Content material warning: Due to the character of a few of the actions we found, this sequence of articles accommodates content material that some readers might discover upsetting. This contains profanity and references to medication, drug dependancy, playing, pornography, violence, arson, and intercourse work. These references are textual solely and don’t embrace pictures or movies.<\/em><\/p>\n

Following on from the third chapter<\/a> of our five-part investigation into what cybercriminals do with their earnings<\/a>, we now study numerous types of enterprise and revenue era which can be, in threat-actor parlance, \u2018black\u2019 (unlawful).<\/p>\n

We acknowledge that legality can fluctuate relying on jurisdiction. Nevertheless, the breadth and depth of those actions are such that we’ve to categorize them in some way, and utilizing the risk actors\u2019 personal classes is a logical if imperfect alternative.<\/p>\n

Key findings of Half 4<\/h2>\n
\n
As in our earlier experiences, we recognized a variety of enterprise pursuits on this class (outright felony actions, dubbed \u2018black\u2019 on the boards)<\/li>\n
In some circumstances, the felony enterprise pursuits we found had been comparatively low-level: fraud, pyramid schemes, and faux items<\/li>\n
Nevertheless, different discussions appeared to narrate to extra severe felony exercise, together with counterfeit gold and foreign money, controlling prostitution, cultivating marijuana, tax evasion, and insider buying and selling<\/li>\n
We additionally famous that reinvesting in cybercrime could be a sexy possibility for risk actors with cash to spend. We noticed a number of funding alternatives and proposals referring to cybercrime<\/li>\n
In some circumstances, discussion board discussions revealed info and pictures that might doubtlessly be used to trace, geolocate, and\/or establish risk actors.<\/li>\n<\/ul>\n
Fraud and theft<\/h2>\n
Bots<\/h3>\n
We noticed a low-level fraud scheme involving the creation of a number of accounts to carry out \u201cduties\u201d beneath a distinguished firm\u2019s rewards program. The risk actor suggested utilizing an \u201cautomation extension\u201d to carry out the duties, and redeeming the earnings as reward playing cards. In addition they supplied recommendation on avoiding the detection of a number of accounts.<\/p>\n
Pyramid schemes<\/h3>\n
We noticed a number of threads referring to pyramid schemes and scams, together with:<\/p>\n
\n
\u201cA outstanding approach that lets you earn a considerable 3% curiosity per day in your base quantity\u2026the complete funding and withdrawal course of is carried out in USDT [the Tether stablecoin]\u2026doubtlessly permitting you to maintain your earnings with out the burden of taxes\u201d<\/li>\n
An funding alternative in a pyramid scheme (i.e., to assist function the scheme, not an try to sucker discussion board customers into it)<\/li>\n
A number of makes an attempt to truly sucker discussion board customers into pyramid schemes\/multilevel advertising applications \u2013 one \u201cwithin the on-line coaching area of interest,\u201d one other that the advertiser famous was \u201ca well-known pyramid\u2026but it surely actually works,\u201d and an old style get-rich-quick scheme.<\/li>\n<\/ul>\n
$\"A$ <\/a><\/p>\n
Determine 1: A risk actor tries to recruit different customers to an \u201cassociates program\u2026[for] anybody who desires to generate income promoting well-liked academic merchandise\u201d<\/em><\/p>\n
Artificial identities<\/h3>\nWe famous a number of guides on creating \u2018CPNs\u2019 (Credit score Privateness Numbers) to ascertain artificial identities<\/a> (typically often known as \u2018ghosts\u2019) to use for loans and bank cards, purchase automobiles, and launder cash \u2013 or to promote to folks as a part of fraud campaigns.<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 2: A part of an in depth information on CPNs on a felony discussion board<\/em><\/p>\n
Refunds<\/h3>\n
One risk actor described a low-level scheme to fraudulently declare refunds from sports activities attire firms, by claiming that deliveries didn’t arrive. The consumer outlined the scheme, offering recommendation on:<\/p>\n
\n
The way to behave on the location when ordering<\/li>\n
The optimum worth of products to order<\/li>\n
The way to report the \u2018failed\u2019 supply<\/li>\n
The way to socially engineer buyer assist staff<\/li>\n
The way to combine authentic and fraudulent orders to keep away from \u201cburning\u201d your handle and account.<\/li>\n<\/ul>\n
$\"A$ <\/a><\/p>\n
Determine 3: A risk actor outlines a low-level refund rip-off<\/em><\/p>\n
Categorized adverts<\/h3>\n
One other risk actor supplied a information to a low-level rip-off on Avito (a Russian labeled adverts market), whereby customers submit fraudulent listings, obtain cash from a purchaser, however don’t ship the merchandise and as an alternative get the customer banned from the platform. The submit contains recommendation on the scheme, the right way to create a sexy itemizing, and the right way to set a worth.<\/p>\n
Intercourse work<\/h2>\n
Laundering<\/h3>\n
