Armor’s Black Market report reveals latest hacker price list and shows cybercrime-as-a-service is thriving

Cloud security-as-a-service provider Armor has released its annual Black Market report which shows that cybercrime-as-a-service is thriving, with cybercriminals staying ahead of the game by offering a raft of new goods and services – and even aftersales support. 

Armor’s Threat Resistance Unit (TRU), part of the company’s Security Operations Centre (SOC), which specialises in gathering knowledge about new and emerging threats, analysed and compiled data from 12 different English and Russian speaking dark markets and forums, between February and June 2019.  In addition to finding and chronicling the current prices for popular core items such as bank account credentials, credit card numbers, full identity packets, and DDoS and spamming services, the TRU team discovered cybercriminals peddling some interesting new offerings.  They include cash for pennies on the pound, log-in credentials for unhacked Windows servers for use with Remote Desktop Protocol (RDP), and articles of incorporation.

One of the emerging services the TRU team spotted in the dark markets is where a criminal can pay a seller $800 in Bitcoin and have $10,000 transferred to a bank account of their choice or wired to them via Western Union.  “For those scammers who don’t possess the technical skills and a robust money mule network to monetise online bank account or credit card credentials, this is an offer that can be very attractive,” said Chris Hinkley, head of Armor’s TRU Team. “The threat actors are still selling financial account and credit card credentials outright, but this clever service gives them an additional channel for monetising the large amounts of financial data available on the underground. Plus, they still reduce their risk because ultimately, they are not taking possession of the stolen funds.”  

The TRU team also discovered numerous cybercriminals selling credentials for unhacked Windows RDP servers. They are being offered for as little as £16 a piece. These servers are a common entry point for ransomware hostile actors trying get a foothold into an organisation’s computer network.  Therefore, it stands to reason that the fraudsters would take advantage of this market opportunity.  The UK was the biggest global target for ransomware attacks in the first half of 2019*, with the number increasing by 195%, compared to a reported 59% reduction in attacks of the same kind in 2018, so business is likely to be good.  

In relation to banking and credit card schemes, it came as no shock to find cybercriminals hawking articles of incorporation and sole proprietorship papers.  These documents enable a money mule (a person who transfers illegally acquired money on behalf of or at the direction of another and gets paid for their services) to apply for a Company Registration Number (CRN) which in turn lets them open a business bank account.  A business bank account allows a criminal to move larger amounts of money in and out of the account, making it less likely that the bank’s fraud alerts will be triggered. The money mule bank accounts are so integral to the success of online financial fraud, such as Business Email Compromise (BEC) and payroll attacks, it makes sense that the TRU team would see these items become a staple on the underground.  

In comparing the current market prices for stolen credit cards, bank accounts, and personal identities to the prices advertised in June 2018, Armor’s TRU team found similar rates. At that time, the average price for a US Visa or Mastercard was around $9, with the current price averaging $8.50. However, the TRU team did see a significant drop in price for UK Visa and Mastercard credit cards. In June 2018, they were averaging $22 a piece, whereas today they are averaging $17 a piece. One  potential reason for this price drop is due to an influx of credit cards hitting the black markets, after a spate of card-skimming attacks hit hundreds of e-commerce websites, including organisations operating in the UK such as British Airways, Marriott, Ticketmaster and others.

Armor’s comprehensive report includes details of the wide-ranging goods and cybercrime-as-a-service offerings and their associated costs, covering everything from DDoS attacks, to spamming, gift cards and - as becoming a social media influencer continues to grow in popularity - the cost of ‘Likes’ and followers. 

The amount of criminal goods and services being peddled in the underground is daunting, however, by continually monitoring these dark markets, security defenders, such as Armor, are able to gain valuable insight into the types of data being targeted, how it is being stolen, and how the data is being used.  “Having this intelligence is key in helping us protect our clients from current and emerging cyber threats,” said Hinkley.  “And although it feels like a never-ending battle, it is a fight worth fighting.”  

Extracts from Armor’s hacker price list: 

*Statistic taken from SonicWall Mid-Year Threat Report published July 2019