Increasing dependency of the society on the information technologies raises concerns over vulnerabilities in cyberspace and the “dark side” of the information networks. The growth of digital operations in legitimate markets is one of the vital factors for the economic development. However, as markets and trading themselves have always attracted criminals seeking benefits from illegal activities, digital networks become a key enabler for the growth of cybercrime, both with regard to committing traditional crimes in the Internet and to developing new types of computer misuse.

Cybercrime has been evolving in line with how society uses digital networks, reacting to every development in the legal sector with the new approaches to committing offences. In the last decade, it has gone through the process of transformation from fragmented acts committed by individuals to increasingly sophisticated and highly professionalised activity. Moreover, cybercrime is believed to be on the stage of evolution into the fast expanding illegal industry where criminal activities are conducted by professional networks as long-term sustainable operations. Due to the newness of the phenomenon, there is still lack of research on how these networks in cyberspace are structured and how they operate. However, it is currently being discussed that we are witnessing the emergence of a new form of organised crime groups operating solely in cyberspace: groups which are not yet consolidated but dangerous nonetheless.

This article seeks to contribute the current research on this problem by examining the question of the possible transformation of cybercrime into a global, fast-expanding, profit-driven illegal industry with a new form of organised criminal groups thriving behind it. Firstly, the paper puts the issue of the increasingly organised on-line criminality into the context of general debate about organised crime in cyberspace. Secondly, it analyses the business models of underground economy of cybercrime. The third part of the paper focuses on the structure of the online criminal groups and their way of functioning. The paper concludes with indicating the legal problems of tackling organised cybercrime.

I. “Organised Crime” in Cyberspace or “Organised Cybercrime”? Two Sides of the Problem.

In the early days of cybercrime, the scene was mainly dominated by young hackers illegally accessing computer systems and breaking security measures just for fun or for demonstrating their technical skills.¹ With the development of digital economy both the criminal landscape and the motivation of offenders have changed dramatically. High rewards combined with low risks have made digital networks an attractive environment for various types of profit-driven criminals thriving on cybercrime.

The ongoing debate about the use of global information networks by organised crime groups revolves around two issues: cyberspace as a new medium for traditional organised crime groups and cyberspace as enabler for the new form of organised crime. On the one hand, it is believed that cyberspace can be used by traditional organised crime groups to carry out their operations.² On the other hand, it is argued that on-line criminals are nowadays shaping the new type of organised criminal networks.³

The problem of cyberspace as a new medium is related to the possibility of traditional organised crime groups to use digital network for their illegal activity. The basic ground for this discussion is the general assumption that traditional organised crime always seeks for “safe havens” offered by countries with weak governments and unstable political regimes.⁴ Cyberspace with its anonymity, absence of borders and the opportunity to commit offences without being physically present at the crime scene constitutes a perfect environment, especially when criminals can operate from countries that do not have proper legal frameworks and technical capabilities to fight cybercrime.⁵ While it is obvious that traditional organised crime groups can benefit significantly from the use of information and communications technologies,⁶ it is still not clear to what extend cybercrime can be attributed to the traditional organised crime groups. McCusker⁷ argues that this debate represents as a tension between logic and pragmatism, where logic postulates that traditional organised crime will engage in criminal activities in digital environment as they would in any low-risk and high-reward illegal business in the physical world; pragmatism, in turn, questions the necessity for traditional organised crime to step into this area and its capability to secure a return on investment and to produce the desired economic benefits.

A decade ago Williams⁸ argued that despite the growing evidence that traditional organised crime groups use the digital networks, organised crime and cybercrime would never be synonymous because the former would be operating offline and most of the cybercrimes will be committed by individuals rather than organised structures. Brenner⁹ also pointed out that there was indication that online crime was reaching the gang level of organization. Though the landscape of cybercrime has changed a lot since then, there is still no clear concept of the synergy between organised crime and cyberspace. Moreover, it is very hard to fit cybercrime into traditional concept of organised crime with its hierarchical homogenous structures.

To avoid confusion in the debate on organised crime in digital world, it is necessary to distinguish two different phenomena, namely, migration of traditional organised crime in cyberspace and organised groups focused on committing cybercrimes. The former is evident: Internet has already become a tool for facilitating all types of offline organised criminality, including child abuse, illicit drugs trafficking, trafficking in human beings for sexual exploitation, illegal migration, different types of fraud, and counterfeiting. It provides anonymity in communication; greater possibilities for advertisement and product placement as well as new money laundering schemes.¹⁰ However, some studies suggest that in the current era of organised crime exploitation of cyberspace by traditional organised crime groups coexists with organised structures operating solely in global information networks and committing only cybercrimes¹¹ and, thus, we are witnessing the evolution of a new form of the organised crime. Recent reports produced by security companies highlight the professionalization and sophistication of cyber attacks and financial crimes committed in cyberspace by these groups, suggesting this new type of organised crime is characterised with different, constantly evolving structures and new ways of using hi-tech tools to get illegal profit.

