Wicked Dark Web Wish List

The Dark Web is a lawless place, but even the most hidden corners of the darknet are not immune to the laws of supply and demand.

 Malware programs, cyber-criminal services and stolen data can skyrocket in popularity on the underground market just as quickly as they can fall out of favor, same as any product sold in the legitimate economy.

A couple of black market cyber trends truly took off in 2018 with experts predicting a few new ones will spring up in 2019.

Malicious Software and Services

It happens all the time: A pioneering hacker or sophisticated threat group becomes the first to introduce a new malware or exploit, and suddenly a whole clowder of copycats emerges. As demand for these malicious tools grow on the darknet, developers and buyers begin to offer the same functionality, sometimes in the form of malware, other times as malware-as-a-service.

Take, for example, Magecart, the e-commerce payment card skimmer toolset that turned into a high-profile threat last year after multiple cybercrime groups used it to carry out major attacks against British Airways, Ticketmaster and Newegg.
By December, researchers at Armor reported the discovery of what they identified as the first-ever Magecart-like tool available for sale on the dark web.

This sequence of events fits a common pattern, according to Corey Milligan, senior security researcher with Armor’s Threat Resistance Unit (TRU), who says that there is a “tendency for certain attack types [and] techniques to spike in conjunction with an increase in open-source reporting, including news coverage, detailing their successful use.”

Of course, this is but one example. Other categories of malware also continue to see spikes and dips in dark web demand.
In 2018, crypto-miners in many respects surpassed ransomware in terms of cyber-criminal demand. Now, just as suddenly, researchers believe we could see a reserving of that trend in 2019.

“Among criminal actors, expect crypto-mining to fall off and ransomware to return,” says Allan Liska, senior solutions architect at Recorded Future.

“Crypto-mining has not been as profitable for many cybercriminals as originally intended. Unless an attacker can infect tens or hundreds of thousands of devices it is difficult to make even close to the money that can be made from a successful ransomware campaign.”

Armor’s TRU team has also observed the ransomware market steadily increasing, while crypto-miner demand on the dark web continues to decline from its peak in May-June 2018.

Black market buzz for certain types of cyber weapons can also be influenced by security professionals’ and law enforcement’s latest activity. Wherever the good guys are training their focus on or bolstering defenses, the bad guys want to be somewhere else.

Allison Nixon, director of security research at Flashpoint, believes DDoS services are losing steam in underground marketplaces “as more and more targets are able to successfully mitigate attacks. Attacks are still happening, but you don’t hear about major outages happening nearly as often anymore.”

On the other hand, the demand for criminal proxy services that can disguise where the real attack is coming from is on the upswing because “We haven’t seen much law enforcement attention yet against criminal and shady proxy networks,” Nixon explains.

Stolen Data

The digital-age business philosophy that “data is king” applies to the criminal underworld as well. Information equals money, the right stolen data in the wrong hands can be used to hijack a bank account or spoof an email address to help perpetrate a financial scam.

If it’s sensitive information you’re after, investing in a malware service to collect it may not even be necessary. There’s plenty of stolen data already available on the dark web, including highly prized credentials, payment card numbers and Social Security numbers.

If you’re lucky or devious enough to get your hands on a particular victim’s complete set of personally identifiable information (PII), then you’ve really hit the jackpot. Scammers call such packages “fullz.”

For law-abiding citizens, such threats to their personal data begin at an early age. More than ever, in fact, it starts as early as birth.

“I’m… watching for an increase or steady supply of younger personal information, infant data, particularly,” says Emily Wilson, vice president of research at Terbium Labs.

“We’ve seen isolated listings for infant fullz and child SSNs pop up over the last few years. I’m expecting to see that market grow over time, shifting from a novelty item to a specialty item: available regularly, but with lower supply and a higher price.”

Fullz even remain valuable after death, not death of the person, necessarily, but of his or her payment cards.

Wilson explains cyber-criminals are increasingly finding worth in “dead fullz,” which refers to fullz containing data for payment cards that have expired or were cancelled.

