If cybercrime was a country, it would have the 13th highest gross domestic profile in the world according to a recently released study, Into the Web of Profit by Michael McGuire, a Senior Lecturer in Criminology at Surrey University. Cybercrime is a relatively new criminal economy, it is conservatively estimated to generate $1.5 trillion each year.

The report suggests that cybercrime can no longer be compared to a business because it is now a multi-layered economy. Its emergence marks an evolution within the criminal ecosystem: “the result is a shift towards platform models of criminality, mirroring shifts in the contemporary global economy.”

McGuire explains: “We are looking at a hyper-connected range of economic agents, economic relationships and other factors now capable of generating, supporting, and maintaining criminal revenues at unprecedented scales.” Increasingly both the legitimate and illegitimate economies are becoming intertwined within an increasingly cyber-criminogenic world.

Cybercrime-as-a-Service and Hackers for Hire

Illicit and illegal online markets are worth an estimated $860 billion, making it the most lucrative form of cybercriminal revenue, accounting for 50% of total revenues. Trade secret and IP theft is worth $500bn and accounts for another 35%.

Cybercriminals are taking a platform capitalism approach to selling, rather than committing crime. A growing number of sites offer reviews, technical support, descriptions, rating and information on success rates. According to McGuire, crimeware and cybercrime-as-a-service have minimum global revenues of $1.6bn.

Some examples of services and products found to be available include:

• Zero-day Adobe exploits ($30,000)
• Zero-day iOS exploit ($250,000)
• Malware exploit kit ($200–$600 per exploit)
• Blackhole exploit kit ($700 a month or $1,500 a year)

In addition to tools, the report states it is also possible to hire a specific trade skill: “much like hiring electricians or plumbers on a site like Checkatrade, sites like Rent a Hacker provide hacking services, with an average cost for a small hack around $200.”

Digital Money Laundering

Around 10% of the estimated $1.6 –$2tn of laundered money being circulated globally can be attributed to revenues derived from cybercrime. 95% of money mule activity has links to cybercrime activities. The report found that the increased use of digital payment systems to launder the proceeds of cybercrime is generating significant revenue flows outside of the traditional financial system’s remit or jurisdiction.

Laundering through cryptocurrencies remains relatively small compared to the volumes of cash laundered through traditional means. Cybercriminals are moving away from Bitcoin to Monero or Zcash.

Cybercriminals Reinvesting in Crime

20% of cybercriminals sampled in the report said that they had reinvested a portion of their ill-gotten gains in further criminal activities such as the drug trade and human trafficking. The report highlighted a worrying connection between cybercrime and fundraising for terrorism, in one instance, cyber crimes were committed to specifically generate funds of more than $3.5m for Al Qaeda. Funds are also put to use maintaining and expanding criminal platforms, investing in more crimeware and paying for other associated criminal requirements.

The findings of this report provides a frightening insight into just how prolific cybercrime has become and how it is rapidly evolving. Cybercrime has changed from the exclusive domain of the technically minded computer expert to an activity as simple as online shopping. Novices to the world of hacking and cyberattacks are now able to access destructive tools, customer support and hacker services at the click of a button. The implication of this is that we will see an increase in the number of cyberattacks on both public and private institutions.