These two tendencies – the move of the organised criminality into cyberspace and the emergence of a new form of organised crime – do not exclude each other. They go hand in hand, giving rise to the synergy between traditional organised crime and criminal structures operating online. However, while the first phenomenon – namely, the use of cyberspace by traditional crime to facilitate its activities – has already been broadly discussed in the academic literature, there is a lack of research examining the new forms and structures of organised crime online. This paper further focuses on the latter issue, providing analysis of the model and structure of these new crime groups committing crimes mostly or solely in cyberspace.

II. Ecosystem of Cybercrime: Business-Model of Operations

1. Business Models of Cybercrime

Illegal activities online, such as credit card fraud, trading compromised users’ accounts, selling banking credentials and other sensitive information, have given rise to the increasingly sophisticated and self-sufficient digital underground economy.¹² Specific Internet forums and communications channels are used as underground marketplaces for the trading of illegal goods and services.¹³ Any data traded on these shadow platforms has its own monetary value.¹⁴ This value represents an illicit commodity, intangible and easily transferrable across borders. It drives the development of illegal markets: Specific criminal activities have been developed and are being constantly improved to steal sensitive information (e.g., phishing, pharming, malware, tools to attack commercial databases). Online criminality includes a broad spectrum of economic activity, whereby various offenders specialize in developing specific goods (exploits, botnets) and services such as malicious code-writing, crimeware distribution, lease of networks for carrying out automated attacks or money laundering.¹⁵

Cybercriminals are increasingly structure their operations by borrowing and copying business models from legitimate corporations. Cybercrime business models were similar to those of high-technology companies in the early 1990s because digital criminality was still in its infancy. But since the early 2000s, cybercriminals have developed patterns imitating the operations of companies such as eBay, Yahoo, Google, and Amazon.¹⁶ One factor indicating the current maturation of the cybercrime industry is the degree of professionalization of the IT attacks, for example fraudulent activities such as classic phishing, which is becoming the greatest identity-theft threat posed to professional businesses and consumers.¹⁷ Another factor is the increasing specialization of perpetrators,¹⁸ which means that cybercrime involves the division of labour. Other factors include the sophistication, commercialization, and integration¹⁹ of cybercrime.²⁰

It is argued, though, that there is a difference between cybercrime business models and legitimate business in terms of core competences and important sources: While the latter is aimed at creating the most value for customers, cybercrime involves defrauding prospective victims and minimizing the risk of having illegal operations uncovered.²¹ However, if one considers cybercrime as a model establishing a relation between the supplier of illegal tools and services and the customer who uses these tools to commit the crime against the victim, this difference does not have much significance: Cybercrime business models are focused on providing the most value for the “consumers,” who are not the victims of crimes but of the criminals using the tools.

2. “Criminal-to-Criminal” and “Crime-as-Service” Models

Technological developments, research, innovation, and the transformation of value chains into value networks has driven the globalization of the legal sector and has affected the organizations, making them more decentralized and collaborative, with regard to external partners. In the same way, innovation has fuelled the creation of new patterns in criminal ecosystems, with regard to product placement, subcontracting, and networking.²² Cybercriminals employ schemes similar to the legitimate B2B (business-to-business) models for their operations, such as the highly sophisticated C2C (criminal-to-criminal) models, which make stolen data and very effective crime tools available through digital networks.²³ Computer systems’ vulnerabilities and software are exploited to create crimeware: “malware specially developed with the intention of making a profit and which can cause harm to the user’s financial well-being or valuable information”.²⁴ These crimeware tools such as viruses, Trojans, and keyloggers offer criminal groups the flexibility of controlling, stealing, and trading data.

