Why Cyber Crime pays: The business model behind the hackers

We tend to picture a cyber criminal as some lone teenager, hunched over a laptop in a dark bedroom.

Forget that image. Cyber crime today is run more like a business than a hobby run from a bedroom, and that’s exactly why it’s making so much money.

It's estimated that cyber crime costs the world trillions of pounds every single year.

That's not small change, and it's not an accident. Cyber crime is profitable because the maths behind it works brilliantly in the criminal's favour.

This is the big one. A burglar has to physically turn up at your house, which means there's a chance of being seen, caught on camera, or disturbed. A cyber criminal can attack you from the other side of the world, hiding behind VPNs, the Tor network, and cryptocurrency payments that are hard to trace back to a real person.

A VPN hides your real location by routing your internet connection through another server. Tor does something similar, but bounces your connection through several servers to make tracing even harder.

And even if a victim reports the crime, which country's police force deals with it? Whose laws apply? Some countries simply don't extradite their own citizens for cyber crime, and a few quietly turn a blind eye as long as the criminals aren't targeting people at home. Low risk of prosecution means high confidence for the criminal.

A burglar can only rob one house at a time. A cyber criminal can send the same phishing email to ten million people in one click, and it costs them almost nothing extra to send it to the eleventh million.

Once the tools are built, automation and bots do all the hard work. There's no extra "labour cost" for each additional victim. Compare that to any physical crime, where more victims means more time, more risk, more effort. Cyber crime doesn't work like that. It's the criminal equivalent of a factory production line.

This might be the bit that surprises people most. You no longer need any real technical skill to become a cyber criminal.

There are ready made ransomware kits, phishing kits, and malware you can simply rent, a bit like renting software for your business. This is often called Cybercrime-as-a-Service. Someone else has written the malicious code, and all the "customer" needs to do is point it at a target and click go.

There are also Initial Access Brokers, criminals who specialise in breaking into a company's network and then selling that access on to someone else, who then decides what to do with it. It's a proper division of labour, just like any legitimate supply chain.

The dark web marketplaces that cyber criminals use often look and function like Amazon or eBay. There are seller ratings, reviews, customer service, and even escrow services to make sure buyers and sellers both trust the transaction.

Different criminals specialise in different jobs; some write the malware, some negotiate ransom payments, some launder the money, and some just recruit "money mules" to move funds around. Nobody needs to be good at everything. They just need to be good at their one part.

Stolen data is treated exactly like a commodity. Usernames, passwords, credit card numbers, and personal information get bought and sold in bulk, the same way you'd buy stock in bulk for a shop.

Cyber crime isn't just about ransomware, although that's the one that makes the news. There's a whole menu of ways for criminals to make money:

• Ransomware - lock up your files and charge you to get them back

• Business Email Compromise - trick a business into paying a fake invoice

• Data theft - steal and resell personal information

• Crypto theft - steal cryptocurrency directly, or hijack someone's computer to mine it for them

• Extortion - and if you won't pay to get your files back, they threaten to publish your stolen data too, and sometimes contact your customers as well

That last one is called double extortion, and it's becoming more and more common. It gives the victim two separate reasons to pay up, not just one.

For a lot of businesses, paying the ransom is thought to be the cheaper option compared to the cost of days or weeks of downtime, lost customers, and reputational damage. Not that you have any guarantees that the criminals will stick to their side of the bargain. Once you have paid the ransom they might just quietly disappear, or ask for even more money.

And many businesses quietly pay and never report it, because nobody wants their customers finding out they got hacked. That silence works in the criminal's favour too.

Even when cyber criminals are caught, and it does happen very occasionally, the penalties often don't come close to matching what they made. And the legal system moves painfully slowly compared to how fast criminal tactics evolve.

By the time a law catches up with one type of scam, the criminals have already moved on to the next one.

Some of the bigger cyber crime groups genuinely operate like companies. They have recruitment, performance targets, and even affiliate programmes, where one gang builds the ransomware and other criminals "sign up" to use it in exchange for a cut of the profits. This is known as Ransomware-as-a-Service.

Some groups are even believed to be tolerated, or quietly backed, by certain governments, as long as they don't target their own country. That gives them a level of protection an ordinary criminal gang could only dream of.

None of this means you're helpless. It just means cyber crime isn't going away any time soon, because right now, the numbers stack up too well in the criminal's favour. Low risk, huge scale, low skill required, and multiple ways to get paid.

The good news is that most cyber crime isn't clever. It's opportunistic. It relies on you making a few common mistakes, that the majority of small businesses are all making.

But make yourself a slightly harder target than all the other small business, and the hackers and cyber criminals will pass you by, moving on to an easier target.

And over the next few months I’m going to explain, in a series of articles, short notes, and podcasts, exactly how as a small business you can “Stop the hackers”.

Chris

#TheAntiVirusGuy and
#TheDataBackupGuy and
#ThePasswordGuy
at ASL Computer Services

💻 Helping entrepreneurs, the self employed, and small business owners stop viruses and cyber attacks.