’s GHCQ, the US FBI, Europol, global financial institutions, and even covert security workers who infiltrated the dark web.

Illicit and illegal online markets make up the bulk of the $1.5 trillion economy ($860) billion; theft of trade secrets and IP is worth $500 billion; data trading is worth $160 billion; crimeware-as-a-service is worth $1.6 billion; and despite its prevalence, ransomware is only worth $1 billion.

McGuire calls cybercrime an economy: “A hyper-connected range of economic agents, economic relationships and other factors now capable of generating, supporting, and maintaining criminal revenues at an unprecedented scale.”

Cybercriminal platform owners will take the biggest share of the cybercrime actions. Managers can earn up to $2 million just with 50 stolen card details.

‘Platform capitalism’ has now extended beyond legitimate companies like Facebook and Amazon, and has now filtered down to the dark web to create the ‘Web of Profit’.

Bromium CEO Gregory Webb adds that the lines between criminal and ‘legitimate’ worlds are now blurring.

“We are no longer simply dealing with ‘hackers in hoodies.’ We have to understand and tackle the underlying economic ecosystem that enables, funds and supports criminal activity on a global scale to stem the tide and better protect ourselves. By better understanding the systems that support cybercrime, the security community can better understand how to disrupt and stop them. New approaches to cybersecurity will be required,” Webb says.

Individual services and products available on the dark web include:

·       Zero-day Adobe exploits, up to $30,000

·       Zero-day iOS exploit, $250,000

·       Malware exploit kit, $200-$600 per exploit

·       Blackhole exploit kit, $700 for a month’s leasing, or $1,500 for a year

·       Custom spyware, $200

·       SMS spoofing service, $20 per month

·       Hacker for hire, around $200 for a “small” hack

McGuire found a number of criminal sites offering ratings, descriptions, reviews, services, and customer support – all of which improve the criminal customer experience.

Advertising is also a core revenue generator -  before being taken down in 2016, the ‘Kickass Torrents’ platform was worth over $54 million, with estimated $12.5-$22.3 million annually in ad revenue alone, the report says.

Dark web market AlphaBay was one of the dark web’s biggest online crime markets before it was taken down. The platform not only included cybercrime tools, but also illicit substances, firearms, counterfeit goods, and toxic chemicals.

“We can clearly link cybercrime to the spread of new psychoactive substances with over 620 new synthetic drug types on the market since 2005. Many substances of this kind are manufactured in China or India, purchased via online markets, then shipped in bulk to Europe,” McGuire notes.

Platform criminality is also contributing to human trafficking, the report suggests.

“Pimps frequently use the internet as a tool for gathering revenues from clients and workers, and then recycle this back into the logistics (and costs) of trafficking victims from target locations with economically vulnerable populations,” McGuire concludes.

Nuance biometrics fight back against fraud
Nuance Communications has crunched the numbers and discovered that it has prevented more than US$1 billion worth of fraud from being passed on to users of its Nuance Security Suite.
Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.
Developing APAC countries most vulnerable to malware - Microsoft
“As cyberattacks continue to increase in frequency and sophistication, understanding prevalent cyberthreats and how to limit their impact has become an imperative.”
Worldwide spending on security to reach $103.1bil in 2019 - IDC
Managed security services will be the largest technology category in 2019.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Norwegian aluminium manufacturer hit hard by LockerGoga ransomware attack
“IT systems in most business areas are impacted and Hydro is switching to manual operations as far as possible.”
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.