Booming Dark Web Markets Fuel Phishing Growth
The dark web economy has a huge impact on phishing. New tools coming on the market can influence the scope and style of phishing attacks. The conditions in dark web marketplaces are especially relevant for social engineering efforts, and they’re very favorable to cybercrime right now. Abundant data is providing bad actors with abundant resources for conducting all sorts of phishing-related cybercrime including whaling, business email compromise, brand impersonation, credential theft and other socially engineered attacks.
How does your current email security stack up to the power of Graphus? COMPARE IT NOW>>
Innovation Isn’t Always a Benefit for Your Business
Credential harvesting tools are widely available and affordable, giving cybercriminals an easy way to use a phishing message to lure privileged users into providing their login. This can be easier to accomplish for cybercriminals than just phishing the general employee populace at a company. Many organizations do not require high-level users like executives, managers, administrators or senior staff to regularly undergo security awareness training, making them less likely to spot phishing messages. Executives are often leaders in the business community with robust social media profiles that provide cyebrciminals with easy routes to gain their trust.
But the vast majority of the information that cybercriminals use in phishing comes from the dark web. Even the software. Bad actors can quickly find many competitively priced options for premade plug-and-play phishing kits. For example, a popular Microsoft 365 phishing kit entered the marketplace in July 2021 and is currently on Version 4. In its newest iteration, it includes features that can detect bot scanning or crawling attempts and serve them harmless-looking alternative content as needed. Kits like this are extremely carefully crafted and can lure even cautious employees into making a cybersecurity flub. The malware developer was bold enough to announce V4’s availability on their “company” Facebook page in mid-2020.
In 2020 researchers reported finding at least eight compromised phishing sites hosting this V4 phishing kit – a statistic that raised the possibility that the sites were in use by multiple groups of cybercriminals. Further, researchers caution that these sites can be utilized to launch or support a wide range of phishing campaigns directed against CEOs, presidents, board members, and founders of companies around the globe including the US, UK, Canada, Hungary, the Netherlands, and Israel. This operation is big, but it isn’t completely unique. Over 60% of cybercriminals rely on spear phishing as their primary infection vector. Phishing attacks can be completely outsourced, just like hiring an outside contractor for other business operations.
Are your staffers taking the safe path to opening a new email? Check your habits with this guide>>
A Booming Job Market is Also Bad News
Just like the world economy, the dark web economy has experienced major shifts in the past year. A wealth of new employment opportunities have opened up and hiring is brisk for everything from jobs in major ransomware gangs to cybercrime-as-a-service gig workers. Demand for all kinds of skilled cybercrime work is high – experts estimate that 90% of posts on popular dark web forums are from buyers looking to contract someone for hacking services. An estimated 69% of hiring posts were looking for website hacking, while another 21% were looking for bad actors who could obtain specifically targeted user or client databases.
Researchers recently stated that 90% of posts on popular dark web forums are from buyers looking to contract someone for hacking services. Hacking a website can cost as much as $10,000. In the biggest category of the rest of those posts, a little over 2% of the dark web forum posts that they surveyed were made by cybercriminal developers who were selling the tools of the trade like phishing kits, keyloggers, password crackers, payment skimmers, malware, ransomware and other cybercrime tools. The abundance of workers and tools makes it easy for cybercriminals to outsource (or automate) part or even all of an operation while still reaping a profit.
Examine the nuts & bolts of the unique, patented technology that powers Graphus! EXPLORE IT>>
Cybercrime Resources Are Priced to Move
A popular way for cybercriminals to gain access to highly privileged accounts to use in business email compromise scams or hacking is to just buy it from someone who has already done the work for them. These records also provide a wealth of information that can be used for spear phishing. Successful phishermen are happy to sell access to executive accounts on underground forums for $250 to $500, and the market is still in its pandemic boom phase. Conducting spear phishing operations against remote or hybrid workers is a very attractive cost/benefit proposition as those workers are more likely to fall for phishing attacks. Between January 2020 and April 2021, digital threat activity increased by 9% month over month. Fraud and scam incidents online increased by 60% and that increase has held steady into 2021.
One thing that never goes out of style is fuel from phishing operations, like user records. Buyers especially love hacked databases from retail outfits, because they can be used to power brand impersonation schemes by easily reaching people with interest in a brand or product. Hacking these companies usually costs between $50 and $2,000 and custom databases are priced between $100 and $20,000, or between $5 and $50 per 1,000 entries. This spells disaster for many organizations – 60% of companies go out of business after a cyberattack, a number that can go much higher when direct financial hits are involved.
See how our 3 shields combine to give you luxe security at a bargain price. START SAVING>>
Graphus Stands Strong Against Dark Web Danger
Protect your business from the hazards of a growing cybercrime market and phishing boom with Graphus. The smart, AI-driven defensive boon that users receive provides a bulwark against many varieties of cybercrime including spear phishing, business email compromise (BEC), whaling, angler phishing, account takeover (ATO) and other phishing-based cyberattacks. Graphus also includes threat modeling capability. Plus, Graphus even takes out your trash by automatically deleting known threat messages and malicious spam without your IT team lifting a finger.
Don’t wait until the rising tide of phishing-related cybercrime comes to your door. Contact our experts today for a personalized demonstration of how Graphus can protect your business from the dark web phishing danger.
