Although the Dark Web has been long known as a place where criminals operate, it has also become an attractive destination for aspiring cyber criminals. Many of these individuals are searching for jobs in which they can make money by exploiting vulnerable systems and victims. In fact, some estimates suggest that there may be up to 10,000 active job postings on the Dark Web at any given time. Many of these jobs are technical in nature, such as website and database hacking, malware creation, and cyber-espionage. Other postings offer less technical routes to earning money through scams, phishing attacks, and other malicious activities. You may also find postings offering rewards for stolen credit card information or other sensitive data.
In recent years there has been an increase in the number of cyber criminals offering dark web jobs especially in the year 2020 and beyond. These jobs can range from low-level cybercrime such as DDoS attacks and website vandalism to high-level activities that require specialised technical know how. According to a recent report by the Global Cyber Security Center, “the last year has seen a marked increase in Dark Web job postings from criminals looking for people with specific skillsets”. The pandemic has a significant part to play with majority of people working from home and being put on furlough through the midst of 2020. With this being the case, a lot of people looked for easy, extra money to earn through the pandemic and being at home 24/7, online work became more appealing.
Dark Web jobs offer a certain level of anonymity and flexibility. Cyber criminals are able to hide behind their computer screens, making it difficult for law enforcement to trace them. This adds a layer of protection that appeals to those who wish to commit cyber crimes without the risk of being identified or caught. The fact that these jobs can be done remotely also makes them attractive to those who are unable or unwilling to take on more traditional jobs. The financial side of it is also attractive: many dark web jobs offer high rewards for minimal effort, allowing cyber criminals to quickly amass large sums of money.
Despite the appeal of Dark Web jobs, there are many risks involved. Due to their anonymity and lack of regulation, these jobs can be difficult to trust and may involve criminal activity that could land you in jail if you were caught. Additionally, the money earned from Dark Web jobs is often untraceable and could even be used to finance further criminal activities.
In conclusion, it is clear that dark web jobs are becoming increasingly popular with cyber criminals. Although they offer anonymity and flexibility, they come with a wide range of risks that could land you in trouble if you are not careful. It is therefore important to exercise caution when dealing with any aspect of the Dark Web. To enquire about any of our services here at DarkInvader, enquire here.
Welcome to a Dark Invader ThreatBite your headline this afternoon: increasingly organised crime organisations are operating as businesses rather than criminal organisations.
Advertising jobs on the Dark Web with a number of advantages for members. A new research has analysed 200,000 job ads have been posted on 150 dark websites between March 2020 and June 2022. So kind of in the middle of the pandemic and it has been very interesting to see the kind of jobs they're advertising for salaries and the fact that there were many kinds of jobs like data analysts, malware testers. Everything you may think of that is useful for a cybercrime job was available today.
I am joined with Angel.
Thanks for coming on another episode.
Angel thank you for having me.
I'm always great having you on and marketing manager Lewis who will be discussing this new story alongside with Angel.
Lewis, I believe this is your first episode.
Yeah.
Thank you.
Good to have you on.
So my first question is who do you think these job advertisements are targeting? And do you think they are working like they are attracting the right people?
Well, yeah, I mean so it states that it was between january 2020 and june 2020 20 and I know that I peeked in the March time.
So this was primetime Covid and during covid, lots of layoffs and companies etc going on.
Yeah, so it peaked in the March and lots of cybersecurity companies laid off employees and etc and with that many people who were quite skilled in the sidebar industry, we're looking for jobs and things and that's when all of this occurred.
Given the need for money and things alongside the Covid meant that there were men that were resorting to the dark web to look for job opportunities and etc. So that's where a lot of the employees and things came from. But as well as that, lots of lots of graduate university students and etc, they came along and that was obviously them being quite skilled but struggling to find a job in the times that were during Covid, so that they were the majority of employees, the dark web and cybercriminals we're looking for.
So in your opinion, would you say that during, during the pandemic there was an increase in possible candidates?
Maybe somewhere in the ransomware gangs. I'm like, you know, I look at this from an outsider's view and I'm thinking, you know, has this just been going on anyway or did did the gangs actually put more emphasis in it because of Covid, and are they continuing to do it now?
So I think definitely within the COVID-19 pandemic, it definitely shot by an enormous rate, but I feel there were definitely still looking for people, but it was a lot more clothes like you have to know someone to to know someone to actually get in there and find yourself a job with covid hitting and things got to the point when people who would be laid off from jobs but go on these dark web forums and quite literally put the cv on there and be like I'm looking for a job I can do with this, I can do with that and that's how it occurred.
Yeah that was something I was gonna mention was I mean even I'm saying on twitter you know people screenshot in like the URL.
