The wages of sin aren't that great if you're a developer choosing the dark side
(2023/01/30)
- Reference: 1675115106
- News link: https://www.theregister.co.uk/2023/01/30/dark_web_it_employment_kaspersky/
- Source link:
Malware developers and penetration testers are in high demand across dark web job posting sites, with a few astonishing - but mostly average - wages.
This, according to a two-year [1]analysis by Russian security house Kaspersky of 227,000 job listings on 155 forums collected between 2020 and 2022. The report found that many ads mirror the style of legitimate IT job postings but with a couple big exceptions: all the work is remote by default, and - for obvious reasons - there are no formal employment contracts for these illegal gigs.
So if you were to get a job as a ransomware developer, don't be too surprised if your employer stiffs you after you've helped extort millions of dollars from a hospital or public school district. In addition to possibly not getting paid, there are other risks associated with cybercrime jobs such as [2]prosecution and imprisonment , which are hardly perks.
[3]
And back to that requirement that Kaspersky notes is "peculiar" to many employment listings: the absence of substance abuse issues, with one example asking for "teamwork skills, stable connection, no alcohol or drug addictions."
[4]
[5]
Despite the common expectation that miscreants can make a lot more money using their hacking skills for evil, rather than good, Kaspersky noted that "we did not detect a significant difference between the median levels of IT professionals' compensation in the cybercriminal ecosystem and the legitimate job market."
Crime doesn't pay that well
Developers were the most sought-after candidates on dark web forums and accounted for 61 percent of total ads. "This could suggest that the complexity of cyberattacks is growing," according to the analysis. "The higher demand for developers could be explained by a need to create and configure new, more complex tools."
For comparison: attackers/penetration testers came in second with 16 percent and designers ranked third with 10 percent.
The compensation for these jobs also reflected the in-demand coding capabilities. The highest paid monthly salary that Kaspersky saw in the ads was $20,000 per month, paid to a developer. The median monthly salary for developers, however, came in at $2,000 per month, compared to attackers ($2,500), reverse engineers ($4,000), analysts ($1,750), IT admins and testers ($1,500) and designers ($1,300).
[6]
There's also the potential for performance-related bonuses, Kaspersky researchers found: "For example, a pentester could be promised a monthly salary of $10,000 along with a percentage of the profits received from selling access to a compromised organization's infrastructure or confidential data, extortion, and other ways of monetizing the hack."
[7]Tech job bloodbath comes to IBM, CFO links layoffs to Kyndryl, Watson Health
[8]Uncle Sam slaps $10m bounty on Hive while Russia ban-hammers FBI, CIA
[9]Analysis of leaked Conti files blows lid off ransomware gang
[10]Weep for the cybercriminals who fell for online scams and lost $2.5m last year
And similar to legitimate, legal-IT professional hiring processes: dark-web job listings often mention paid test assignments, interviews, and probation periods, as well as incentives such as paid vacation and sick days, pay raises and opportunities for growth, and flexible hours. Some ads even touted more nebulous job benefits such as a close-knit team (8 percent of ads) and exciting challenges (7 percent).
The research also seems to suggest that the adage about desperate times holds true. "Many turn to the shadow market for extra income in a crisis," the report said, noting that the number of resumes posted on dark-web forums surged at the start of the COVID-19 pandemic in March 2020.
This is worrisome given the [11]recent tech layoffs and economic downturn of late. Here's hoping that this line stands out to any newly out-of-a-job IT professionals weighing their options: "The risks associated with working for a dark web employer still outweigh the benefits." ®
Get our [12]Tech Resources
[1] https://securelist.com/darknet-it-headhunting/108526/
[2] https://www.theregister.com/2023/01/27/10m_hive_reward_russia/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y9hMDj2E3j9l7rE33mziuwAAAFY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y9hMDj2E3j9l7rE33mziuwAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y9hMDj2E3j9l7rE33mziuwAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y9hMDj2E3j9l7rE33mziuwAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/01/26/ibm_job_cuts/
[8] https://www.theregister.com/2023/01/27/10m_hive_reward_russia/
[9] https://www.theregister.com/2022/03/11/conti_leaks_code/
[10] https://www.theregister.com/2022/12/08/scammers_scam_cybercriminals_sophos/
[11] https://www.theregister.com/2023/01/26/ibm_job_cuts/
[12] https://whitepapers.theregister.com/
This, according to a two-year [1]analysis by Russian security house Kaspersky of 227,000 job listings on 155 forums collected between 2020 and 2022. The report found that many ads mirror the style of legitimate IT job postings but with a couple big exceptions: all the work is remote by default, and - for obvious reasons - there are no formal employment contracts for these illegal gigs.
