Dark pathways into cybercrime: Minding the threat actor talent gap

Digital Shadows (now ReliaQuest) recently published two blogs looking at how threat actors express their personality on cybercriminal forums — either inadvertently or on purpose. In the first piece, we examined the role that gender and nationality play on these sites, discussing ways in which, for example, female threat actors might conceal their true gender to avoid attracting unwanted attention, and the coalescence of forum users around a common language and nationality identity. The second blog explored cybercriminals’ attitudes to morality and their qualms about their illicit activities, and how the personal circumstances and views of forum administrators may affect the success of a site. Thinking about the real-life individuals behind these forum usernames also raised the question of the role these sites play in threat actors’ development, and how they can help “turn” curious forum members into committed cybercriminals. 

As you might imagine, most cybercriminals are generally reluctant to allow many details of their personal lives to shine through. The examples we provided in the blogs mentioned above show that threat actors will occasionally allow personal information to slip through or raise an issue to obtain personal validation or comfort. But operational security (OPSEC) is always at the forefront of these individuals’ minds, and any expressions of personality mustn’t threaten to expose their real-life identities. For this reason, it’s hard to find concrete details of how threat actors honed their craft and entered the underground scene. We often see forum users discussing their previous experiences on cybercriminal sites to prove their legitimacy and increase the likelihood of successful sales — effectively providing a “cybercriminal résumé”, if you will. But, understandably, threat actors discussing their pathways to crime is not widespread. We dug around the forums, though, to find nuggets of intelligence that might help form a picture of some common routes to the underground. 

It begins with a curious mind

One common pathway that our investigations revealed was joining cybercriminal forums for research purposes, to improve technical skills, or out of curiosity and then ending up getting involved in cybercrime. Of course, this reasoning could be offered as a defense or justification for a forum presence — the “I’m just looking” excuse. But it does make sense for this to be the way in which many threat actors grew into their current roles. Forum users unintentionally or purposefully provide indications of how much money they have made from their illicit activities. It’s easy to imagine an impressionable mind being wowed by the promise of such riches. For example, the Sodinokibi/REvil ransomware group recently deposited over $1 million into one Russian-language forum as “proof” of their legitimacy and the success of their ransomware partnership program. Many forum users expressed awe and astonishment at the ransomware group’s apparent profits when discussing this deposit.

In February 2020, a user on the gated Russian-language cybercriminal forum Verified initiated an anonymous poll to ask forum members how much they had earned from cybercrime in the past two years. The most common answer was “less than $12,000”, although “more than $21,500” took second place. Even a profit of $12,000 would seem appealing to many curious newbies, especially those located in countries where the average wage is much lower than this figure. In fact, low average wages compared with potential cybercrime earnings is often cited as a reason for the high proportion of cybercriminals originating from the former Soviet Union nations.

In June 2020, a thread on the prominent Russian-language cybercriminal forum XSS raised the question of how forum members had found the site and begun their cybercrime journey. One user in this thread predicted that 5% of cybercriminal forum users were members of such platforms for research purposes; this is a large contingent of members who could move from researchers to practitioners. Several forum members commented on the thread to share the reasons that they had entered cybercrime. One user said that they had entered this scene back when the idea of hacking was new and exciting. Another said that back when they bought their first computer, they started experimenting with programming to understand the computer components, using the forums for research purposes, and then realized the kind of money they could make. 

Although not cited in this thread, another factor that could ease curious individuals’ paths into cybercrime is the increasing prevalence of “as-a-service” offerings and detailed tutorials on cybercriminal platforms. These offerings mean that even those without computer programming skills can quickly become prolific cybercriminals. These services can be more expensive than developing a project yourself and writing the code. Still, many probably see it as worth the initial outlay if the promise of significant profits is fulfilled.

Platform administrators welcome new users with open arms

We have also seen examples of some forums actively encouraging newcomers’ development. CryptBB, an English-language cybercriminal forum known to previously only have accepted new members following a rigorous application and interview process, recently introduced a “Newbie” section. The previous process likely made it difficult and off-putting for beginners and users with low-level skills to join the forum. However, with the new section, CryptBB promotes itself as an excellent forum for “newbie” hackers, programmers, and carders, likely to expose the platform to more users and entice them to share the knowledge and expertise they have.

In September 2020, the XSS forum administrator announced the launch of a new e-learning section. As the administrator themselves admitted, this scheme is not new – many cybercriminal platforms have previously featured tutorials and guides to help teach more junior members. Yet the e-learning section announcement stated that XSS’s foray into this field would be different and would use new and updated teaching methods. The announcement affirmed that “The main concept of the existence of our forum is [to be] an old-school technical and thematic place, friendly to newbies” and pledged to “return the evolutionary course of development to our ranks”. Interestingly, the administrator said that “The market, place of sale, commerce – all of this is secondary for us, it is a consequence of knowledge gained, but it is in no way the meaning of life” and indicated that developing inexperienced cybercriminals into skilled threat actors was a worthy cause that the forum and its members should devote efforts to. With such support available, it is possible to discern how newcomers to the scene could quickly develop their technical and cybercrime skills. XSS and another high-profile Russian-language cybercriminal site, Exploit, have also incentivized experienced users to share their knowledge by organizing competitions with substantial prizes given to those who write the best articles on cybercrime techniques. One recent competition on XSS was sponsored by the Sodinokibi/REvil ransomware group, partly with the aim of finding skilled new recruits to join their team. A technically-minded forum user, seeing these competitions as an opportunity to showcase their knowledge and expertise, could easily be dragged into cybercrime if they impressed, and were then courted by, a ransomware group.

