Content material warning: Due to the character of a number of the actions we found, this sequence of articles accommodates content material that some readers could discover upsetting. This consists of profanity and references to medicine, drug dependancy, playing, pornography, violence, arson, and intercourse work. These references are textual solely and don’t embody photos or movies.
Following on from the primary chapters of our investigation into what cybercriminals do with their earnings, we now study numerous types of enterprise and earnings era which might be, in threat-actor parlance, ‘gray’ (on the boundaries of legality, and/or of questionable ethics and morality).
We acknowledge that legality can fluctuate relying on jurisdiction. Nevertheless, the breadth and depth of those actions are such that now we have to categorize them in some way, and utilizing the menace actors’ personal classes is a logical if imperfect alternative.
Key findings of Half 3
- We noticed menace actors discussing all kinds of ‘gray’ enterprise pursuits on cybercrime boards
- A number of of those – together with promoting adware and vulnerabilities – could also be of concern to the safety business
- Different enterprise pursuits on this class embody visitors era, pornography, playing, prescribed drugs, import and export, drop-shipping, and promoting antiques
- Different schemes of notice embody a proposal to outsource software program growth to Russian jail inmates, residency permits, and promoting intelligence
- In some circumstances, discussion board discussions revealed data and pictures that would probably be used to trace, geolocate, and/or establish menace actors.
‘Authorized’ malware and cybersecurity companies
Adware
A consumer proposed “legally” promoting adware to “pentesters and costly companies” and requested “if there are loopholes.” Different customers famous that “legal professionals…are wanted” however that “in some way Cobalt [Strike] and others exist.” Different commenters cited FinFisher and NSO Group, and suggested the menace actor to contact a lawyer.
Determine 1: A menace actor asks whether or not it’s attainable to “legally promote” malware to “pentesters and costly companies”
Vulnerabilities
A consumer posted a thread searching for “a comrade-in-arms” who’s “concerned in hacking, trying to find vulnerabilities, and IT safety.” The consumer, purportedly based mostly in Moscow, defined that they meant to search out vulnerabilities in native companies’ networks, contact them, present proof, “and supply one-time companies to place the infrastructure so as or tackle ongoing upkeep…our purpose is to offer safety companies and to not extort cash.” The menace actor additionally talked about that “I don’t set myself the duty of blackmailing anybody, extorting cash, or inflicting any injury in any respect.”
Determine 2: A menace actor seeks a enterprise companion for a vulnerability enterprise
The consumer claimed that “I unintentionally discovered myself on this state of affairs, raised some huge cash, and received an everyday consumer,” suggesting that the enterprise is already up and operating.
Different customers famous that “there’s nothing white about this, abnormal blackmail…similar as the way it’s good to beat somebody up on the road, after which provide him your karate class.”
Site visitors era
We famous a number of situations of schemes referring to synthetic inflation of visitors, both referring to web promoting, or to laundering/producing cash. Schemes included:
- A consumer who was receiving $10,000-20,000 passive revenue from spending $3,000-4,000 on “adverts on fashionable boards and mails to corps”
- A plan to artificially inflate Spotify streams to generate income
- A plan to drive visitors to OnlyFans profiles
- “Lead era” utilizing Fb
- Registering Telegram accounts “utilizing a bug” to generate passive earnings of 20,000-500,000 rubles a day)
- TikTok promotions associated to internet affiliate marketing.
Determine 3: A part of an in depth information on a technique for artificially inflating Spotify streaming income; the menace actor claimed to have “roughly efficiently mastered it and, one would possibly say, refined it” after discovering it “on one other discussion board six months in the past”
We additionally noticed a proposal to arrange a advertising/promoting company on a Tor hidden service. Whereas the proposer didn’t make the character of this company or its clientele clear, they did consult with “your individual service in a darkish theme.” This might point out that the company can be meant to advertise illicit companies, notably these on hidden companies.
Pornography
Webcam studios
We noticed an funding alternative (ROI: refund of deposit plus 25% of earnings) to assist scale up a webcam studio. The menace actor outlined the prices, defined how promoting would work, and acknowledged that the output shall be “English for Western audiences.”
One other webcam studio proposal was from a menace actor who had “5-6 rooms…searching for a franchise or enterprise plans…with approximate calculations.” Some customers debated the legality of this (“I learn a number of articles and judicial observe below Article 242 of the Legal Code of the Russian Federation. It appears tough to prosecute her for this exercise”) and suggested chatting with legal professionals. Others gave particular recommendation on how to join affiliate packages for promoting.
Determine 4: A menace actor seeks franchise or enterprise plans “for opening webcam studios”
OnlyFans
We noticed a number of threads on laundering cash/diversifying by way of OnlyFans. Some have been centered on low-level laundering and cashing out (“create an OnlyFans account the place you add AI-generated foot fetish porn…you can begin shopping for subscriptions utilizing your stolen bank cards/PayPal accounts”); others on making a revenue.
