There's big money to be madee on the dark web; cybercrime is generating at least $1.5 trillion in annual revenue, according to a new study.
Criminology expert Michael McGuire embarked on a nine-month study that focused on a key question: how much do cybercriminals really make?
What he found was a shadowy, but organized industry that's been making some people very rich. "This is not cybercrime as a business," McGuire said in a talk at the RSA security conference last Friday. "This is cybercrime as an economy."
McGuire interviewed 50 convicted or currently active cybercriminals, and spoke with dozens of experts from law enforcement, financial institutions, and IT security companies. He estimates that top cybercrime earners are raking in as much as $2 million a year. Mid-level earners, on the other hand, will pull in $900,000 on average. Low-income miscreants generally make $42,000 a year, but that's still more than recent college graduates in the UK, he said.
What's driving all this revenue? Ransomware, data breaches, and cryptocurrency mining have received most of the limelight when it comes to cybercrime. But according to McGuire, the big bucks are being made through the sale of illicit goods online, particularly prescription pharmaceuticals and counterfeit products.
These illegal sales—which can be done on dark web market places or on Amazon and eBay—can generate $860 billion in annual revenue.
Next in line was intellectual property theft, which generated $500 billion in revenue. This includes the mundane trade of digital piracy, in addition to underground online forums that sell corporate trade secrets.
In contrast, the ransomware market only pulled in $1 billion in annual revenue. The data trading market, which specializes in selling stolen credit cards and Social Security numbers, generated an estimated $160 billion. McGuire adds that the big earners in the cybercriminal world are usually running the online platforms that sell illegal goods, whether they be drugs or stolen credit cards.
How can any of this be stopped? McGuire pointed to a key cog in the cybercrime economy: money laundering. Cybercriminals are routinely trying to translate their illegal profits into actual cash, but stopping this could put a serious dent in their business.
According to his research, cryptocurrencies are only playing a small role in global money laundering schemes. Most cybercriminals prefer to use legitimate payment services like PayPal, Bitcoin ATMs, and Western Union. In some cases, money can also be laundered through internet platforms such as online games, Airbnb, and Uber. One cybercriminal can pay cash to another by simply opening an account on any of the platforms and pretend to buy a service.
"Law enforcement and cybersecurity professional need to get with these platforms and help get their act together," he said.
McGuire is a senior lecturer at the University of Surrey. The security firm Bromium sponsored his study.