So on the dark web forums to to these like you know basically open CV for kind of looking for you know malicious tool developers, malware developers. I mean they're not even trying to hide it anymore. It just looks so blatantly obvious.
But is that an issue is like I think with the opportunities given as well that the skill level is not one that would need to be really through the roof because in terms of UK salary it's in comparison to a dark web salary it's it's undervalued a lot.
So if you were to be working in a legitimate job you could you could quite easily go over to the dark web forums and become a candidate and I know candidates get got paid like £300 and things just submitting to a test to prove that they were they were qualified to do these things and given the opportunity and the lust of these salaries and benefits is is on comparable or anything on the internet or in the world at the moment with cybercrime operations becoming more business orientated. The dark web remains a recruitment venue for threat actors seeking a reliable income.
What are the risks involved?
You always get caught.
I think everyone knows this at this point, you'll always get caught no matter if it's in the first week, the first day of 4 to 5 years down the line and on top of that, sitting on the dark web and adhering to these things can it can bring you into a very scary situations at times and some situations you will not want to be in and I think everyone can agree with that, you'll end up getting tied in with things and potentially getting extorted or blackmailed and being turned on by them people who pay your wages.
So in a nutshell, you saying that while while these jobs look glamorous, obviously there's a dark side to everything and while you know looking at this, I mean we've got, we've got a cut here, this is like with each successful Simon, you get a raise in an instant bonus, high salaries for the right candidates were available £100,000 per month in one list in 20,000 per one month and another, the median salary being around 1300 to 4 grand a month and that's for like I was saying earlier for The lower level kind of skills and I mean I can understand completely how 18 years old, coming out of uni or you've just finished an apprenticeship and you're getting playing around with tools and you know, I mean it's all available online now anyway, you don't you don't really need to be that much of always anymore how how appealing that could be.
It's like I think for you and this is something you can probably comment on is how readily available all the tools are now.
So you don't actually have to be this kind of genius kid that you know sat in his room and you know, I forget the name but the guy that went and worked for the FBI Snowden, like you don't have to be yeah, you don't you don't have to be that sort of guy anymore, Is that pretty accurate?
I mean lots of the tools are readily available all over the internet but in situations like this, you're creating your own tools and creating things that have never been seen before.
So when it does come to using it in a malicious standpoint people like the authorities and so on, They've never seen tools like this before, They don't know how to react how the work, how they're deployed, how they're encrypted etc.
So you're building tools on your knowledge and that's where that's where you're getting paid the most given it's all about ransomware in today's in today's era and about encrypting all and getting the most back from it and that's who they're looking for the most within these dark web forums like malware developers and just developers in general, like fishing to create websites like reverse engineers to break down other people's ransom ways to see how they went about it and how they can improve on top of theirs.
So it's deadly in a sense, you don't need to know a lot, but once you can learn it very quick and very fast louis what you mentioned earlier about them offering big sums of money, I think that then raises more flags. So I feel as though those positions are probably going to be less successfully recruited as they are just attracting criminals.
But when you are titling the role as developer data analyst or even designer then with a more moderate realistic salary, those would probably have more of a chance of success. I would totally agree.
Like angels just saying obviously there has to be those people that you know, make the tools, make them all design, you know, reverse engineer the ransom way to discover new ways to basically exploit companies. But the low hanging fruit, the people that know enough and can see these, you know, gross salaries that are just more than they're ever going to get, especially not to get political but especially in a kind of a we're in a time where you know, there's a shortage of job availability.
There's you know what's the phrase cost of living crisis if you're, if you're start home, not not to use the term like, you know, the mom's basement dweller kind of kind of vibe if you'll start there at 16 years old and you can do all this.
I mean, not to put any names out there, but I mean I probably know people that have probably been tempted by this, people that have probably probably now work at penetration testing companies or as developers or programmers for kind of tech companies who who have access to all this and 100% will be tempted.
For me it's just interesting, like I think, I think Angel mentioned about like the authorities, I mean what can they actually do?
Like if that's on the floor that's out there on the forums, is there no way they can stop it?
It is literally just like this, this almost like virus, like you can stop one, but like another 3000, they're gonna be pulled up in like 10 minutes, you know, is there actually anything they can do to try and stop this because it's obviously feels like a waste of such young talent getting pulled into this, this industry, there's certain things that can do, but in a situation like this, if if an organisation or a ransom work and can take down businesses by the day, I mean you're going to struggle trying to take down a few forum posts and things going through it.
But you brought up a great point about Them being young and being tempted and things.
There's no age restriction on this. So it's an easy thing to learn and pick up. There could be people out there 1314, campaigned for £40,000 a year and they're never going to change going to school and things and it's all remote and it could be getting paid £40,000 and no one would know.