Determine 5: A menace actor outlines a scheme for making “simple cash” with OnlyFans
We additionally famous one menace actor, probably a ransomware affiliate, who famous that OnlyFans is a “excellent solution to launder with native ladies, we use for 10-20% of laundering ransom fee however when there’s sanctions it’s powerful…finest to make use of an LLC formation in America…purchase bitcoin with proceeds to financial institution and you’re good.”
Determine 6: A menace actor (probably linked to ransomware) suggests utilizing “native ladies” for laundering cash
We noticed an in depth proposal about “visitors administration” for OnlyFans, Frisk, Fansly, and ManyVids, suggesting “creating copies of highly effective porn websites that seem in searches for a lot of key phrases.” The put up outlined the price, promotional actions, estimated visitors per day, and extra.
Determine 7: A part of an in depth proposal for “investing in visitors administration instruments for working with OnlyFans, Frisk, Fansly, Manyvids”
‘Camming’
We discovered a prolonged thread by a consumer on how they made $2,000 a month “ewhoring” for a number of years. This included how you can cope with present playing cards and items, how you can cover your handle from clients, how you can make interesting content material, recommendations on reselling content material from different fashions, and how you can appeal to and retain clients.
Determine 8: A part of an in depth put up during which a consumer shares their expertise of “ewhoring”
Taking advantage of pornography
We famous a protracted dialogue about benefiting from pornography. This included:
- Recommendation on how you can recruit actors
- Recommendation on contracts
- Specific discussions about how “taking pictures pornography shouldn’t be a very nice course of”
- Discussions on legality, together with references to “unlawful strategies” and area of interest and unlawful types of pornography, together with bestiality
- An admission from a consumer that “we’re searching for our fashions, registering them on present fashionable webcams and getting a % of their actions”
- Detailed explanations of how affiliate packages and commercial schemes work – together with percentages, quantities, fee strategies, ROI, and extra.
We additionally noticed the next remark:
Generally they promote ‘a web based retailer administrator is required. A sociable lady with information of English.’ Candidates come, they’re advised that they may change into directors, however first they should learn to talk with individuals by way of the Web, sit in chat rooms, correspond in English, discuss, blah blah blah, they’re put in entrance of computer systems and for a couple of month they’re trampled and so they result in the truth that there is no such thing as a retailer, and so they should be porn fashions. Some individuals study this and depart, whereas others keep.
A few of this data could also be the results of insider information; one consumer famous that they “had talked to the fashions of this studio, and so they advised me.”
Playing
Funding proposals
We noticed a number of gambling-related funding proposals, together with:
- An internet site devoted to betting on the NBA for residents of the US and China
- A proposal to develop a poker bot much like the Pluribus AI bot
- An funding alternative (ROI: 50%) to “construct and launch a large-scale Bitcoin P2P betting platform.” As a bonus, the consumer famous that the discussion board neighborhood would carry out pentesting on the platform.
Determine 9: A menace actor seeks funding for his or her “massive scale bitcoin P2P betting platform”
A cryptocurrency lottery
One menace actor shared their experiences of collaborating within the moonpot.com lottery (the place customers deposit cryptocurrency right into a financial savings pot, earn curiosity, and are entered right into a prize draw), noting that it’s “like yield farming.” That they had gained round $2000 to this point, and sought different customers so as to add funds to extend their probabilities of profitable (“In case you…are afraid that I’ll run away together with your cash, I’m able to make a deposit on the discussion board equal to your switch”). The consumer included a screenshot displaying the precise quantity they gained on a selected date.
Determine 10: In a thread explaining a cryptocurrency lottery, a menace actor posts a screenshot displaying the cash they gained on a selected date
Prescription drugs
A menace actor famous that “there are numerous affiliate packages for promoting prescribed drugs in Europe and the US.” They expressed a need “to open my very own warehouse within the EU” and requested for recommendation on jurisdictions, pitfalls, “how rapidly will the cops react…in spite of everything, that is the sale of prescribed drugs with out prescription,” and which fee gateway/financial institution to make use of.
Determine 11: A menace actor asks their friends numerous, particular questions on “affiliate packages for promoting prescribed drugs in Europe and the US”
One other consumer famous that “you’ll be able to simply switch pharma from Russia to EU,” and that “cops will not be notably within the actions of pharmaceutical hucksters.” This consumer additionally acknowledged that “an acquaintance even ordered Xanax from the Czech republic to the Russian Federation.”
Determine 12: In the identical thread, different customers debate professionals, cons, and potential pitfalls
We additionally noticed a imprecise provide to promote “sports activities chemical substances” (probably steroids/enhancement medicine) wholesale.
Import and export
Automobiles
We noticed two threads on the import/export of autos: First, a consumer provided to “bypass customs clearance” and ship 5-10 vehicles per week from Europe “at European costs + my curiosity.”
