Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/30/2012
05:14 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Shopping The Russian Cybercrime Underground

Inside look at the wide range of hacking and related services being offered in the Russian-speaking cybercrime marketplace illustrates its maturity and popularity

If you weren't already convinced that the Russian cybercrime underground is now a vast, sophisticated, high-volume market, consider this: there are at least 20 different types of services offered in Russian-speaking forums for just about anyone who wants to make a buck off of cybercrime, everything from crime-friendly VPN and security software-checking services to plain old off-the-shelf exploits, according to a new report.

Many of the services found and detailed in the report by Trend Micro today are well-known, but it's the breadth and relatively inexpensive pricing for the financial fraud services the firm studied that are most striking, security experts say.

"This shows the fully fledged commercial nature of it. It's very much crime-as-a-service," says Rik Ferguson, Trend Micro's director of security research in Europe. "It's a very mature market."

Programming services – basically malware-writing -- and software sales are the most popular cybercrime services and activities, according to the report, which provides a glimpse into the underground activity in Russian-speaking forums and cybercriminal circles. The sale of off-the-shelf malware programs like Trojans, spammers, DDoS bots, Zeus, and SpyEye are also among the hottest markets.

Some programming services are more expensive than others, according to Russian ads translated by Trend: a programmer writing a banking Trojan can charge $1,300, while fake programs only cost about $15- to $20.

The basic spamming or botnet businesses are inexpensive first steps into the biz, but the more sophisticated – and lucrative – services are zero-day development and other heavy coding services. "If I want to find out how to break into cybercrime – excuse the terrible pun – I can rent a botnet [for example], now buy myself a BlackHole exploit kit, and infect [victims] with my own custom Trojan from this other vendor ... it's like a jigsaw puzzle," Trend Micro's Ferguson says. Gone are the days of the Russian Business Network dominating the cybercrime scene, he says. "Now there are some individuals and smaller groups, and some bigger players out there, too."

One particularly interesting trend is that bulletproof server hosting pricing is dropping in the underground, he says. You can purchase a dedicated server service for anywhere from 50 cents to $1 per month, for example, and a bulletproof hosting service for $15- to $250 per month.

"The cost of hosting is being driven down. What's surprising is that it's so cheap, but if you look at what's happening in legitimate business, you shouldn't be that surprised: the hosting business has low margins," Ferguson says.

Jeffrey Carr, CEO of Taia Global, says it's a volume business. "And that report just reflects the basic stuff: imagine how much more there is to it," he says.

"It's also important to note that [Russian Federation] hackers are allowed to operate unless they attack Russian Federation sites – government, banking, etc. Then they're arrested," Carr says.

[Insight into key characteristics, behaviors of cybercrime versus cyberespionage attackers can help -- but the threats aren't just from China and Eastern Europe. See Profiling The Cybercriminal And The Cyberspy.]

According to Trend, the remainder of the top 10 most popular services after programming services and software sales (in order) are: hacking services; dedicated server sales and bulletproof-hosting services; spam and flooding services; download sales; DDoS services; traffic sales; file encryption services; Trojan sales; and exploit-writing services and sales.

DDoS and botnet services are relatively cheap: one day of DDoS'ing a victim or victims costs between $30- and $70, or just $10 for one hour. A one-month subscription goes for about $1,200.

Botnet leasing is actually rare in the underground market because it's not as lucrative as other services. "Hackers normally operate their own botnets because selling them is less profitable," the report says.

But bots go for about $200 for 2,000 infected machines. A DDoS botnet can cost $700 and $100 per DDoS botnet update, according to Trend.

The top Russian cybercriminal forums for buying and selling include: antichat.ru; xeka.ru; carding-cc.com; Exploit.IN; InAttack; XaKePoK.su; HACKER-PRO CLUB (HPC); XAkNet.ru; zloy; and HackForce.RU.

Al Huger, vice president of development for the cloud technology group at Sourcefire and a co-founder of Immunet, says the bottom line is that cybercrime is big business now. "It's a volume business. There's so much of it," Huger says. "[And] there are more of them than there are of us."

The "Russian Underground 101" report is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31547
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.
CVE-2021-31548
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.
CVE-2021-31549
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppressed MediaWiki usernames to unprivileged users.
CVE-2021-31550
PUBLISHED: 2021-04-22
An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.
CVE-2021-31551
PUBLISHED: 2021-04-22
An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.