So like it's a, it's a big thing and even even with all the benefits and things that come alongside it, like paid sick leave and flexible schedules so they could go to school and they could come back and I could still do all hours and things. So it's quite a lucrative scheme, I would say.
And you mentioned a great thing about people being lured into this and I can definitely agree with you.
And I feel like I know a lot of people who could, who may have been seduced in a sense to this sort of thing and I don't blame them, the numbers, everything the benefit. It's one and on.
But I think the smart guys always realize that you'll always get caught and it's not something you can do forever with a lot of things.I think, I know probably, I think we've probably got our sister company probably got a podcast about like that, the ransomware group and kind of following on from what you're saying that, you know, you will get caught like it's called the dark web after you're gonna get caught.
Especially the small fries, like the low hanging fruit guys that you're going to be the first to go, you're gonna be the first to get thrown under the bus.
I mean, I think we've had a few examples over the last 67 months, I think there was a hive and then is it Conti broke up completely and like they've just like dispersed all, I'm not quite sure off the top of my head right now, but you can see them all getting caught day by day and it's becoming a thing when people are just getting shut down and no one even remembers them, you know what I mean?
Like you do all that work, take all that money just for you to be shut down till we, people just like me not even remember if you're disbanded or not and I don't know if we have this information, but like what would the, do we know what the kind of prison sentence would be for something like this if you did actually stop a company or you did commit a successful ransomware attack on a business. I think it depends upon your situation within the operation.
Like as you said, low hanging fruit, the people who are posting the CVS and things on these forums. I know if I was in a position to be employing people, I would, I would be laughing in a sense if you post, if you're putting your CV and things on and you don't know who you're talking to when you don't know anyone in this industry already, they're going to purposely put you up and leave you, leave you dry in a sense.
And in terms of the, the guys much higher up, I mean their prison sentences are, they will vary by years and potentially even lifetimes just depending on, where it could be the difference of a step or a promotion unless they get hired by the FBI.
Yeah, yeah, that's a great point.
You mentioned, you know, with a lot of people who are under the age of 18, if you do end up getting yourself caught up in a cyber crime, like so cyber criminal sort of essence.
I know a lot of the time people from the government and authorities and things end up taking you in as almost like a talent trip, like a prodigy in a sense, you know what I mean?
So it's like, I could definitely see how it would be hard for a person under 18 to distinguish what the one to do if given an opportunity like this.
I think as well, like I'm got a bit of a film and tv again myself, but I mean it's almost like it's made to be cool like in the industry like, you know, you've got mr robot and countless films that show how cool and edgy and urban.
It like it is to be like and almost rewarding behavior like saying, yeah, if you get caught, but now now I'm working at, you know, Movies like James Bond but it's stupid but it is, it makes it look cool. I know that's half the reason a lot of people that we know that have maybe dabbled in breaking things and been a little bit naughty have done it.
So yeah, In terms of the films and things like you said, there's a very slim amount of films and movies and representations of how penetration testing and how it really is. Like you see the films and it's like 30 seconds.
I mean, I mean the green writing and everything is nothing like that. You could be sat on the computer for hours and hours and hours and not even find a single thing.
So I think my favorite, so when they get, you know, you've got like Mission Impossible or something, they get tasked with breaking into this huge like, you know, security firm, all the whistles and stuff.
And I think, I think the thing that I think that the thing that I find quite funny is like I've seen it and I think it's like Mission Impossible, which is by no means are based on true true events, the film, But you know, they get told to hack into like a company takeover, like get all the private information or whatever and they do it in, they literally like click a button and you've got a loading bar 80 90 100% get the memory stick, We've got it in reality that's like what, six month plan job at least like 13 people, you know, definitely is a chance that can happen
And I mean all this loading and when, when you're doing at a high level, it takes a lot to know.
And you really sort of need to be a guy that can take, acknowledging like a sponge.
You really need to understand what you're looking at and how you're going to exploit it And from an offensive side, you need to understand that all defensively first and you can't just go in like an attacker in football and just try shooting the goal.
You need to understand how, how the defense are going to react and etc.
So to get at the point when you just press about and even at the highest level that is quite slim also are they offering any benefits as well, like how you would get in a normal job like remote working for example.
Yeah, well most of it will be remote work because when you go into circles like that and things and you're never really going to be face to face with people.A lot of messages are going to be encrypted and things are going to be encoded and it's gonna be a long, it's gonna be a long process just to communicate with these people.
And I mean when it comes to something like this, the money in the cash flow that goes through a ransomware gang, it's like the money isn't really an object, so it's like paid time off and let all the rest.
