January 7, 2016 By Douglas Bonderud 2 min read

Once the domain of outsiders and tech-savvy specialists, hacking has evolved into a diverse market complete with industry verticals, specializations and intense competition that sees groups that aren’t willing to play ball kicked to the curb as more malleable services take their place.

According to Business Insider, in fact, the rise of user-friendly viruses and exploit kits so simple almost anyone could turn to a life of digital ill repute has sparked a kind of customer service war among cybercriminals. Malicious actors face off to offer better support, quicker response times and even money-back guarantees for underhanded activities. It’s official: Things have gotten very, very strange out there.

Card-Carrying Cybercriminals

As noted by Business Insider, one of the first market segments to roll out cybercrime support were the carders — criminals who steal and sell credit card information and the attached personal data. It started around 15 years ago with a major crackdown on carding services, which in turn opened the market for smaller, startup offerings.

To set themselves apart, cybercriminals offered card testing through charity donations along with money-back guarantees if cards didn’t work as advertised. The idea quickly spread to other attack verticals such as ransomware and even marketplaces like AlphaBay.

For example, ransomware creator Jeiphoos — who developed the Encryptor ransomware-as-a-service (RaaS) — inserted a comment and feature request box in his malware package and has since implemented a number of customer suggestions to improve the offering.

AlphaBay, meanwhile, now includes the same kind of seller reviews and vendor ratings users would expect to see on Amazon or eBay. In what can only be described as a kind of bizarro-world mimicry, one AlphaBay patron filed a scam report when the two packages of flour he ordered didn’t contain a Beretta pistol.

Attackers have also taken to offering ongoing support for their products, and some even provide setup services for a small fee, effectively making the moniker of cybercriminal available to anyone willing to surf the Dark Web and spend a little cash.

No Slowdown

Despite increased competition among cybercriminals, however, there’s no ceiling predicted for this market in the near future. Time reported that Hyatt Hotels recently discovered a payment processing virus on its system that could result in millions of customer cards being compromised.

NBC News, meanwhile, has a roundup of cyber predictions for 2016. From hacktivism to increased use of ransomware and the threat of a hackable Internet of Things (IoT), there are plenty of sales vectors left for malicious actors to fill and subsequently support. In short, companies should expect an uptick, not a slowdown, as the cybercriminal market looks to enhance the customer experience.

So what’s the takeaway in this strange new cybercriminal landscape? The mastermind responsible for a corporate network shutdown or retail chain hack may not be a tech wizard or prolific malware-maker but rather a disgruntled employee with a little cash, a smartphone and an ax to grind. In a way, it’s almost sad: Hacking has transitioned from a niche market shrouded in secrecy and mystique to just another e-commerce venture, one replete with scams and poor sellers.

The good news? More exploits, kits and other malware in the hands of tech novices means more data for security experts, while the focus on customer service over quick-and-quiet code exchanges makes supportive cybercriminals easier to catch in the act.

More from

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

AI cybersecurity solutions detect ransomware in under 60 seconds

2 min read - Worried about ransomware? If so, it’s not surprising. According to the World Economic Forum, for large cyber losses (€1 million+), the number of cases in which data is exfiltrated is increasing, doubling from 40% in 2019 to almost 80% in 2022. And more recent activity is tracking even higher.Meanwhile, other dangers are appearing on the horizon. For example, the 2024 IBM X-Force Threat Intelligence Index states that threat group investment is increasingly focused on generative AI attack tools.Criminals have been…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today