Exploring Risk Avoidance Practices Among On-Demand Cybercrime-as-Service Operations

Abstract

Criminologists have recently explored online cybercrime-as-service markets where offenders offer hacking tools and services for a fee. So-called “stresser” or “booter” markets offering distributed reflective denial of service (DRDoS) attacks have been a recent target of international law enforcement action. Few have explored the ways in which these operations continued to function under increased enforcement and sanction. This study attempted to address this gap through a qualitative analysis of online advertisements from 44 booter and stresser operators. The findings revealed operators changed their preferred communications and payment platforms, as well as increased the attack methods available to customers. The implications of this analysis for our understanding of illicit online markets, and the decision-making processes of cybercriminals are discussed in detail.

An Assessment of Cryptomixing Services in Online Illicit Markets

“…Similarly, investigating cryptomixing providers may generate information about their customers, who could be pursued for criminal charges related to illicit narcotics or other illicit services as have been observed in other arrests of cybercrime service providers (see Holt et al, 2022;Hutchings & Holt, 2015). Such efforts may deter some mixer operators, or cause their customers to displace to other payment platforms which could have a general destabilizing effect on the illicit use of cryptocurrencies generally (see also Holt et al, 2022;Hutchings & Holt, 2017). Analyses of any law enforcement strategies would be vital to improve our understanding of the ways in which economic cybercrime can be affected by formal and informal mechanisms of social control and the degree of displacement that may occur (e.g., Newman & Clarke, 2003).…”

“…Vendors were intentional in conveying their ability to safely move large sums of money, demonstrating their care and preoccupation with security, reliability, and efficiency in service. Similar to other cybercrime-as-service vendors (e.g., booter and stresser operators), most cryptomixing services also stated that they did not retain customer logs of transactions, which is done to protect customers in the event law enforcement investigations and takedowns occur (see also Holt et al, 2022; Hutchings & Clayton, 2016). In addition, vendors operating on the Dark Web mentioned the security features inherent with functioning on the Dark Web which were not possible for Open Web operators.…”

“…Their existence also creates opportunities for investigation and prosecution under money laundering charges or violations of financial transaction laws (FBI, 2020). Similarly, investigating cryptomixing providers may generate information about their customers, who could be pursued for criminal charges related to illicit narcotics or other illicit services as have been observed in other arrests of cybercrime service providers (see Holt et al, 2022; Hutchings & Holt, 2015). Such efforts may deter some mixer operators, or cause their customers to displace to other payment platforms which could have a general destabilizing effect on the illicit use of cryptocurrencies generally (see also Holt et al, 2022; Hutchings & Holt, 2017).…”

“…including the sale of stolen credit card data (Holt & Lampke, 2010;Hutchings & Holt, 2015) and cybercrime-as-service tools (Holt et al, 2022;Hutchings & Clayton, 2016;Leukfeldt et al, 2017). Over the last decade, research has grown considering the practices of illicit online markets selling various physical products, including drugs (Aldridge & Askew, 2017;Demant et al, 2018;Munksgaard & Tzanetakis, 2022), firearms (Copeland et al, 2020;Holt & Lee, 2022a;Lee et al, 2022), and passports (Holt & Lee, 2022b).…”

“…Research exploring the operations of online illicit markets has grown substantially over the last two decades (Hutchings & Holt, 2017; Tzanetakis et al, 2016). There has been particular emphasis among researchers on economically motivated offenses, including the sale of stolen credit card data (Holt & Lampke, 2010; Hutchings & Holt, 2015) and cybercrime-as-service tools (Holt et al, 2022; Hutchings & Clayton, 2016; Leukfeldt et al, 2017). Over the last decade, research has grown considering the practices of illicit online markets selling various physical products, including drugs (Aldridge & Askew, 2017; Demant et al, 2018; Munksgaard & Tzanetakis, 2022), firearms (Copeland et al, 2020; Holt & Lee, 2022a; Lee et al, 2022), and passports (Holt & Lee, 2022b).…”