And when it said before, I think you mentioned louis that, and as soon as your first job or your first, your first full execution of a job that it's an instant bonus or an instant promotion.
So it just goes to show that money is no object, the value, the value, loyalty confidentiality and knowledge within this industry.
Yeah, I totally agree with you angel.
Then offering benefits like flexible hours remote working. It makes it look like more of a professional job.
And, and those are all things that people are looking for in this day and age, like no one really wants to go into the office five days a week. I mean, I like coming into the office, I like seeing my colleagues, but to be fair, the majority of people don't really like coming into the office, especially the people, you know, more swayed to go in for a job like this are probably already, you know, not, not really your social, you know, Bubbly people.
Yeah, they're probably going to be excited to be able to just sit there and get on and get paid an absolute fortune but I'm not having to see anyone.
Yeah, I mean, yeah, it shows the appeal to the younger generation as well like how many people are going to school and just coming out of school who are just like the last place I want to be anywhere or that in my bedroom. I definitely agree when I was in high school and things that I was the exact same.
So it just goes to show how the lust that these jobs and things can get off.
I think that's like we did mention it but I think that is the biggest danger with it is just the fact that At that age at that kind of you know coming of age 15 to you know early twenties people are a little bit like that and if they get caught in this wheel before they've had time to kind of go into a nice job and and meet more people and and grow up as a person a little bit they will get caught in that in that kind of lull and this is just speaking more just from like from a social aspect, but once they get into that they won't know away really getting out of it and then they get caught in that machine and they either get caught, get brought in and make a deal or kind of, you know, smothered through like a talent agency with, with like all, you know, the authorities or something, I can definitely agree with that.
I feel like once you've dabbled in and you've seen the money and all the benefits, it's going to be so hard to bring yourself away from that.And it's one of them things when once you delve into it, you just your knees, you, there's no getting out.
And even if you managed to get out the guys who you've been doing working things with, you're going to be the first person there, throw under the bus, You've done one job, you're quite easy to just throw out the police and take the fall for a lot of things. I'll be right in thinking, you know, especially with some of the stuff that we cover that, surely these gangs have all the background information on these people.Surely, I mean they're loading the CVS that like, I mean this is, this is from your, your expertise, from my perspective, I think surely they know enough.
I mean, I think it depends on what getting uploaded and things like if people are putting the full names and things on there, you think they will get the job quite literally, but it, it depends because I know in terms of their security, they'll want, message over very secure things as well.
So it's, it's a connection between one person and another, they'll want their connection to be secure just as much as theirs.
But in a sense, if I if I was to be a head of an organization, etc, I definitely try to social engineering my way and finding who was on who, what's really going on below us.
Yeah.
So I think obviously we've covered quite a lot today.
But I think one thing that I think we probably should, just reiterate is while obviously these things do look great, you know, it's worth noting that the risks are just just far, far, far outweigh the benefits and you really don't want to spend the rest of your life behind the cell.
So yeah, if you're interested in getting a job like this, probably don't it?
You will always get caught.
It's just it doesn't matter how good the job looks like if it's on the dark web, you will get caught definitely any more final comments before we wrap up this podcast.
Guys, not for me.
I think we went through a lot.
Thank you for having us.
Thank you.
I think you both have mentioned some really great points today.
The risks involved, no matter how good the job looks, do not get a job on the dark web as there are many risks involved prosecution imprisonment facing arrest being framed and obviously there was a hive attack.
I was reading a report this morning.
The FBI are getting on top of all these dark web jobs now and who knows one of the FBI could apply for the job being undercover and I mean like just as we tie up will probably do a little a little bite on this book, they're really knuckling down.
The cyber industry is like growing every day, just evolving constantly and with it.
So the ransomware gangs and hackers that are out there and in turn the authorities are having to evolve and doing things like this, getting people inside that can do these sort of things in house.
It's only a matter of time before we start seeing more examples like Hive.
So as you said, it's just not worth it.
Yeah, just that, I mean, I know we're closing up and things, but it might have been the Hive one or the Lock Bit one, but I know one of the guys got arrested and Europol and the FBI and everyone were involved and even even on their lists and things, that was one of the top guys that were looking for.
So it just goes to show how much cybercrime really, really holds its foot in the world today.
Thank you both for joining me on today's episode and thank you to our threat bite listeners for tuning in, join me next week on another Dark Invader threat bite.
Unlock continuous, real-time security monitoring with DarkInsight. Sign up for your free account today and start protecting your external attack surface from potential threats.
Create My Free Account
DarkInvader, Calls Wharf, 2 The Calls, Leeds, LS2 7JU ©2024 DarkInvader, All Rights Reserved