Second, a menace actor provided “clear supercars/luxurious vehicles…on the market within the US for 50%…with full authorized paperwork and certificates of possession. The vehicles can be utilized for reselling/exporting/private use.”
Determine 13: A menace actor gives “clear supercars” on the market within the US
Items
A menace actor was thinking about getting concerned within the “Tajik community of Chinese language items” – “low cost Chinese language garments, sneakers and equipment with a markup of 200-400%,” a scheme which is “dominated by the Tajik diaspora.” Different customers steered speaking to “drop-shippers” (third-party order fulfilment specialists). One acknowledged “I do know the place to get counterfeits from completely different manufacturers…when you’re , write to me in PM.”
One other consumer mentioned: “I used to be as soon as carefully related to this” and supplied intensive, particular particulars on areas, prices, and the way the method works.
Uncommon schemes
We noticed some uncommon import/export companies, together with vintage Japanese katanas on the market. The consumer acknowledged that “scanned copies of certificates and images” will be despatched on request, “however solely in case you are actually able to buy.” The consumer listed six swords, together with one from the fifteenth century. “All the things is confidential, purchaser anonymity assured.” The provenance of the swords was unclear. (It’s price noting that artwork and antiquities could also be enticing propositions for cash laundering, notably on condition that some well-known public sale homes settle for cryptocurrency at chosen auctions).
Determine 14: A menace actor lists the assorted vintage Japanese katana swords they’ve on the market
We additionally famous the next reasonably cryptic put up in one other thread: “I’m searching for an individual/firm to move items from Russia to Turkey. Not medicine and never individuals!”
Miscellaneous schemes
License plates
We discovered an funding alternative in a automobile license-plate manufacturing outfit “in accordance with all the necessities of the visitors police!” Alternatives included a joint share, or a franchise (“I’ll present a web site, a advertising plan, promoting materials, accompanying documentation, gear, and determination of any points with the federal government. Enterprise entry from $20,000”).
Intelligence
We noticed an funding alternative from a identified menace actor who claims to be an “intel dealer.” The undertaking is “WikiLeaks-inspired” with the intention of “publishing delicate intel for numerous political causes to show corrupt regimes and to make clear sure injustices…along with all that, to fund my trigger and to maintain myself I promote sure units of unpublished intel as properly.”
Determine 15: A menace actor seeks funding for his or her “Wikileaks-inspired undertaking”
One other menace actor claimed to have “a number of secrets and techniques able to promote” concerning the Colonial Pipeline assault in 2021, together with “very darkish issues about corruption with politicians…every part is in paperwork and screenshots…I ask for this data: 15,000 USD in XMR.”
Jail inmates
We famous one unconventional proposal from a distinguished discussion board consumer who claimed to be concerned in quite a lot of ‘white’ and ‘gray’ companies, together with development and actual property. The thought was to outsource software program growth, {hardware} manufacturing, and cybersecurity to Russian jail inmates.
This proposal met with some derision (together with from one menace actor we suspect from unrelated investigations to be a malware developer), however others steered that it may work in some circumstances (e.g., writing crude malware).
Determine 16: A menace actor proposes utilizing jail inmates for “software program, data safety, devices, design”
Apparently, contemplating that many discussion board customers use ‘fenya’ (a dialect fashionable in Russian prisons), some have been disparaging about prisoners on this thread. Whereas some customers may see advantage within the proposal, others thought it will be unfeasible (we famous equally break up reactions to concepts by this similar consumer in different threads).
On this thread, customers uploaded three images of what have been purportedly the interiors of Russian correctional amenities. We have been capable of finding two of the images elsewhere on open supply, though the provenance of one other was unclear.
Determine 17: A picture uploaded by a discussion board consumer, probably displaying a room in a Russian correctional facility
Mission administration
We noticed an advert from a “undertaking supervisor with intensive expertise in creating numerous black and white tasks…I’ll make it easier to implement your undertaking at the very best value.”
OPSEC: Who they’re
Through the course of our analysis we gained an perception into what menace actors inform others they do for a dwelling (we famous just a few threads about this throughout numerous boards). Solutions included:
- Programmer
- IT specialist
- Freelancer
- Unemployed
- Web promoting
- Sports activities bettor
- search engine optimisation
- Safety marketing consultant
Residence permits
We noticed a number of customers providing to promote everlasting and momentary residence permits and citizenship for numerous international locations, together with Poland, Slovakia, Belgium, Portugal, Eire, UK, Bulgaria, Romania, Greece, USA, UAE, Cyprus, Malta, and extra.
Determine 18: A menace actor gives numerous residence permits on the market
In Half 4 of this sequence, we’ll focus on the outright legal (“black market”) enterprise pursuits we noticed throughout the 5 boards.