Automation plays a significant role in the development of C2C models. Automation tools use technology to avoid the operational requirement for physical groupings and force of numbers.²⁵ The core of the automation is a system of botnets: networks of compromised computers which can be controlled by the perpetrators remotely and used as “zombies”. Users are usually not aware that they computers are infected with the malware and serve for the purpose of criminal networks. With a botnet, cybercriminals can make use of many compromised and controlled computers at the same time to launch large-scale attacks on private and corporate systems, send spam, disseminate malware, and scan for system vulnerabilities. Without botnets, they must target victims and machines manually and individually which would have made attacks too costly and time-consuming.²⁶ In this regard, the possibility to infect computers and turn them into “zombie” networks was one of the main factors in transforming some types of cybercrimes, such as phishing, into a worldwide underground ecosystem which is run, supposedly, by organised groups.²⁷

Crimeware is also used to deploy Crime-as-a-Service (CaaS) as a part of C2C business models: the system of trading and delivering crimeware tools. The trading of botnets has become a high-revenue activity in the underground economy, specifically concerning Crime-as-a-Service models. Criminal organisations offer botnets for relatively low costs, profiting from the turnover based on the number of “customers.” Moreover, as one of the logical shifts in adopting business models from legal economy, criminals started employing the policy of price differentiation, moving from static pricing lists to the flexible pricing schemes with discounts and bonuses.²⁸ In addition, they nowadays offer different packages of the same products depending on the service. For example, in 2012 the basic package of Distributed Denial of Service (DDoS) bot Darkness by SVAS/Noncenz cost $450. The same botnet was offered also under “Bronze”, “Silver”, “Gold” and other options which included, depending on the price, free updates, password grabbers, unlimited rebuilds, and also discount for other products.²⁹ The costs of DDoS attacks vary from $5 for one hour to $900 for one month of persistent attack. 5-15% discounts are offered on the return policy base.³⁰ These costs are relatively low compared to the criminals’ financial gains: the estimated revenue of crime groups using botnets range from tens of thousands to tens of millions of dollars.

In addition to the botnet trade, there is another emerging core service related to “Crime-as-a-Service” models of operations, namely, Pay-Per-Install (PPI) service which has become a key growing area of the underground economy.³¹ This service has been developed to meet one of the vital demands of illegal market – infection of computer systems via digital networks. It outsources the dissemination of malware by determining the raw number of victims’ computers that should be compromised within the budget of the “customer”.³² A single PPI service can partner with thousands of affiliates which are paid for the number of malware installs. A typical affiliate can supply more than 10,000 install per months which can generate millions of infected computers for illegal business including thousands of affiliates.³³ This business might be very profitable for affiliates: for example, Trend Micro reported about an affiliate who generated $300,000 from rogue AV installs in only one month.³⁴

As yet another advanced step in the development of underground economy, tools-supplying business models are also used to share the techniques to commit cybercrimes. For instance, by creating “customer” systems where instruments are available on demand, the owners of the server with crimeware allow “users” just log into the server and choose from the range of tools suitable for fraud, phishing, and data-stealing and then download them. Less skilled criminals can buy tools to identify vulnerabilities, compromise system and steal data. More sophisticated offenders can purchase malware or develop custom tools and scripts on their own. When user data is stolen, criminals can use crimeware servers to commit organised attacks. These servers also allow for controlling compromised computers and managing the stolen data.³⁵ Furthermore, the next generation of business models started offering such services as licensed malware and technical support for illegal software and tools.³⁶

3. Money Laundering and Money Mules

The final and essential part of the cybercrime business model is monetization of illegal commodity (stolen data and information). For this purpose cybercriminals use “money mules”. Mules are usually recruited via spam or false job offers, promising high commission: between 3% and 5% of the total money laundered.³⁷ Their goal is to open a bank account, or sometimes use their personal account, and transfer the cash, very often in different jurisdictions than those in which the crimes have been committed.³⁸ The mules are the visible “face” of the organised cybercrime³⁹ because they are particular individuals turning the data into money, and thus can be easily captured by law enforcement. Some studies consider them to be yet other victims of cybercrime because they might not be aware of the fact that they take part in criminal operations.⁴⁰

It has been argued that “money mules” are the main bottleneck of underground economy of cybercrime.⁴¹ Cybercriminals face the same problem as any organised crime groups with cash-out operation involving money mules: there are not enough of them in service. The ratio of stolen account credentials to available mule capacity concerning digital crimes could be as high as 10,000 to 1.⁴² The lack of money mules is given to the fact that they usually can operate only for a very short time before they are either abandoned by their handler or revealed by the law enforcement. As an underground digital economy continues to expand, it will be increasingly challenging for criminals to maintain a necessary level of supply of these temporary “workforce” to profit fully from their illegal activities. Many sophisticated techniques have already been developed to deceit people into being hired as mules, such as masking the supposed illegal activities as legitimate services, for example, help in a job search.⁴³ It is very likely that the scam techniques for hiring money mules will continue evolving.

