If you think it seems like there is more activity, attacks, and exploits from cyber-criminals and other bad actors, you may be right. Malware exploits can be easily bought online as kits complete with installation assistance and technical support. Just as the business web is moving everything to “The Cloud” with AaaS (Anything as a Service), the denizens of the Dark Web are offering “Malware as a Service and “Exploit as a Service.”
There was a time when you had to go to the Dark Web to find these products and offerings, but not any more. Many malicious or questionable applications are offered for sale on the regular web, often sold as “Administrative Tools.” The more dangerous and higher quality exploits are still to be found Dark Web marketplaces.
The site link-base<dot>org offers an exhaustive index of markets, forums, and hacker collectives in 21 languages. From there it is a short hop to the malware tools of your choice. It is not quite as simple as Amazon yet, but the malware marketplace is one of the busiest areas of the forums.
What can an aspiring cyber-criminal find? Remote access Trojans, banking Trojans, ransomware, modular bots, keyloggers, data stealers, and more are available. Prices range from $50 to $5000 depending on what you are looking to achieve.
A lot of these tools come with hardware infrastructure, installation assistance, and technical support, either included or available for an additional service fee. There are even classes available for cyber-crooks who want to learn the technology and.up their game.
The FBI’s 2019 Internet Crime Report puts reported losses in the US at $3.5 billion. World-wide, the underground cyber-crime economy has an estimated value of $5.2 trillion. This is a massive transfer of wealth from companies and individuals. There are indirect costs for remediation, and increased expenses for cyber defenses, security hardware, and expanding IT and cybersecurity departments.
As I have been saying for years, the question is not if I will be attacked, but when will I be attacked. My answer is that it has probably already happened to you at least once, and you may not even know it.
A typical ad for a ransomware exploit kit.
More information:
- Cybernews – Buying Your Own Malware..
- Tech Republic – Malware is Easy to Buy...
- Heimdahl Security – Ransomware for Sale…
MAY
About the Author:
I am a cybersecurity and IT instructor, cybersecurity analyst, pen-tester, trainer, and speaker. I am an owner of the WyzCo Group Inc. In addition to consulting on security products and services, I also conduct security audits, compliance audits, vulnerability assessments and penetration tests. I also teach Cybersecurity Awareness Training classes. I work as an information technology and cybersecurity instructor for several training and certification organizations. I have worked in corporate, military, government, and workforce development training environments I am a frequent speaker at professional conferences such as the Minnesota Bloggers Conference, Secure360 Security Conference in 2016, 2017, 2018, 2019, the (ISC)2 World Congress 2016, and the ISSA International Conference 2017, and many local community organizations, including Chambers of Commerce, SCORE, and several school districts. I have been blogging on cybersecurity since 2006 at http://wyzguyscybersecurity.com