10/25/2023
Exploring the Operations of Cybercriminal Organizations
In this report, we delve into the inner workings of cybercriminal organizations, shedding light on the day-to-day activities of their members and the evolution of hierarchies within these groups as they grow. As we examine this landscape, it becomes evident that these entities are increasingly mirroring legitimate businesses in their operations.
Small Cybercrime Groups
Small-scale cybercrime groups typically operate on a partnership model, often composed of a handful of members who, in addition to their criminal endeavors, hold day jobs. This dual existence as both legitimate employees and cybercriminals highlights the adaptability of these groups. In most cases, such groups have only one management layer, comprising 1 to 5 staff members, and an annual turnover of less than US$500,000. Notably, they are highly likely to collaborate with other criminal entities, forming partnerships that amplify their operations.
Medium-Sized Cybercrime Groups
Moving up the ladder in terms of size and complexity, medium-sized cybercrime groups exhibit a more structured approach. Their members are dedicated full-time to the group's activities, managing various tasks during an eight-hour workday. With typically two management layers and a staff ranging from 6 to 49 employees, their annual turnover can reach up to US$50 million. These groups often adopt a pyramid-style hierarchy, with a single individual overseeing operations.
Large Cybercrime Organizations
The largest and most intricate cybercrime organizations function in ways that closely resemble legitimate corporations. Their members work from home, adhering to rigid schedules, and maintain regular communication with line managers, akin to remote workers in corporate settings. These organizations are characterized by three management layers, comprising 50 or more staff members, and an annual turnover exceeding US$50 million. They prioritize operational security (OPSEC) and frequently collaborate with other criminal entities. The leaders of these organizations are seasoned cybercriminals who hire a range of specialists, including developers, administrators, and pe*******on testers, often employing short-term contractors. Some large cybercrime organizations even establish corporate-like departments, such as Information Technology (IT) and Human Resources (HR), while implementing employee programs, including performance reviews.
The Implications for Investigators and Law Enforcement
Understanding the size and complexity of a criminal organization holds invaluable insights for investigators. It assists in identifying the specific types of data to focus on during investigations, aiding in the pursuit of cybercriminals. Moreover, the knowledge of a targeted criminal organization's size enables law enforcement agencies to make informed decisions on which groups to prioritize. By doing so, they can maximize their efforts and have a more substantial impact in the fight against cybercrime.
For further inquiries or assistance, please contact Cyberlytics.