III. Crime Networks in Cyberspace: Reconsidering the Traditional Concept of Organised Crime Structure

Though it is already evident that cybercrime is evolving into big profit-driven illegal industry, it is still uncertain to which extent this market is dominated by the organised structures and to which extent they can be called organised crime. Indeed, it is very hard to fit the new form of organised on-line criminality into the traditional concept of organised crime because the structure of these new groups differs from what is traditionally attributed to the organised crime. Traditional organised crime groups are considered to be ethnically homogeneous, formally and hierarchically structured, multi-functional, bureaucratic criminal organisations.⁴⁴ In contrary, cybercrime has never gone through this stage of organisation during its evolution. It moved from individual and fragmented criminal activities to the models employed from the modern corporate business⁴⁵ but the structure behind this criminal business marks “the cleanest break to date from the traditional concept of organised crime groups as hierarchical”.⁴⁶ The most common view on the structure of organised criminal groups is that they represent flexible networks formed by high-skilled, multi-faceted virtual criminals.⁴⁷

As it was mentioned afore, Internet is used either as a medium or a sole platform for operation by both new and old types of organised crime. They can coexist without disturbing each other because of the very specific characteristics of Internet crime. One of the core characteristics of traditional organised crime groups is that they violently maintain a monopoly over their assets and territory to control certain scarce or illegal commodities on the black market.⁴⁸ The commodity at the illegal market is stolen, intangible data which circulate in borderless cyberspace. Obviously, cybercrime groups do not require control over a geographical territory – the concept of geographical control would not work due to the specific environment where the operations are taking place. Furthermore, cybercrime does not require a lot of personal contacts between members or enforcement of discipline between criminals. Again, any discipline would be hard to enforce in the cyberspace due to the lack of control mechanisms. Thus, the groups operating in cyberspace have less necessity for a formal organisation.

Moreover, the classic hierarchical structures of organised crime groups may even be unsuitable for organised cybercrime.⁴⁹ The new type of the organised crime in digital environment is less competitive⁵⁰ and its model of competition is rather similar to the modern corporate world with pricing strategies, service-based competition, innovation and “customer care” policy. The power of the criminal group is in the strength and sophistication of its software, not in the number of individuals.⁵¹ From this point of view, automation techniques in committing cybercrimes played a vital role not only in the development of the underground criminal industry, but also became one of the core factors determining the structure of the groups: with the automation the power focus shifted from people to technical tools.

On-line crime groups are believed to be more flexible compare to traditional organised crime groups, allowing for the incorporation of members for limited periods of time due to their flexibility.⁵²These networks are structured on a “stand alone” basis, as members of the groups are often not supposed to meet.⁵³ They mostly rely solely on electronic communications and sometimes members do not have even virtual contact with their fellows. It is supposed that the majority of them carry out criminal activities using a number of web-based forums devoted to online crime⁵⁴ or Internet Relay Chats,⁵⁵ anonymous channels where member know each other only by their nicknames.

Both web forums and IRC channels are operated by administrators and serve the same goal of being a platform for illegal activities. However, forums seem to be more sophisticated ways of organising criminal activity online, because they have a peer-review process that every potential vendor needs to go through before status is granted to ensure that only trusted people get access to the illegal goods and services traded on the underground markets.⁵⁶ In contrast, virtually anyone can use IRCs for advertisement, which makes them more inclined to admit law enforcement agents or unreliable criminals. As a solution, IRCs offer services to check the validity of the data offered for sale.⁵⁷

Speculation and debate as to the professionalism and organisation of criminal groups online are actually fuelled by the nature of such forums, because they can be considered more as tools for collaboration between individuals loosely connected to each other than as platforms for highly organised groups.⁵⁸ Nevertheless, it is obvious that there is a certain level of organisation occurring on these platforms, at least on the administrative level. Moreover, recent studies argue that there is an incorrect assumption that organised crime in global networks is organised only on administrative level or relates only to distributed non-hierarchical “networks” with no links to traditional organised crime families. They point out that there is already a movement toward long-term organised crime activities in cyberspace.⁵⁹ For example, Symantec experts state that there is significant evidence that organised crime is involved in many cases involving the online underground economy.⁶⁰

Concerning the size of the cybercrime groups (or networks), the estimates vary from 10 to several thousand members, when the affiliated networks are incorporated into the bigger and more complex structures. Regardless of the number of members and affiliates, virtual criminal networks are usually run by a small number of experienced online criminals who do not commit crimes themselves, but act rather as entrepreneurs.⁶¹ The criminal structures collaborate in teams where the roles are defined and the labour is divided.⁶² For instance, the first group writes malicious code, such as the “Trojan”; the next group is responsible for the distribution and use of malicious software on the Internet; while another group collects data from the illegal platforms and prepares everything for the identity theft. This data may then be used by other groups of offenders: they can be either sold or supplied as a part of collaboration efforts.⁶³ The leading members of the networks divide the different segments of responsibility (spamming, controlling compromised machines, trading data) among themselves. There are some “elite” criminal groups that act as closed organisations and do not participate in online forums because they have enough resources to create and maintain the value chains for the whole cycle of cybercrime, and therefore have no need to outsource or to be engaged as outsiders into other groups.

