Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/20/2018
08:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cybercrime Economy Generates $1.5 Trillion a Year

Threat actors generate, launder, spend, and reinvest more than $1.5 trillion in illicit funds, according to a new study on cybercrime's 'web of profit.'

RSA CONFERENCE 2018 – San Francisco – If cybercrime was a country, it would have the 13th highest GDP in the world. Attackers generate $1.5 trillion in annual profit, which is about equal to the GDP of Russia, according to a new study on the interconnected economy of cybercrime.

"Into the Web of Profit," among the first studies to explore the intricacies of revenue and profit in the world of cybercrime, was conducted by Dr. Michael McGuire, senior lecturer in Criminology at England's University of Surrey. Over nine months of study, he learned how the "economy" of cybercrime sustains itself and overlaps with the legitimate economy.

This wasn't the original intent behind the Bromium-sponsored study, which began with the idea of learning where cybercriminals spend their money. "It turned into a huge piece of research, which looks at the whole of how money flows around the cybercrime system," says McGuire. The report pieces together conversations with global organizations, security workers who have infiltrated the Dark Web, international police forces, and of course, the criminals themselves.

His study indicates a rise in "platform criminality" similar to the platform capitalism model in which data is the commodity, used by organizations including Amazon and Facebook. This platform turns malware into a product, simplifies purchase of illicit tools and services, and enables broader criminal activities including drug production, human trafficking, and terrorism.

More than 620 new synthetic drug types have appeared on the market since 2005, McGuire says. Many are created in China or India, purchased online, and sent to Europe in bulk. Evidence shows groups earning revenue from cybercrime are also involved in drug production, he found. The takedown of Dark Web online market Alphabay led to the discovery of listings for illegal drugs, toxic chemicals, malware, and stolen and fraudulent data.

The $1.5 trillion that cybercriminals generate each year includes $860 billion in illicit online markets, $500B in theft of trade secrets and intellectual property, $160B in data trading, $1.6B in crimeware-as-a-service, and $1B in ransomware. Evidence indicates cybercrime often generates more revenue than legitimate companies: large multi-national operations can earn more than $1B; smaller ones typically make between $30k-$50K.

It's time to move behind the idea that cybercrime is like a business. "It's much, much more than that," he says. "It's like an economy which mirrors the legitimate economy. Increasingly, what we're seeing is the legitimate economy feeding off the cybercrime economy."

Blurring the Legal Lines

The interdependence between the legitimate and illegitimate economies is driving the "web of profit" fueling cybercrime, McGuire says. Criminal organizations take data and competitive advantages from real companies and luse them to accomplish their goals. Part of the problem is, many of these legitimate organizations don't know their role in furthering cybercrime.

Companies like Facebook and Uber are rich with data, making them a prime target for attackers seeking user information and intellectual property. They give hackers a platform to sell illicit goods and services, and set up fake shops to launder money or connect buyers and sellers. This makes massive companies facilitators in a criminally driven economy.

The owners of cybercrime platforms are the biggest earners, McGuire found. Each hacker might only make $30K per year; however, managers can earn up to $2M per job with as few as 50 stolen credit cards. They aren't committing crime but they are selling it, and their criminal platforms have evolved to offer services, descriptions, and technical support for their buyers.

McGuire shares some of the numbers behind these earnings. A zero-day Adobe exploit, for example, can sell for up to $30K while a zero-day iOS exploit costs $250K. Malware exploit kits cost about $200-600 per exploit; a blackhole exploit kit costs $700 to lease for a month or $1,500 for a full year. Custom spyware costs $200, an SMS-spoofing service runs $20 per month, and a "hacker for hire" will charge about $200 for a minor hack.

Much of the money is reinvested in new criminal ventures. Criminals put about 20% of their revenues into additional crime, indicating up to $300B is used to drive illegal activity.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19604
PUBLISHED: 2019-12-11
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVE-2019-14861
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permiss...
CVE-2019-14870
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authent...
CVE-2019-14889
PUBLISHED: 2019-12-10
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...
CVE-2019-1484
PUBLISHED: 2019-12-10
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.