There has been an explosion in AI-powered cybercrime tooling available on underground marketplaces over recent months, according to a leading ransomware expert.
Cynthia Kaiser, SVP Ransomware Research Center at Halcyon, is also a former FBI deputy cyber director and White House advisor. At Infosecurity Europe on 2 June, she said that her time in government made her realize that tackling cyber threats is the “national security challenge of our lifetime."
“It’s scary to look at some of the most powerful people in the world and see the fear in their eyes and know that’s because of what people are doing at keyboards thousands of miles away,” she told attendees.
Kaiser and her team at Halcyon had already mapped a cybercrime underground dependent on supply chain “specialization, efficiency and division of labor.”
However, they wanted to see what impact AI-powered tools would have. So they ran an analysis of 4000 entries, 77 Telegram channels, 20 dark web forums and five specialized underground markets, she explained.
The team was shocked to see posts mentioning the technology surge from just 38 in December to 1486 in February. That's an increase of over 3810%.
What’s more, when they hit the market, these services featured automated distribution, freemium options, and tiered pricing – the sign of a sophisticated market, Kaiser said.
Cybercrime actors on these forums and marketplaces are selling tools that roughly split into four categories, Kaiser explained.
Kaiser explained how criminals are continuing to drive demand and improve resilience to disruption.
The financial barrier to entry for cybercriminals is “virtually zero” thanks to widely available freemium tools. Telegram bot-driven distribution automates the process of sales, customer service, notification and order tracking, and functions as “unmanned storefronts,” Kasier added.
Finally, the multiplicity of channels ensures redundancy.
“If a paid tier is disrupted, the free tier continues to distribute. If a website goes down, the Telegram bot continues,” she explained. “If the Telegram channel is banned, the forum thread persists, and if the forum is seized the website survives. Each channel is a backup for the others.”
Against this backdrop, organizations need to be prepared on four fronts, Kaiser said:
“The good news is that the same intelligence work that reveals how these markets operate also reveals where they’re vulnerable,” Kaiser concluded.
“Law enforcement disruption and financial pressure can cause real friction. Defenders who understand how attackers actually operate based on direct observation of what they’re buying, building and doing have a meaningful and actionable advantage.”
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