Even though they can’t use the payment cards to score quick cash, attackers can still take advantage of these fullz because the stolen information can be used to compromise other accounts that do remain active.

In a recent report predicting dark web trends in 2019, Terbium Labs prognosticates that the advent of new technologies such as biometrics, Internet of Things (IoT) devices and autonomous vehicles will only expand the array of sources from which data can be stolen.

Biometric data in particular could become a hot-ticket item, the report states, because such data lasts for the victim’s entire lifetime, and cannot be altered, even if there is a breach.
 
“Compromised payment cards are simply canceled and reissued; no similar recourse exists for compromised fingerprints or retina scans,” the report says.

“Criminals on the dark web look for data they can monetise; right now, there is not sufficiently broad adoption of biometric technologies to warrant mining and marketing that data on criminal markets,” the report says.

“Once we see increased use of biometric technologies across multiple industries, however, especially if biometric tech becomes a favored replacement for passwords or two-factor authentication, expect to see that data make its way into the dark web economy.”

SC Magazine

You Might Also Read:

Dark Web Dealers Voluntarily Ban Deadly Fentanyl:

 

« The Top 5 Malware Attack Types
Foreign Hackers Target Canadian Government & Banks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Entrust

Entrust

Entrust is a global leader in digital security, identities, payments, and data protection.

SKKU Security Lab (seclab)

SKKU Security Lab (seclab)

SKKU Security Lab supports research and education in information security engineering. The lab is a part of the College of Software, Sungkyunkwan University.

limes datentechnik

limes datentechnik

limes datentechnik is an authority in the fields of cryptography and data compression. The FLAM product family is an internationally accepted standard for efficient and safe handling of data.

sayTEC

sayTEC

sayTEC's mission is to develop and deliver next-generation products and services in encrypted data and voice transmission.

Information Systems Security Partners (ISSP)

Information Systems Security Partners (ISSP)

ISSP is a specialized system integrator focused on the information security needs of its corporate clients and providing best in class products and services for securing organizational information.

Synectics Solutions

Synectics Solutions

Synectics deliver solutions for reducing risk, combating financial crime, and enabling organisations to meet their compliance and regulatory commitments.

Greylock Partners

Greylock Partners

Greylock Partners is a leading venture capital firm based in Silicon Valley. We invest in all sectors of enterprise software technology including applications, cloud/SaaS, networking and security.

Nokia

Nokia

Nokia is a proven leader in fixed, mobile and IoT security offering capabilities that range from systems design to integration and support.

MassMutual Ventures

MassMutual Ventures

Mass Mutual ventures backs companies building category-defining businesses in markets including enterprise software, digital health, cybersecurity, and fintech.

Kinetic Investments

Kinetic Investments

Kinetic Investments is a venture capital firm dedicated to early-stage companies that are transforming the digital landscape.

Ridge Canada Cyber Solutions

Ridge Canada Cyber Solutions

Ridge Canada helps insurance brokers and insurance buyers understand, evaluate, and secure cyber coverage that is tailored to their business.

Luxembourg House of Financial Technology (LHoFT)

Luxembourg House of Financial Technology (LHoFT)

Offering start-up incubation, co-working spaces including a soft-landing platform, the LHoFT connects and creates value for the entire Luxembourg FinTech ecosystem.

Opticks Security

Opticks Security

Opticks provides fraud detection and monitoring solutions for leading brands. agencies and networks. Our relentless mission is to deliver reliable and innovative software to beat digital fraud.

Aite-Novarica Group

Aite-Novarica Group

Aite-Novarica's Cybersecurity practice provides ongoing research and advisory services to chief information security officers focused on protecting their companies’ assets.

Trustifi

Trustifi

Trustifi leads the market with the easiest to use and deploy email security products, providing both inbound and outbound email security from a single vendor.

C2 Risk

C2 Risk

C2 Risk are focussed on risk analytics for information assurance, privacy and ESG (Environmental, Social, and Governance).