Criminals in North America needn't always go as far as the Deep or Dark Web looking for weapons, drugs, stolen identities, or malware kits; those can often be found on the open web. And while these marketplaces certainly aim for criminal buyers, they're often penetrated by amateurs and even law enforcement. According to a new report by Trend Micro, things are very different in France.

The French underground is a comparatively small operation -- only about 40,000 individuals strong, according to estimates by the Gendarmerie Nationale and Police Nationale. The small size, however, may be a deliberate function of the fact that it's so hard to crack into, and even those inside the community often work mostly alone.

"French cybercriminals are very cautious," Trend Micro threat researcher and author of the report Cedric Pernet says, "because they are frightened by both law enforcement agencies which might be working on trying to catch them and the other cybercriminals who might scam them." 

The French underground exists only on the Dark Web, say researchers, and access is vigorously restricted through a system of vetting, reputation-based controls, membership programs, and "halls of shame" where anyone exercising dishonor amongst thieves will be blasted. 

Shaming is also for competitors, and sometimes the dog-eats-dog world gets so nasty that marketplace operators commit cyberattacks against each other, with little regard for their own customers. Researchers cite one example: the administrator of marketplace A -- knowing that some of its customers also patronized marketplace B -- took its own members' credentials and used them to hack into marketplace B -- and steal Bitcoins. (This ultimately backfired.)

Full access to forum services is often allowed only after obtaining a high enough reputation score - proving one's criminal mettle with each "incriminating post or successful fradulent transaction," as the report explains.

Even then, trust is wary and security is paramount. Members of the French underground generally use encrypted communications and accept payments only through Bitcoins or Prepaid Card Services that require no identity information. Payments are also generally done through escrow services that take a 5% to 7% cut (one marketplace had a semiautomatic escrow system with two-factor authentication and took only 4%) and some will restrict further purchases until payment has cleared for initial purchases.

"I feel the situation was different some years ago, before Bitcoin appeared," Pernet says. Bitcoin makes it easier for marketplaces to handle money, says Pernet, "Therefore, it is also easier to be scammed by marketplace administrators who might run away with all the money. Add some wars between different marketplaces and you have quite a pretty good feeling on why they are paranoid. The hack of the whole database of one of the biggest marketplace last year also made them think how vulnerable they are, and enforced the use of encrypted communications even in private messages on marketplaces."

Many sellers also cut out the marketplace operator and instead run "autoshops" -- sites maintained by individual providers who deal directly with buyers. Autoshops are so common that there are even autoshop creation services that provide CMSes and domain registration.

Even the products themselves slant towards the stealthy. In addition to stolen credentials and locally produced ransomware are a niche market for small, easily hidden or disguised weapons -- including pen guns, brass knuckles, and flexible knives shaped like credit cards. Also popular are fake bills for use in sale fraud, fake car registrations for use in the sale of stolen automobiles and bank account opening services.

Working in the French underground isn't an entirely friendless endeavor, though. "When it comes to make a lot of money illegally, few people have all the required skillset to do it all by themselves," says Pernet. So at least in some cases, "Therefore, they need to partner/team up."

Related Content: