Posted on Oct 20, 2020 at 7:09 am
Maze, FIN6, GandCrab, Mummy Spider… The nicknames in cybercrime are well worth those of drug and counterfeit gangsters. Sometimes close to mafia organizations and traditional cartels, these groups of unscrupulous computer scientists have also adopted their network organizations, united by commercial and mutual aid relationships.
It is on the “dark web” forums, where most Internet users never go, that cyberpolices and analysts from cybersecurity companies observe the reconciliations between these hundreds of groups of ten people each. These contacts seem fruitful when cybercrime is now reported to bring in 2.8 times more money than drug trafficking, according to calculations by Mike McGuire, a researcher in criminology at the University of Surrey.
Predation
“The most agile [et] those who earn the most money are probably the attackers [par opposition au budget de l’écosystème de la cyberdéfense]», Explained Guillaume Poupard, the Director General of the National Agency for the Security of Information Systems (Anssi), last week, at the opening of the Cybersecurity Conference in Monaco. “Organized cybercrime has today reached an unprecedented level of predation on a global scale”, laments Pierre Jeanne, the head of cybersecurity solutions at Thales, in the introduction of a report on the subject published by the French company in mid-October.
At the top of the pyramid, the “big fish” make the headlines of the daily attack detection centers. Maze and a few other groups have recruited the best technical experts, occasionally collaborate with spies, and are prepared to invest large sums of money in campaigns against multinationals. Obviously, their frenetic activity largely covers their stake, despite the competition that may also exist between rival groups.
$ 300 to $ 10,000 for a breach
But they don’t work on their own. A myriad of “suppliers” are busy selling them attack tools and sometimes even identify for a payment the loopholes that will allow the security of a solvent target to fall. Some of these subcontractors have themselves become giants of this illegal market, like the creators of the dreaded Emotet, which is very active in France.
This software, which is able to take part of the control of the affected computer, then allows its authors to sell other cybercriminals information useful for computer infiltration or to show them the way before the installation of ransomware, the scourge of the moment. According to an Accenture study, direct access to a company’s internal network sells for between $ 300 and $ 10,000, depending on the size and income of the victim.
