Cybercriminal salaries can exceed $1 million
If crime doesn’t pay, some cybercriminals wouldn’t know it. According to a report released by Trend Micro on Monday, a member of a cybercrime team like Conti can earn around $1.1 million a year.
Since cybercrime groups do not file reports with the SEC, the salary earned by a big money maker in a big criminal enterprise like Conti represents Trend Micro’s best estimate based on information disclosed on the group and its estimated revenues of 150 to 180 million dollars. million.
“Facts extracted from the leaked conversations paint a picture of the Conti organization closely resembling a large, legitimate business,” the Trend Micro researchers noted.
“These criminals appear to have managed to build a complex organization with many layers of management and internal rules and regulations that mimic that of a legitimate corporation,” they added.
The “Inside the Halls of a Cybercrime Business” report, by David Sancho and Mayra Rosario Fuentes, focuses on the revenue and organization of three distinct criminal groups – a small (less than $500,000 in annual revenue), a medium (up to $50 million) and a large one (over $50 million).
Size influences specialization
Like any business, size influences the degree of specialization of a criminal organization, observed Trend Micro’s vice president of market strategy, Eric Skinner.
“A small group will specialize in one area — either contracting out other aspects of its operation or being niche providers for larger groups,” he told TechNewsWorld.
“As a group gets bigger,” he continued, “it may bring more niche skills in-house to reduce costs or have more control over its supply chain.”
“Criminal organizations tend to mirror legal business because both try to maximize profits,” he added. “An organization not motivated by profit, say an idealistic or terrorist organization, will often have different structures to reflect its different goals.”
As criminal organizations grow, they face many of the same “business” challenges as legitimate organizations, including recruiting, training, software development, business development and marketing, noted Sean McNee, vice president of research and data at Internet intelligence specialist Domain Tools in Seattle.
“As such,” he told TechNewsWorld, “they have adopted many best practices and business models to address the same issues that legitimate organizations face in managing these challenges.”
New type of startup
McNee said the cybercrime ecosystem is a rapidly maturing competitive free market.
“Relationships in this economy allow organizations to explore technical specialization, effective affiliate and sales models, and the ability to scale effectively,” he continued. “Cybercrime operations could then be viewed in terms of tech startups – capitalizing on speed, rapid iterations to adapt to product market and forge business partnerships.”
Criminal organizations are not that different from for-profit corporations, said John Bambenek, principal threat hunter at Netenrich, a computer operations and digital security firm in San Jose, Calif.
“They have to organize people and processes to accomplish the mission of making money,” he told TechNewsWorld. “They are simply willing to use criminal tools to achieve this.”
Not only are traditional business models proven, but they are also scaling well, added Erich Kron, security awareness advocate at KnowBe4, a security awareness training provider in Clearwater, Florida.
“Dealing with groups of criminals, there must be a clear delineation of powers, and checks and balances must be in place to ensure that these criminals do not steal from their own cybercrime organization,” he said. at TechNewsWorld. “A well-defined organization and authority are essential to ensure the smooth running of operations.”
Size Matters
The report noted that determining the size of an organization can be an important piece of information for law enforcement.
He explained that knowing the size of a targeted criminal organization can lead to prioritizing which groups to prosecute over others to achieve maximum impact.
“Also keep in mind that the larger the organization, the less vulnerable it is to arrest, but the more prone it is to manipulation,” the researchers wrote.
ADVERTISEMENT
“Data collection techniques are vital,” they continued, “If there’s anything the leaked Conti cats have taught us, it’s that information disclosure can be much more powerful in crippling people. group operations than server teardowns.”
“Once private information has been leaked, the relationship of trust between group members and their external partners can be irreversibly eroded,” they added. “At this point, restoring trust is much more difficult than changing IP addresses or changing Internet service providers.”
Sacrifice Skels
Kron pointed out, however, that well-organized cybercrime operations will be much harder for law enforcement to penetrate and gather information.
“They can provide security for higher-level leaders by having many levels of culpability under them,” he said. “Just like with street drugs, it is usually the low-level street vendors who are arrested while the kingpins and large-scale traffickers are isolated.”
Trickbot and Conti recruited from tech universities and legitimate job search sites, and it’s likely those recruits were unaware of the work they were supporting, added Andras Toth-Czifra, principal analyst at Flashpoint. , a global threat intelligence company.
“The arrest of an individual does not necessarily compromise an organization because lower-level workers may not be aware of the work they are supporting,” he told TechNewsWorld. “Analysts have observed similar tactics being used to recruit unwitting financial mules.”
Underground economy
With increased organization and specialization, cybercrime groups move faster and more efficiently through every stage of an attack, Skinner noted.
“While the majority of attacks still start with phishing or exploiting vulnerable assets accessible on the Internet, we are seeing an increase in supply chain attacks,” he added.
“And,” he continued, “we are seeing an evolution in extortion tactics, beyond destructive ransomware, with more emphasis on data exfiltration and threats of public disclosure of information sensitive”.
“What we see is a developing underground economy,” McNee added.
He noted that recent trends focus on specialization and division of labor within groups as they garner the resources they need to grow and mature their criminal enterprises.
ADVERTISEMENT
“Collaboration has always been the hallmark of many of these groups,” he said. “As some large organizations have consolidated, their ability to develop certain capabilities internally has increased.”
“With the proliferation of the ransomware-as-a-service model, customer support and their ‘customer success’ marketing and support has also increased,” he added.
One of the fascinating things about cybercriminals is how quickly they adopt cutting-edge technology, observed Andrew Barratt, general manager of solutions and investigations at Coalfire, a cybersecurity consulting services provider based in Westminster, Colorado. .
“A few years ago, we knew of criminals using AI and machine learning to perform language processing – all pre-chatGPT – to mimic the language used in emails used by their targets.”
“They are cloud-enabled, globally diverse, and in many cases willing to take risks with new technologies because the payoffs can be so high,” he added.
Tech
Leave a Reply