Shocking news! It turns out that criminals cannot be trusted.
Of course, it’s obvious, but criminals themselves may also be guilty of trusting others a little too much and getting scammed as a result.
Sophos researchers published a study at Black Hat Europe this week about so-called “metaparasites” (scammers who trick other scammers).
Matt Wixey and Angela Gunn from Sophos describe their research as follows:
“…a novel study of scammers scamming scammers and hackers hacking hackers in three of the most established and prominent criminal markets. Examine the motives of metaparasites, how the arbitration process works, and how metaparasites influence the culture and operations of the markets in which they operate.
And you can make a lot of money by targeting cybercriminals.
According to Sopbos, cybercriminals have lost more than US$2.5 million to other scammers on three underground forums over the past 12 months.
sign up for newsletterSecurity news, advice and tips.
Fraud can take multiple forms, including fake data breaches, extortion, backdoor malware, and phishing.
The researchers also found 20 websites created to mimic the criminal marketplace “intended to trick users into charging a $100 ‘activation fee’.”
Oh my god, never mind.
And, perhaps unsurprisingly, there is even evidence that some scammers who get scammed go on to get their revenge by scamming the very person who scammed them (read this to the end). I would appreciate it if you could…).
The problem of cybercriminals defrauding other cybercriminals has become so serious that underground forums even have dedicated “arbitration rooms”.
So this is all very interesting. We like the idea that cybercriminals are tricking each other instead of targeting innocent civilians.
According to researchers, yes:
“Metaparasites inadvertently provide analysts with the benefit of intelligence that would otherwise remain hidden in sales, operations, negotiations, identifiers and even market cultures, varying levels of operational security, and deception. Gain unprecedented insight into vulnerabilities to and social engineering.”
But don’t laugh too hard, researchers warn.
As long as those who explore and study the culture of cybercriminals aren’t fooled, I think we can take some comfort from the idea that cybercriminals are scamming each other and not us.
Did you find this article interesting? Follow Graham Cluley on Twitter Or visit Mastodon to read more exclusive content we post.
