Darkode: Recruitment Patterns and Transactional Features of “the Most Dangerous Cybercrime Forum in the World”

Abstract

This article explores the social and market dynamics of Darkode, an invitation-only cybercrime forum that was dismantled by the FBI in July 2015 and was described by a U.S. Attorney as “the most sophisticated English-speaking forum for criminal computer hackers in the world.” Based on a leaked database of 4,788 discussion threads, we examine the selection process through which 344 potential new members introduced themselves to the community in order to be accepted into this exclusive group. Using a qualitative approach, we attempt to assess whether this rigorous procedure significantly enhanced the trust between traders, and therefore, contributed to the efficiency of this online illicit marketplace. We find that trust remained elusive and interactions were often fraught with suspicion and accusations. Even hackers who were considered successful faced significant challenges in trying to profit from the sale of malicious software and stolen data.

Stolen account credentials: an empirical comparison of online dissemination on different platforms

“…Platforms could try to mitigate the risk of both rippers and law enforcement, whereas suppliers could specifically attempt to appear honest. The risk of dealing with rippers could partly be alleviated by platforms through admission and verification procedures (Dupont et al 2017;Hutchings and Holt 2015). The risk of detection by law enforcement is relevant for both platforms and potential hijackers.…”

“…The dissemination of stolen credentials and the wider demand for stolen data has resulted in thriving online markets as well as platforms where stolen data are distributed for free (High-Tech Bridge 2014). Previous research on underground markets largely focused on the economy of these markets (e.g., Allodi 2017;Benjamin et al 2015;Franklin et al 2007;Holt, Smirnova, and Chua 2016a;Kigerl 2018) or on how trust issues in these anonymous environments are solved through reputation systems and admission procedures (e.g., Dupont et al 2017;Mell 2012;Motoyama et al 2011).…”

Fraud Risk Management: Using Fraud Analytics to Combat External and Insider Threats

“…Armed with data from credit cards, fraudsters try to either initiate fraudulent transactions or sell the information in illicit marketplaces. However, buyers and sellers on such marketplaces know that it is only a matter of time before banks detect the fraud and cancel the cards and malicious actors have therefore begun to steal personal information, which, unlike credit card information, is not open to being changed or replaced (Dupont et al 2017). Significant data breaches at Yahoo and Equifax resulted in billions of records becoming available in illicit marketplaces (Smith 2018), making it possible for criminals to try to open new accounts or to obtain loans and other services under stolen identities.…”

“…Fraudsters either sell such stolen information and the tools used to extract it in illicit marketplaces (Dupont et al 2017) or leverage the data for illegal purposes, such as using social engineering and spear-phishing attacks to trick targets into providing confidential information, perform fraudulent transactions, or make it possible to install malware on victims' computers (Butavicius et al 2016). Spear-phishing differs from traditional phishingwhich involves sending email to a massive number of individuals but expecting only a small responsein that attackers have personal information about their victims and can target specific individuals within an organization.…”

Examining the Social Organization Practices of Cybercriminals in the Netherlands Online and Offline

“…Criminological inquiry on cybercrime has increased dramatically over the last decade, with some emphasis on economic-motivated offenses (e.g., Holt & Bossler, 2016; Yar, 2013). There are a range of cybercrimes that generate revenue for offenders through the theft and resale of information or the facilitation of fraudulent financial transactions, including phishing, computer hacking, and the use of malicious software that captures keystrokes and sensitive user information (e.g., Dupont et al, 2017; Holt, 2013; Holt & Lampke, 2010; Hutchings & Holt, 2015; Leukfeldt, 2017; Leukfeldt et al, 2017a, 2017b, 2017c, 2017d; van Hardeveld et al, 2017).…”