Due to the fact that the cybercrime industry, though being already powerful, is still in the early stage of its development, there is a lack of data related to this phenomenon, especially concerning the actual level of its organisation. Thus, the main problem of assessing the structure of organised cybercrime groups is that there is much more information about what they are doing – or can possible do – and what harm they can cause than about who is behind those groups.⁶⁴ Moreover, it is assumed that a single individual or group of perpetrators can play separate or simultaneous roles (developers of malware, buyers, sellers, enablers, administrators) in the cybercrime economy, which makes the structure of the illegal market “complex and intertwined”.⁶⁵ Recent studies on the organised criminality pointed out that new digital crime is being organised, though it has not yet been consolidated.⁶⁶ Thus, we are now witnessing the process of evolution of organised cybercrime; and the results are still unforeseeable.

IV. Conclusion: Addressing the Problem

Fighting cybercrime has always been a complex task. It extends beyond the national borders and spans different jurisdictions.⁶⁷ Committing crime in cyberspace is easy, fast and relatively safe for cybercriminals: intangible computer data can be fast and easily transferred around the globe via computer networks while offenders have no need to be present at the same location as the target.⁶⁸ At the same time, cybercrime investigations take a lot of time and efforts due to the international scale of the crime.⁶⁹ While information society is struggling with the problem of harmonisation of cybercrime legislation and cooperation on operation level to investigate crimes and prosecute cybercriminals, organised criminal groups in cyberspace, both traditional ones and those operating solely online, remain – and probably will continue to remain – several steps ahead of legislators and law enforcement agencies. C2C networks are very likely to continue benefiting from anonymous communications, automation of attacks, and the difficulties that law enforcement agencies experience in determining locations: servers with crimeware could be in one country, while members of the network could be in another one targeting victims across the world.

In addition to strengthening the current legal frameworks, updating old legislation, and harmonising laws on an international level, what is needed is also cross-sector cooperation on the national level as well as international cooperation in detecting, investigating, and preventing e-crimes committed by organised criminal groups.⁷⁰ The development of a comprehensive understanding and a forward-looking approach are required, since fighting organised cybercrime seems to be a moving target. The main goal is to tackle not only the top of the iceberg like money mules, but also those who are behind the visible face of the underground economy. In this regard, the study of the organised on-line crime phenomenon should help to determine the core nodes of the networks: for example, targeting the writers of malicious codes is more effective than targeting affiliates operating in the “pay per install” market, legal frameworks and operational measures aiming to take down botnets’ control-and-command centres might be more effective that tackling those who are at the end of botnet distribution chain.

In the borderless cyberspace, international collaboration between the states is the key. While some states just do not have the necessary tools to respond to the activities of the organised cybercriminals, or they may lack the technical skills or face legal drawbacks,⁷¹ the organised cybercrime can always find the safe digital havens. The development of a common understanding that no country can be safe alone in the global ICT network is very important. The problem of the legal harmonisation can be solved only on the global level.⁷²

Since there is yet no clear understanding of the phenomenon of organised crime groups in cyberspace, it is very hard to tackle this developing problem. The process of elaboration of specific legal strategies to tackle on-line organised crime groups is still mere in its infancy. With the absence of a global strategy to counter organised cybercrime, the problem is very likely to deepen in the foreseeable future. With the development of ICT networks and the opportunities they offer, organised criminal groups will benefit from the entire range of tools and models available to legitimate economy sectors. The information’s availability not only makes more accessible to organised groups, but also easier for them to foster and automate their fraud-committing activities. It would also probably link more opportunistic criminals to existing criminal networks.

Cybercrime might be going through a transformation into an organised illegal industry, where syndicates are highly sophisticated and are very hard to identify. Some cybercrime industries might end up to be run solely by organised criminal groups that are constantly seeking the newest technical solutions and the creation of new markets. As a result, it is likely that the cybercrime ecosystem will soon be dominated by criminal organisations, as cybercrime networks that have already become international will multiply the opportunities and reach to a global scale by exploiting the weaknesses of legal frameworks while searching for safe havens in countries with fewer resources to detect and fight them. In this regard, the problem shall be addressed by developing long-term responses that would include coordination and harmonisation of efforts on both the national and international levels.