Recruitment campaigns enable cybercriminal talent acquisition

Sometimes the trajectory from beginner to cybercriminal appeared to be a rather more deliberate act instead of an accidental development. Our research revealed examples of recruitment campaigns on cybercriminal forums that could have “turned” curious forum surfers into more committed threat actors. 

In June 2020, Europa Market created a recruitment post on the English-language cybercriminal forum Envoy. The post explained that the marketplace was seeking an intern due to the site having grown rapidly in March 2020. The post indicated that successful interns might receive the opportunity to join the site as paid permanent staff members. It’s easy to see how such a position could quickly turn a curious mind into a dedicated cybercriminal.

Over the past few months, we have also observed an increased drive on some English-language cybercriminal forums to hire new staff. The forum administrators tend to look for new staff among trusted forum members and encourage them to apply if they fit the requirements laid out in the “job description” provided in the job vacancy announcement. 

In April 2020, the English-language cybercriminal forum Nulled announced they were hiring two new forum moderators to “help maintain peace on the forum,” following a COVID-19-related growth in members. After approximately two months and many applications, Nulled reported that they had hired not two but three new moderators, who appeared to be trusted or highly ranked forum members. The English-language cybercriminal forum CrackedTO ran two recruitment drives this year–in April and June 2020–to find a new forum moderator and a section moderator. The site cited “recent events” as the impetus for them looking for new team members; this is potentially another reference to the ongoing coronavirus pandemic, which has led to increased membership counts for multiple cybercriminal forums. 

A forum moderator’s role represents a step up on the ladder of hierarchy on both Nulled and CrackedTO. It also enables users to become more committed and actively involved in the forums’ maintenance and daily processes. It logically follows that curious and amateur cybercriminals might decide to commit to the underground path by signing themselves up to fulfill such roles. 

In perhaps a less niche example, the well-known extortionist threat actor “TheDarkOverlord” ran several recruitment campaigns at the height of their activity. It’s unclear if these recruitment campaigns were legitimate, but they would undoubtedly have been enticing to potential new-joiners. One of TheDarkOverlord’s posts on the now-defunct English-language cybercriminal forum KickAss offered an ultimate salary of $70,000 per month for several technical roles on their team.

Real-life employment breeds a certain type of cybercriminal

Another interesting version of the cybercriminal development story is the potential intersection between real-life employment and online activities. Once they have spent some time on these sites, sometimes curious forum users realize they can use their privileged position in their real-world employment to make a splash in the cybercriminal scene. 

We have seen examples of individuals working in telecommunications companies offering to conduct SIM-swapping operations, leak databases of customer information, or conduct targeted research on individuals. One telecommunications company employee even posted their hours of work so that any cybercriminal customers who needed them to look up privileged information about a target knew when they could get their information. Obviously, such an approach is incredibly high-stakes as it risks jeopardizing users’ real-life employment and is more likely to attract law enforcement attention. Threat actors likely consider that the potential profits outweigh the risks. However, having privileged access to exclusive information like this would immediately accelerate a user’s pathway to revenue, as this type of compromised data commands a premium on cybercriminal sites. 

The Russian phenomenon of “probiv” is a typical example of one of these slippery slopes that can enable individuals to transition. Digital Shadows (now ReliaQuest) previously published a blog on this scheme, if you’d like to read about the arrangement in more detail. Probiv involves providing or requesting privileged information about a target usually taken from private databases via insiders’ use. For example, an individual with access to the traffic police’s database might offer their services performing lookups for a particular target in their system and providing all the personal information on that victim that is available in the database.

From novices to SMEs, everyone has a seat at the table

Our research revealed four typical pathways for evolving as a cybercriminal: curiosity and being attracted by profit, development schemes organized by cybercriminal platforms, deliberate recruitment drives, and abusing real-life employment. It is unlikely that these pathways will change much in the foreseeable future. As companies and organizations become increasingly aware of the danger of insider threats, they may introduce measures to try and clamp down on employees abusing their privileged position to bolster their virtual aliases on cybercriminal platforms. However, underground forums show no sign of becoming less popular; as mentioned previously, the coronavirus pandemic appears to have even increased sites’ membership levels. While such sites continue to host illicit discussions and sales, individuals will likely continue to travel along these well-trodden paths from the curious beginner to verified vendor. Regardless of an individual’s initial reason for joining, they may be pulled into the cybercriminal life if the justifications and financial payouts seem worth it–whether this is a complete novice looking to make a quick buck through phishing attacks or an experienced IT technician who is contacted by a ransomware collective looking to harness their knowledge and weaponize their skills after submitting an article for a competition.