Paquet-Clouston

On the Dynamics Behind Profit-Driven Cybercrime: From Contextual Factors to Perceived Group Structures, and the Workforce at the Periphery

On the Dynamics Behind Profit-Driven Cybercrime: From Contextual Factors to Perceived Group Structures, and the Workforce at the Periphery

Through an inductive thematic analysis of semi-structured interviews with experts, this study corroborates key findings on contextual and organisational dynamics behind profit-driven cybercrime. The findings pinpoint three contextual factors influencing individuals to participate in profit-driven cybercrime: lack of legal economic opportunities, lack of deterrents, and drifting means. The findings also highlight how experts perceive group structures of those behind profit-driven cybercrime: as organised, enterprise-like, loose networks, or communities. Experts’ narratives, moreover, emphasise the presence of a workforce at the periphery of cybercrime groups. Such a workforce is not actively involved in developing criminal schemes, yet it helps their orchestration by achieving necessary tasks such as writing texts or developing software. The study results confirm key insights on crime participation related to both cyber and non-cybercrime literature while also raising new research avenues, including questions concerning to what extent those forming the peripheral workforce are willing to participate in cybercrime.

On the Motivations and Challenges of Affiliates Involved in Cybercrime

On the Motivations and Challenges of Affiliates Involved in Cybercrime

The cybercrime industry is characterised by work specialisation to the point that it has become a volume industry with various “as-a-service” offerings. One well-established “as-a-service” business model is blackmarket pay-per-install (PPI) services, which outsource the spread of malicious programmes to affiliates. Such a business model represents the archetype of specialisation in the cybercrime industry: a mass of individuals, known as affiliates, specialise in spreading malware on behalf of a service. Extant literature has focused on understanding the scope of such a service and its functioning. However, despite the large number and aggregate effect of affiliates on cybercrime, little research has been done on understanding why and how affiliates participate in such models. This study depicts the motivations and challenges of affiliates spreading Android banking Trojan applications through a blackmarket PPI service. We conducted a thematic analysis of over 6,000 of their private chat messages. The findings highlight affiliates’ labour-intensive work and precarious working conditions along with their limited income, especially compared to their expectations. Affiliates’ participation in cybercrime was found to be entangled between legal and blackmarket programmes, as affiliates did not care about programmes’ legal status as long as they yielded money. This study contributes to the literature by providing additional evidence on the downsides of work specialisation emerging from the cybercrime industry.

Entanglement: Cybercrime Connections of a Public Forum Population

Entanglement: Cybercrime Connections of a Public Forum Population

Many activities related to cybercrime operations do not require much secrecy, such as developing websites or translating texts. This research provides indications that many users of a popular public internet marketing forum have connections to cybercrime. It does so by investigating the involvement in cybercrime of a population of users interested in internet marketing, both at a micro and macro scale. The research starts with a case study of three users confirmed to be involved in cybercrime and their use of the public forum. It provides a first glimpse that some business with cybercrime connections is being conducted in the clear.

Cybercrime Specialization: An Exposé of a Malicious Android Obfuscation-as-a-Service

Cybercrime Specialization: An Exposé of a Malicious Android Obfuscation-as-a-Service

Malware authors constantly obfuscate their files and defenders regularly develop new techniques to detect them. Given this cat-and-mouse game, specialized obfuscation services have appeared in the cybercrime industry. These services allow malware authors to obfuscate their code for a fee. This study investigates an automated obfuscation-as-a-service platform for Android applications and yields unique insights on the technical difficulties and business reality of those behind such a specialized service. The service investigated was found to be average in quality, mainly using known obfuscation techniques, and generating obfuscated applications that were still detected by anti-viruses. It had a small clientele of large-scale attackers who used the service to decrease anti-virus detections of highly malicious applications, thus increasing their chances of compromising devices. Depending on the price bundles considered, operators offering the service were estimated to have made a minimum revenue ranging from USD 5,100 (conservative) to USD 61,160 (optimistic) for a six-month operation. This study illustrates that even though obfuscation-as-a-service is a market niche, taking advantage of the value added from this specialization is not effortless nor easily accessible to everyone involved in cybercrime.

Uncovering Automatic Obfuscation-as-a-Service for Malicious Android Applications

Uncovering Automatic Obfuscation-as-a-Service for Malicious Android Applications

This research provides the first overview of such automatic service, which takes advantage of the whole malware-as-aservice industry, providing medium quality obfuscation for the Android malware market. Although the technical obfuscations are not state-of-the-art, the service succeeds in reducing detection for malicious Android applications. We conclude that the active use of the service highlights the need for the malware market to develop better obfuscation techniques, hence the good job that the security community is doing at quickly detecting changing malware. We also conclude that this service seemed to generate enough revenue for the group, given its automatic nature and purpose. Given that automatic services like this may be a greater problem in the future of malware obfuscation, this research provides a first technical analysis of the details of such obfuscation service and the possible impact in detection results.

Protecting the civil society through high quality research