The Cybercriminals – from Nation State to Criminal Gangs

The Digital Age Criminal Business Model

Below you will find a very high-level overview of Cyber threat actors, and an explanation of why an SME can be targeted by highly sophisticated hacking tools, just as easily as a large corporate. 

This is not a list of the groups or the typical threats any one cyber group may pose but sets out to make all SMEs aware, in general terms, what they are up against.

Want to get a quick assessment of your organisation's vulnerability to these cyber threats? Take our free Cyber Health Check now.

‍

Nation States

The most well-funded and sophisticated hacking tools Western companies face originate, generally, in one of five Countries – China, Russia, Iran, Pakistan and North Korea.

These countries have developed “state proxy” hacking groups that provide plausible deniability of involvement in cyber attacks. 

Given state backing the groups have the time, motivation, resources and skills, to develop sophisticated forms of attack and hacking tools. 

Attacks can be designed and mounted for a variety of outcomes, using methods that may never have been seen before, so called ‘zero-day attacks’.

Nation State Proxies to Global Hackers

However, once the Nation State proxy has launched its attack, it is in many ways open and available to be studied and copied by cybercriminal gangs around the world. 

Hackers of all persuasions can now all see, access and build similar tools and malware to then use for purely criminal purposes. 

Indeed, some of the state proxies and criminal gang personnel are the same. Once the ‘states’ mission has been achieved the criminal gang is free to use the malware.

So, the highly sophisticated Nation State hacking tool is now available to use like a Martini – any time, any place, anywhere against any company.

And to make matters worse, the Cybercriminals operate in a sophisticated business-like way.

‍

Cybercrime Business Model and Supply Chains 

Cyber-criminal gangs/entities have grown ever more sophisticated as has their level of specialisation and interaction. 

They have developed an ‘as a service’ model, where they specialise in one core competency and interact with other gangs who provide their own core competencies. 

This results in a cybercrime supply chain which has carefully planned and compartmentalised business models. 

As cybercriminals create better revenue-generating business models, they need external people with very specialised skills. This results in a cybercriminal marketplace where different entities offer goods and services, which are exchanged on the forums where hackers hire and cooperate with one another. 

Want to learn more about building a cyber-resilient business that can withstand these evolving threats? Find out more in our blog post Building a Cyber-Resilient Business. 

The result is a marketplace where gangs know that they can’t do it all and remain economically viable. 

The result, for example, may be that gang 1 specialises in establishing beachheads on a company’s network, and gang 2 specialises in deploying the ransomware itself. 

A commission-sharing arrangement or some other form of payment for the “services” is agreed.

‍

Where is the Marketplace? 

It isn’t just on the so-called “dark web”. Instead, there is a set of websites, forums, platforms, and instant messaging channels that cyber criminals use to communicate. 

This can be accessed with a normal browser without having to go into the dark web. 

There may be a sign-in page, or an introduction made by an existing member to allow you to enter the sites, etc. Once in it’s a world advertising cybercriminal services and products. 

Criminal Business Behaviour and Reputations

Call-centres, payment terms and conditions are just some of the services cyber gangs offer to their victims, who they see as clients!

And reputations matter in a repeat business – If they have deployed ransomware and demanded a payment to release it, once paid they will want to be seen as doing what they said they would do. A reliable criminal!

Concerned about the increasing number of cyberattacks targeting small businesses? Our blog post Why Your Small Business is a Prime Target for Cyberattacks, and How to Fight Back offers practical advice on how to fight back and protect your organisation. 

Need help navigating the complex world of cybercrime and protecting your business? 

‍Contact Digital Oversight today for expert guidance and support.