In a thread itemizing a number of concepts for cash laundering, a risk actor urged: \u201cRecruit (actual or pretend) escorts to ship you money of your individual cash after they declared their \u2018revenue\u2019 from intercourse work\u2026the prostitute concept is within the Canadian context since prostitution is authorized to promote, not purchase.\u201d One other concept from the identical consumer: \u201cFaux you’re a hooker your self.\u201d<\/p>\n
In an analogous vein, a consumer claiming to be from Australia famous in one other thread that since prostitution is authorized there, that they had the concept of \u201cpretending to be an escort to scrub money.\u201d<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 4: A risk actor proposes pretending to be a male escort to launder cash<\/em><\/p>\n
Controlling prostitution<\/h3>\n
A risk actor urged making a \u201cjob web site for escort women\u201d \u2013 the place \u201csevere escort businesses\u2026even brothels\u201d can join with \u201cwomen who wish to go to enterprise, however there is no such thing as a ticket there for the prepare from the village or for the airplane to Dubai or anything.\u201d<\/p>\n
Some customers picked minor holes on this plan (rivals, difficulties in promoting visitors to the location), with one arguing: \u201cWhy such a problem, if you happen to actually wish to do pussy, you make webcam studios.\u201d<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 5: A risk actor proposes making a \u201cjob web site for escort women,\u201d sparking a protracted dialogue about intercourse work<\/em><\/p>\n
One consumer stated: \u201cI’ve the chance to arrange my very own brothel in Sochi\u2026the Sochi cops are negotiable and gained\u2019t take very a lot\u2026However it’s important to make investments a ton.\u201d<\/p>\n
In the identical thread, we additionally noticed the next disturbing remark:<\/p>\n
\n
The ladies will have to be trampled down, instilled in them with the concept that they’re no one and nothing and solely beneath your safety can they in some way earn one thing. This can be particularly evident within the prostitution enterprise, the place the best and most conventional manner of controlling feminine staff is to make them drug dependent.<\/p>\n<\/blockquote>\n
Stolen and counterfeit items<\/h2>\n
Counterfeit gold<\/h3>\n
A risk actor sought a enterprise companion with \u201can energetic eBay vendor account\u201d as a result of they \u201chave a big provide of counterfeit gold and have been promoting it\u2026the issue is\u2026opening up new accounts.\u201d<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 6: A risk actor seeks assist promoting \u201ca big provide of counterfeit gold,\u201d which they declare to have already been doing for some time<\/em><\/p>\n
Pretend items<\/h3>\n
A risk actor sought recommendation on the right way to pretend the nation of origin for cheaply purchased Chinese language items that they deliberate to promote on-line. Alongside comparable strains, we famous a scheme to create a web-based store and \u201cpromote excessive class fakes.\u201d Different customers suggested them to \u201cattempt to undergo moderation of merch as second hand\u2026they won’t ask for invoices.\u201d The identical consumer supplied in depth element on their very own experiences.<\/p>\n
Historic artifacts<\/h3>\n
In by far probably the most weird thread we found, a risk actor claimed to have \u201cdiscovered some pharaonic and coptic monuments [i.e., Ancient Egyptian artifacts]\u2026solely two folks find out about its location. We wish to promote it, however we don\u2019t know the way\u2026to deal with the cargo and the proper place to promote in an public sale (black market).\u201d The consumer uploaded two photographs of what gave the impression to be a sarcophagus mendacity on bubble wrap.<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 7: A risk actor claims to have \u201csome pharaonic and coptic [sic] monuments\u201d that they wish to \u201cpromote in an public sale (black market)\u201d<\/em><\/p>\n
Some customers expressed curiosity in buying; others beneficial technique of verifying age\/authenticity. One consumer claimed that that they had been to Egypt for the same job and will put the sellers in contact with a authentic purchaser \u201cwho will purchase it instantly after his knowledgeable confirms.\u201d<\/p>\n
Medication<\/h2>\nHashish<\/h3>\n
One risk actor said that \u201cwe’ve direct enterprise relations with an American firm that legally grows and sells marijuana within the US.\u201d The consumer famous that the enterprise is in search of lead turbines and buyers, with lead turbines getting 10% of revenue (\u201crevenue is often $1000-$4000 per day\u201d).<\/p>\n
We additionally noticed a information on the right way to develop 25kg of hashish in 4 months. The consumer outlined prices, together with $7,000 for hydroponics, $1,500 for fertilizer, $12,000 to hire a home, and $1,700 a month for lighting. \u201cThe typical price of 25 kilograms of excellent grass wholesale is $50,000\u2026promoting is straightforward and protected\u2026by no means fascinating to the cops \u2013 in court docket you’ll have to show the actual fact of the sale.\u201d<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 8: A risk actor posts a tutorial on rising hashish, the gear wanted, and expenditure<\/em><\/p>\n
