HP Inc. Monday released an HP Wolf Security Report, “The Evolution of Cybercrime: Why the Dark Web is Supercharging the Threat Landscape and How to Fight Back.” The findings show cybercrime is being supercharged through “plug and play” malware kits that make it easier than ever to launch attacks. Cyber syndicates are collaborating with amateur attackers to target businesses, putting online world at risk.
The HP Wolf Security threat team worked with Forensic Pathways, a leading group of global forensic professionals, on a three-month dark web investigation, scraping and analysing over 35 million cybercriminal marketplaces and forum posts to understand how cybercriminals operate, gain trust, and build reputation.
Some of the key findings of the report include the fact that malware is cheap and readily with over three quarters (76%) of malware advertisements listed, and 91% of exploits, (that is code that gives attackers control over systems by taking advantage of software bugs), retail for under ₦4,923.17. The average cost of compromised Remote Desktop Protocol credentials is just ₦2,092.35. Vendors are selling products in bundles, with plug-and-play malware kits, malware-as-a-service, tutorials, and mentoring services reducing the need for technical skills and experience to conduct complex, targeted attacks – in fact, just 2-3% of threat actors today are advanced coders.
The irony of ‘honor amongst cyber-thieves’ – Much like the legitimate online retail world, trust and reputation are ironically essential parts of cybercriminal commerce: 77% of cybercriminal marketplaces analysed require a vendor bond – a license to sell – which can cost up to ₦1,230,793. Eighty-five per cent of these use escrow payments, and 92% have a third-party dispute resolution service. Every marketplace provides vendor feedback scores. Cybercriminals also try to stay a step ahead of law enforcement by transferring reputation between websites – as the average lifespan of a dark net Tor website is only 55 days.
Popular software is giving cybercriminals a foot in the door – Cybercriminals are focusing on finding gaps in software that will allow them to get a foothold and take control of systems by targeting known bugs and vulnerabilities in popular software. Examples include the Windows operating system, Microsoft Office, web content management systems, and web and mail servers. Kits that exploit vulnerabilities in niche systems command the highest prices (typically ranging from ₦393,853.76 – ₦1,723,110.20). Zero Days (vulnerabilities that are not yet publicly known) are retailing at tens of thousands of dollars on dark web markets.
“Unfortunately, it’s never been easier to be a cybercriminal. Complex attacks previously required serious skills, knowledge and resource. Now the technology and training is available for the price of 3 litres of fuel. And whether it’s having your company and customer data exposed, deliveries delayed or even a hospital appointment cancelled, the explosion in cybercrime affects us all,” comments report author and Senior Malware Analyst at HP Inc, Alex Holland.
“At the heart of this is ransomware, which has created a new cybercriminal ecosystem rewarding smaller players with a slice of the profits. This is creating a cybercrime factory line, churning out attacks that can be very hard to defend against and putting the businesses we all rely on in the crosshairs,” Holland adds.
The Evolution of Cybercrime – The Evolution of Cybercrime: Why the Dark Web is Supercharging the Threat Landscape and How to Fight Back – an HP Wolf Security Report is based on findings from an independent study carried out by dark web investigation firm Forensic Pathways and commissioned by HP Wolf Security. The firm collected dark web marketplace listings using their automated crawlers that monitor content on the Tor network. Their Dark Search Engine tool has an index consisting of >35 million URLs of scraped data. The collected data was examined and validated by Forensic Pathway’s analysts. This report analyzed approximately 33,000 active websites across the dark web, including 5,502 forums and 6,529 marketplaces. Between February and April 2022, Forensic Pathways identified 17 recently active cybercrime marketplaces across the Tor network and 16 hacking forums across the Tor network and the web containing relevant listings that comprise the data set.
The report also includes threat telemetry from HP Wolf Security and research into the leaked communications of the Conti ransomware group.
Interviews with, and contributions from, a panel of cybersecurity experts including:
Senior Malware Analyst at HP Inc.,and report author, Alex Holland; Chief Information Security Officer at HP Inc., Joanna Burkey; Global Head of Security for Personal Systems at HP Inc., Dr. Ian Pratt; Chief Technologist for Security Research and Innovation at HP Labs, Boris Balacheff; HP Security Advisory Board member and CEO at Medsec , Justine Bone; senior lecturer of criminology at the University of Surrey, UK and authored expert on cybersecurity, Dr. Mike McGuire, and , HP Security Advisory Board member and Partner at Deloitte, Robert Masse.
