Movies have this tendency of exaggerating their depiction of the cybercriminal underground. In film, cybercriminals are almost always seen donning headsets and blank faces, mashing their keyboards inside moving vans, abandoned warehouses, or some secret underground lair. Regardless of their location, they always seem to have everything they need to do just about anything on any given system. Cracking open an electronic bank vault? No sweat. Disabling an entire building's automated security?
That's child's play. Though these scenarios may be possible—if and only if the attackers actually have the skills, technology, and years of planning and reconnaissance to do so—they give a distorted picture of what the cybercriminal underground actually is in real life.
Think of the cybercriminal underground as a global marketplace full of anonymous buyers and sellers. It's composed of several smaller markets unique to each region. Currently, the most prominent are those in Russia, China, and Latin America. These virtual black markets mostly thrive in forums or chat rooms where numerous cybercriminals act as anonymous businessmen who trade goods and services to make profit. And much like typical businessmen, these cybercriminals adhere to specific business models:
- Commercial model: It’s the most straightforward approach. Cybercriminals hawk goods like stolen user credentials, malware, exploits, and the like, and sell them to anyone who’s interested.
- Organized crime model: This set-up involves several individuals or groups who work together to achieve certain targets. Each person in the chain serves their own unique function integral to the whole team’s operations.
- Outsourcing model: This business model requires cybercriminals to partner with outside computer owners, whose network of machines they can rent as botnets for malicious schemes.
- Mentor-apprentice model: Those interested to advance their know-how in hacking or creating malicious applications can hire more skilled cybercriminals to pass on what they know.