Medication and carders<\/h3>\nAs famous in the primary article<\/a> on this sequence, we famous an admission from a risk actor that they’ve given cocaine and capsules to cybercriminals, in change for stolen bank card particulars.<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 9: A felony discussion board consumer admits to giving cybercriminals \u201ccocaine or capsules\u201d in change for stolen bank card particulars<\/em><\/p>\n
Tax evasion<\/h2>\n
We noticed an in depth dialogue on tax evasion strategies, together with particular steerage on tax evasion versus cash laundering; utilizing \u201ca corrupt, overseas financial institution\u201d versus false reporting; hiring \u201cspecialised attorneys\u201d and extra.<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 10: A part of an in depth dialogue on tax evasion on a felony discussion board<\/em><\/p>\n
Insider buying and selling<\/h2>\n
One risk actor claimed to have an insider in a distinguished know-how agency, who beneficial investing huge cash after \u201cthe corporate made some main modifications\u2026they need to double their inventory worth in 12-16 months.\u201d<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 11: A risk actor claims to have an insider inside a distinguished know-how firm<\/em><\/p>\n
One other risk actor suggested others \u201cto not gamble on the inventory market\u2026getting inside data is the one manner\u2026if hacking teams give a heads up on which firm\u2019s paperwork they\u2019re going to leak you should purchase put contracts on the corporate and revenue on inventory taking place.\u201d<\/p>\n
In the identical vein, one other consumer requested about shorting shares of firms affected by ransomware assaults, and puzzled if ransomware operators have thought-about doing this. Most customers stated this was viable, though others had been extra uncertain (\u201cYou’ll appeal to regulatory authorities for insider buying and selling\u201d).<\/p>\n
In the identical thread, risk actors additionally mentioned different varieties of assault (DDoS and web site defacements), together with their attainable impacts on inventory worth and whether or not it will be price shorting the inventory. A consumer urged utilizing web optimization, deepfakes, and AI-generated articles to drive down the inventory costs of attacked firms additional.<\/p>\n
On one other thread, a risk actor claimed to \u201cpromote insider info effectively prematurely of the massive strikes out there for some cryptocurrencies. I often work with funding firms, however a few of you could have an honest quantity of cryptocurrencies, and I consider that I may be of nice assist to you.\u201d<\/p>\n
Reinvesting in cybercrime<\/h2>\n
Throughout our analysis, we famous many risk actors asking their friends what they need to make investments their cash in, and replies comparable to \u201cmake investments it within the enterprise that introduced you this revenue. It\u2019s apparent.\u201d Reinvesting in cybercrime could also be engaging to risk actors who’ve \u2018paid their dues\u2019 and profited \u2013 they will spend money on a brand new mission in a well-recognized discipline, and reap the rewards whereas being uncovered to much less threat.<\/p>\n
Malware and phishing<\/h3>\n
We noticed a number of funding alternatives in in-progress\/in-development malware and campaigns, together with an funding alternative ($1,000-2,000) in an Android botnet, with the flexibility to steal bank card data, spam contacts, ahead incoming calls, launch customized apps, and intercept incoming SMS messages. A screenshot was included.<\/p>\n
We additionally famous:<\/p>\n
\n
An funding alternative ($3,000-5,000) to open a retailer for botnet logs (i.e., stolen information from infostealers)<\/li>\n
An funding alternative ($5,000) in a Telegram phishing instrument\/marketing campaign<\/li>\n
A imprecise proposal referring to an MT103 (a protocol utilized in SWIFT) staging server (\u201cI’m in search of cooperation with a darkish internet developer\u2026we’ve a deal for 10 million {dollars}\u201d).<\/li>\n<\/ul>\n
$\"A$ <\/a><\/p>\n
Determine 12: A risk actor seeks funding to create their very own \u201cbotnet logs retailer\u201d<\/em><\/p>\n
$\"A$ <\/a><\/p>\n
Determine 13: A screenshot of a Telegram phishing platform, included as a part of a pitch to potential buyers on a felony discussion board<\/em><\/p>\n
DDoS<\/h3>\n
We noticed a chance (ROI: 30% of revenue) to spend money on a year-old DDoS-related mission (the consumer insisted that this was not a rip-off, pointing to their fame and lack of arbitration complaints, and the truth that they had been keen to debate circumstances privately).<\/p>\n
SIM-swapping<\/h3>\n
We noticed an funding alternative (ROI: 20% of every cashout) in sim-swapping. \u201cI’ve crypto logins and financial institution logins with cash, my final step is sim-swapping.\u201d<\/p>\n
Crowdfunding<\/h3>\n
One risk actor proposed launching a crowdfunding platform on Tor \u201cfor gray\/black matters.\u201d Different customers gave the impression to be eager in precept, however famous that the platform would wish to each guarantee anonymity and forestall scams. One consumer urged sensible contracts as a attainable resolution.<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 14: A risk actor proposes a \u201cdarknet\u201d crowdfunding platform for felony actions, likening the precept to Kickstarter<\/em><\/p>\n
