Cybercrime - A Peek at the Cybercriminal Ecosystem

In exchange for these "quality" tools and services, these cybercriminal platforms receive a portion of the ransoms as payment. These platforms charge various fees: 20% for Netwalker and up to 70% for other groups. 

In our simulation, our group of cybercriminals has chosen to affiliate itself with the Egregor cartel, giving them about 30% commission for successful attacks.

Outsourcing parts of their cyberattacks allows less experienced cybercriminals to conduct more complex and ambitious raids and increase profits for the platforms. Thus, a team of affiliated cybercriminals will lead the attacks, heavily assisted by the Ransomware-as-a-Service cartel.

When cybercriminals are affiliated with a platform, their task becomes much easier. They no longer have to develop ransomware and an interface to drive the attack, nor do they have to manage the negotiations or the collection of the ransom. However, these affiliates maintain responsibility for the intrusion (via previously purchased access), the theft of data to facilitate negotiations and the ransomware deployment.

Relationships on these platforms are primarily based on trust between the seller (the platform) and the buyer (the cybercriminal conducting the attack). Affiliated cybercriminals must first prove themselves in basic attacks, before earning the necessary trust to conduct more ambitious operations.

In our simulation, we have assumed that of the 20 companies attacked by the criminals, a large number of the attacks have succeeded. Hence, we have estimated that only 4 victims (20%) have ultimately paid a ransom (negotiated at 20% cheaper on average).

Cover your tracks and launder your money

Once the cyberattack is successfully completed, cybercriminals have obtained a ransom paid in cryptocurrencies - usually in Bitcoins. Although more confidential cryptocurrencies exist, such as Monero, Bitcoin’s popularity has made it a perennial favorite.

In our simulation, our cybercriminal group, now affiliated with the Egregor cartel, has demanded Bitcoin payments. Our hypothesis is that they have used a Bitcoin mixing service to cover their financial tracks. This has cost them 0.5% of the money laundered.

Finally, cybercriminals must find a way to launder their money and get it into their actual physical wallets. One way to do this is to use specialized money laundering groups who rely on money couriers, or "money mules", taking the money out of the country and turning it into cash. To recruit couriers, cybercriminals abuse the trust of relatively naïve people through scams, such as false job offers, or blackmail.

According to cybersecurity expert Brian Krebs, the cost of laundering is estimated at 50% of the profits and is usually outsourced.

In our simulation, our cybercriminal group has called on a specialized group for laundering and money mule management. These services have cost close to 50% of the money laundered.

What is then the profitability of an attack campaign on 20 targets by a group affiliated to a ransomware cartel?

The "platformization" of cybercrime provides attackers with impressive financial means and allows them to grow exponentially. Recently, the REvil cartel (also known as Sodinokibi) reported earning a minimum of $100,000,000 per annum, with its affiliates’ earnings ranging from $30,000 to $8,000,000 for each attack (depending on its size). The X-Force Threat Intelligence 2020 report (IBM) estimates that this cartel made at least $123 million in profits in 2020, stealing approximately 21.6 terabytes of data. The example of Ryuk is also striking. The platform, created in mid-2018, collected $3,000,000 in its first year according to FBI analysis, then $60,000,000 in its second, reaching a total of $150,000,000 from mid-2018 to the end of 2020.

In our simulation, we have calculated profitability margins ranging from 250% to almost 1000% for a cybercriminal group conducting an attack. Profits are even higher for platforms that manage ransomware from multiple attacks.

These figures vary greatly depending on which platform is used, the level of expertise and seniority of the affiliate groups, or the demands for ransom payments.

At present, cybercriminal groups have human and technological resources rivalling those of state offensive cybersecurity departments, allowing them to grow considerably. Until we are able to better apprehend cybercriminals, it seems impossible to slow down this phenomenon. However, international law enforcement operations in early 2021 bring hope, proving that coordinated legal actions can be taken to stop cybercriminals. How can this phenomenon be significantly curbed? The third and final post of our series will offer suggestions.


Copyright: DAMIEN MEYER / AFP