Trend Micro researchers released a new report about the Japanese Cybercrime Underground, a growing criminal community with its own distinctive characteristics.
The Cybercrime underground in general is a growing and profitable industry that is not affected by any crisis, as can be seen from the countless financial reports published from time to time by security companies and legal authorities.
We have previously reported on the criminal underground communities of Russia, China, and Brazil, which are considered among the top in the world and have often been the focus of security companies. Now, researchers at Trend Micro have published a new report titled “The Japanese Underground,”a criminal online community that is growing rapidly and has managed to have a highly stable underground economy.
According to the National Police Service of Japan, by March 2015 cybercriminal activities increased by 40% compared to the corresponding figures of the previous year. In June 2015, the Japan Pension Service suffered a significant data breach in which more than one million user accounts were exposed.
It has been discovered that the Russian underground community specializes in hacking and in scams involving electronic payments, the Chinese cybercrime underground community specializes in mobile scams, while the Brazilian underground community focuses on banking malware.
What is happening with the Japanese Cybercrime Underground community?
Researchers consider that Japanese cybercriminal rings are still fresh in the field and beginners, and this is due to the very strong legislation that exists in Japan for criminals. Thus the Japanese do not write malware because of the severe sanctions awaiting those who engage in similar activities.
Experts have observed that the Japanese Cybercrime Underground community is heavily involved in the illegal buying and selling of fake passports, drugs, weapons, stolen credit card information, databases of phone numbers, advice and child pornography. For example, a US passport, which is usually offered for $5,000-$6,000 on other black markets, can be obtained for as little as $1,000 on the Japanese market.
Even though the victims of Japanese cyber criminals are mainly in the country, the growing interest in DDoS tools/services and ransomware indicates that the actors are moving beyond their national borders to expand their profits.
Japanese players of the criminal underground exploit secured bulletin boards, and virtual PO boxes. The main payment methods are Amazon gift cards and Sony PlayStation Store codes. In some cases, experts discovered a Japanese BBS named Tor 2 Channel which displayed on its home page a warning that it had been seized by the FBI, Europol, and the US Department of Homeland Security Immigration and Customs Enforcement. In reality, the BBS is active and users can gain access by clicking on one of the country flags located on this page.
In 2014, online banking fraud cost $24 million, while the total cost of online fraud for Japanese banks was $13 million in the first half of the year.
In the image below, the sale prices in the Japanese Cybercrime Underground market are shown, as well as the sale prices for the same products in other illicit communities. A stolen Japanese credit card that has been verified by Visa is offered for $60, much more than the comparable cards from the U.K. and the U.S., which cost only $7-8. Prices for PayPal credentials are roughly the same across all countries, about $1-2 per account.
Japan was one of the countries that suffered the highest number of attacks based on the Angler exploit kit. In September 2015, approximately 3,000 high-profile Japanese websites were hit by a massive malvertising campaign.
What will happen in the future?
Experts have no doubt that soon the malicious users of the Japanese Cybercrime Underground community will start developing their own malware.
