Economy of hacking: how do hackers make money?

Selling data on the dark web

As any good penetration tester will tell you, compromising a confidential corporate database is a challenging hack more often than not, so why do hackers do it? Well, for the hundreds of millions of records containing personal information. Whilst this information can be used to commit identity theft, those who purloin such data tend to sell it on the dark web instead.

The dark web might sound like something from a cheap fantasy book, but there’s a lot of dodgy activities that goes on there. Personal data lifted from compromised databases (particularly email addresses) can be sold. Personal data is valuable as it can be used by those in the know to commit identity theft. Hotel chain Marriott was hacked in 2018 and 2020 (will they ever learn?), and the vast amount of data stolen, which included passport numbers, will certainly end up for sale on the dark web. A particular note-worthy case was 2020's easyJet hack, where the personal details of over 9,000,000 people fell into hackers’ hands.

In addition to this, email addresses can be sold on to enable fraudsters to commit phishing campaigns, which in turn could lead to identity theft or the spreading of malware for other monetisation streams, such as whaling (we’ll get to that later). That malware in question could be adware, cryptomining software or even our old friend ransomware. Speaking of which...

Never forget the classic

You may remember ransomware from its sell-out 2017 tour (you might recall its smash hit, WannaCry, which crippled the NHS), and it’s not gone away. Research from Sophos shows that from 2017 to 2020, ransomware campaigns have only dropped 3%, and 51% of companies are still hit by ransomware. This makes it an effective way for hackers to make money. We spoke of this iconic cyber villain in our 2019 annual cyber security report, and highlighted its continuing prevalence in our 2020 report too. Theoretically, it’s the simplest way to monetise a hack. Through sophisticated phishing tactics or simply by dropping malware once access has been gained to a network, hackers can begin encrypting crucial files and charge a hefty sum (usually in Bitcoin) to unencrypt them.

If that wasn’t bad enough, a lot of companies found that when they paid the ransom (something you should never do) they didn’t actually get their files back. You can’t trust hackers these days. Worryingly, ransomware is evolving. Some strains deliberately slow the rate of encryption and spread in order to keep under alerting thresholds and therefore stay undetected for longer. Some have even showed devious tactics like directly encrypting the hard drive’s Master Boot Record, meaning there’s no need to waste all that time going from file to file.

WannaCry alone is known to have earned hackers at least £108,000 in Bitcoin. This is a tidy sum, but the cost to businesses is of course much higher than this, as they must suffer loss of sales and cost of recovery. £100k is a good haul, so hackers are unlikely to let it go.

Hi-ho hi-ho, let’s mine some Monero

As we pointed out in the Bulletproof annual cyber report 2019, cryptojacking became more prominent on the cyber landscape over 2017’s ransomware trend. For reasons I still don’t understand, Bitcoin became a thing, setting a precedent that lead to a rise in digital ‘currencies’. The majority of these are obtained by using CPU or more recently GPU power to ‘mine’ for it. As said, Bitcoin is the most popular currency, but is becoming increasingly harder, and therefore less profitable, to mine. Monero seems to be the currency of choice for most hackers.

When mining for Monero (XMR), you are in fact part of a wider mining pool which uses your resources to maintain a public ledger which records transactions. For every transaction recorded you are rewarded with a small amount of XMR. If all of this sounds like nonsense, well, it’s because it is, but that’s the world we live in now.

Botnets for hire

Botnets, consisting of compromised devices forming a... net, are getting larger. This is in part due to the relatively recent explosion of IoT devices, particularly cheap variants that have taken a slapdash approach to security (if they took any approach at all). If a computer, server or IoT device is added to a botnet, the chances are you’ll never know, as the malware used won’t cause any noticeable disruptions. Hacking groups are forever struggling to have the biggest botnet, because in this instance size really can matter.

These botnets can then be used to commit targeted DDos attacks. This is where a site or service gets bombarded with so many requests that the server can’t process them quick enough, causing it to fall over and take the service offline. Think of it like a pub with only one person manning the bar, but thousands of customers barking out orders. Eventually, the poor bar person will curl up on the floor and cry and then no one can get a drink.

Hacking groups can charge an hourly rate for use of their botnet. There are a number of reasons for people to want to take a service offline, from cyber extortion, to people who are just angry at a site for their own reasons.

Money Money Money

There are yet more ways for hackers to make money. We haven’t even mentioned those paid to commit dubious acts on behalf of nations. Of course, the easiest way for a hacker to make money would be to become a penetration tester. Penetration testing is basically ethical, licensed hacking. You can earn good money and get great job satisfaction without the falling foul of the law.

Naturally, all the above tactics will adapt to changing environments and continue to plague the cyber landscape. Unfortunately, as long as there is money to be made, hackers will continue to hack. However, there are ways to defend against all of these issues. Effective SIEM threat monitoring can keep watch over your important assets. Penetration testing can check for any weaknesses in your apps and infrastructure to ensure no rogue code finds its way through the net. Effective security training can help educate your staff against the threats that are forever lurking in the cyber shadows.

If you make sure your business is doing everything right and has tight defences, it’ll become less profitable for hackers to have their way. The less profitable it becomes and the harder it is, the less of a target you’ll be.