Counterfeit foreign money<\/h2>\n
A risk actor proposed a scheme whereby they would offer different customers with counterfeit US foreign money to launder, earlier than giving the OP a share. The OP urged $400 (4 $100 payments) to begin, later rising to hundreds. The counterfeit payments allegedly had a number of serial numbers, watermarks, safety strips, optically variable ink, and handed the \u201cpen check\u201d (a technique to detect counterfeit payments through a particular ink), however didn’t work in ATMs and wanted to be aged and handled earlier than use.<\/p>\n
One other consumer outlined a plan for counterfeit payments, and supplied particulars on their digital and bodily OPSEC measures. The latter included:<\/p>\n
\n
By no means utilizing the payments in retail shops, solely at bodily meet-ups (e.g., Craigslist transactions)<\/li>\n
Going from metropolis to metropolis<\/li>\n
By no means utilizing cash for trivial issues like inns, meals, fuel<\/li>\n
Promoting the illicitly acquired objects in several nations<\/li>\n<\/ul>\n
$\"A$ <\/a><\/p>\n
Determine 15: A risk actor goes into vital element concerning their plan to distribute counterfeit payments<\/em><\/p>\n
Potential assault<\/h2>\n
Lastly, we noticed a very disturbing thread, though it was (in all probability intentionally) very imprecise. A risk actor requested the cryptic query: \u201cHas anybody encountered or maybe heard of individuals being intimidated by voices? An individual is combined with some substance after which he begins to have extreme issues.\u201d<\/p>\n
$\"A$ <\/a><\/p>\n
Determine 16: A risk actor posts an uncommon query on a felony discussion board<\/em><\/p>\n
One other consumer responded:<\/p>\n
\n
You need to use a \u2018fact serum\u2019 (scopolamine or analogues, accessible on the darknet)\u2026the individual himself will quit all the things and let you know all the things. In actual life, I noticed a profitable theft utilizing scopolamine, the person did all the things he was requested to do \u2013 he took the paperwork and laptop computer out of the home, he withdrew cash from the ATM, he himself entered passwords in banking. Watch out about dosing.<\/p>\n<\/blockquote>\n
Scopolamine (prescribed to handle, amongst different issues, nausea and vomiting attributable to movement illness or surgical anesthesia) is thought to have been used for theft<\/a>, and allegedly additionally to facilitate kidnappings and sexual assaults<\/a>.<\/p>\n
Over the previous 4 articles, we\u2019ve explored a wide selection of enterprise pursuits, starting from the innocuous (digitizing VHS tapes and making a cell health app) to the downright felony (curiosity in working a brothel, counterfeit payments, rising hashish) and just about all the things in between. However what does this imply for the cybersecurity trade, regulation enforcement, and society as an entire?<\/p>\n
Within the concluding chapter<\/a> of this sequence, we\u2019ll study the implications, challenges, and alternatives of risk actors transferring past the cyber kill chain.<\/p>\n<\/p><\/div>\n\n","protected":false},"excerpt":{"rendered":"
Content material warning: Due to the character of a few of the actions we found, this sequence of articles accommodates content material that some readers might discover upsetting. This contains profanity and references to medication, drug dependancy, playing, pornography, violence, arson, and intercourse work. These references are textual solely and don’t embrace pictures or movies. […]<\/p>\n","protected":false},"author":2,"featured_media":3107,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[209,2245,121,668,120],"class_list":["post-3105","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybercriminals","tag-money","tag-news","tag-part","tag-sophos"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/3105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3105"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/3105\/revisions"}],"predecessor-version":[{"id":3106,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/3105\/revisions\/3106"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/3107"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3105"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3105"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Fraud and theft<\/h2>\n

Intercourse work<\/h2>\n

Stolen and counterfeit items<\/h2>\n

Counterfeit gold<\/h3>\nA risk actor sought a enterprise companion with \u201can energetic eBay vendor account\u201d as a result of they \u201chave a big provide of counterfeit gold and have been promoting it\u2026the issue is\u2026opening up new accounts.\u201d<\/p>\n

SIM-swapping<\/h3>\nWe noticed an funding alternative (ROI: 20% of every cashout) in sim-swapping. \u201cI’ve crypto logins and financial institution logins with cash, my final step is sim-swapping.\u201d<\/p>\n

SIM-swapping<\/h3>\n
We noticed an funding alternative (ROI: 20% of every cashout) in sim-swapping. \u201cI’ve crypto logins and financial institution logins with cash, my final step is sim-swapping.\u201d<\/p>\n