Trend Micro security researcher Max Goncharov has published a new report on Russia's underground online markets
The report reveals interesting facts about the country's dark web sites, as well as the services they offer.
When they first appeared in 2004, underground communities were used by cybercriminals to exchange information. However, they have slowly evolved into organized marketplaces used to trade all sorts of illegal goods and services. Experts point out that Russian underground actors specialize in selling traffic direction systems (TDSs) and providing pay-per-install (PPI) services.
Since some services and products are not as good or reliable, sellers and buyers are increasingly relying on escrows or “guarantors”, i.e. third parties who receive percentages of the sale price (from 2 to 15%) in exchange for ensuring the safety of both sellers and buyers.
Underground websites can have tens of thousands of unique members. These members rely on various methods (Tor and VPN) to maintain their anonymity, and are identified only by their nicknames and ICQ numbers.
The Russian underground market is just like any other business: Prices for products and services are set by supply and demand. For example, now that cybercriminals have come up with effective ways to steal payment card data, the prices of credit and debit cards have dropped significantly in recent years.
The same goes for stolen accounts. For example, the value of stolen Facebook accounts has halved between 2011 and 2013. On the other hand, there are some account types for which no significant changes have been observed (e.g. Gmail, Hotmail, and Odnoklassniki).
The full report “Russian Underground Revisited” is available on the Trend Micro website.