So if you were to get a job as a ransomware developer, don't be too surprised if your employer stiffs you after you've helped extort millions of dollars from a hospital or public school district. In addition to possibly not getting paid, there are other risks associated with cybercrime jobs such as [2]prosecution and imprisonment , which are hardly perks.
[3]
And back to that requirement that Kaspersky notes is "peculiar" to many employment listings: the absence of substance abuse issues, with one example asking for "teamwork skills, stable connection, no alcohol or drug addictions."
[4]
[5]
Despite the common expectation that miscreants can make a lot more money using their hacking skills for evil, rather than good, Kaspersky noted that "we did not detect a significant difference between the median levels of IT professionals' compensation in the cybercriminal ecosystem and the legitimate job market."
Crime doesn't pay that well
Developers were the most sought-after candidates on dark web forums and accounted for 61 percent of total ads. "This could suggest that the complexity of cyberattacks is growing," according to the analysis. "The higher demand for developers could be explained by a need to create and configure new, more complex tools."
For comparison: attackers/penetration testers came in second with 16 percent and designers ranked third with 10 percent.
The compensation for these jobs also reflected the in-demand coding capabilities. The highest paid monthly salary that Kaspersky saw in the ads was $20,000 per month, paid to a developer. The median monthly salary for developers, however, came in at $2,000 per month, compared to attackers ($2,500), reverse engineers ($4,000), analysts ($1,750), IT admins and testers ($1,500) and designers ($1,300).
[6]
There's also the potential for performance-related bonuses, Kaspersky researchers found: "For example, a pentester could be promised a monthly salary of $10,000 along with a percentage of the profits received from selling access to a compromised organization's infrastructure or confidential data, extortion, and other ways of monetizing the hack."
[7]Tech job bloodbath comes to IBM, CFO links layoffs to Kyndryl, Watson Health
[8]Uncle Sam slaps $10m bounty on Hive while Russia ban-hammers FBI, CIA
[9]Analysis of leaked Conti files blows lid off ransomware gang
[10]Weep for the cybercriminals who fell for online scams and lost $2.5m last year
And similar to legitimate, legal-IT professional hiring processes: dark-web job listings often mention paid test assignments, interviews, and probation periods, as well as incentives such as paid vacation and sick days, pay raises and opportunities for growth, and flexible hours. Some ads even touted more nebulous job benefits such as a close-knit team (8 percent of ads) and exciting challenges (7 percent).
The research also seems to suggest that the adage about desperate times holds true. "Many turn to the shadow market for extra income in a crisis," the report said, noting that the number of resumes posted on dark-web forums surged at the start of the COVID-19 pandemic in March 2020.
This is worrisome given the [11]recent tech layoffs and economic downturn of late. Here's hoping that this line stands out to any newly out-of-a-job IT professionals weighing their options: "The risks associated with working for a dark web employer still outweigh the benefits." ®
Get our [12]Tech Resources
[1] https://securelist.com/darknet-it-headhunting/108526/
[2] https://www.theregister.com/2023/01/27/10m_hive_reward_russia/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y9hMDj2E3j9l7rE33mziuwAAAFY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y9hMDj2E3j9l7rE33mziuwAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y9hMDj2E3j9l7rE33mziuwAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y9hMDj2E3j9l7rE33mziuwAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/01/26/ibm_job_cuts/
[8] https://www.theregister.com/2023/01/27/10m_hive_reward_russia/
[9] https://www.theregister.com/2022/03/11/conti_leaks_code/
[10] https://www.theregister.com/2022/12/08/scammers_scam_cybercriminals_sophos/
[11] https://www.theregister.com/2023/01/26/ibm_job_cuts/
[12] https://whitepapers.theregister.com/
Not top talent
Anonymous Coward
In most cases these people aren't at the top of the game. This shouldn't be a surprise for people posting on bad guy craigslist, the big fish are running their own crews or working through less public forums.
Contract work for other criminals, big surprise it's not paying top dollar, and that you get what you pay for. But the same can be said for the "One step above Fiverr" postings that usually get picked up by overseas sweat shops. I just saw one for what was obviously a spamming ring mixed in with other posts, and immediately thought to myself that even if the checks cleared it would never be close to worth it just on the dollars to amount of work ratio. Easy enough to land a brain dead job for more money and less work, with less specific skills needed.
And so I expect that the "no junkies" clause makes sense, because at the rates offered, the people that the posters will get applications from are going to be weighted to burnouts and human train wrecks, and people that already have a record and can't get work in an above board shop. It's still a suckers game, as you are the bag holder if LE gets involved, and are getting fed scraps for your troubles in the mean time.
That's pitiful!
And not even a health plan thrown in? Retirement?
Wages of sin, indeed. I wouldn't get out of bed for that. Though I expect getting that in US$ would be a king's ransom in some countries.