Hacker Infrastructure and Underground Hosting 101

guest · Jul 22, 2020

Hacker Infrastructure and Underground Hosting 101:Where Are Cybercriminal Platforms Offered?
Underground platforms are part of a mature ecosystem for trading cybercrime goods and services
July 21, 2020
https://www.trendmicro.com/vinfo/us...101-where-are-cybercriminal-platforms-offered

In the cybercrime underground, a criminal’s hosting infrastructure serves as the foundation of their entire business model.

Criminal sellers provide services and infrastructures that other criminals need to execute their attacks.
An underground hosting service or underground infrastructure enables threat actors to harbor cybercriminal components and carry out their malicious activities undisrupted by takedowns or arrests, which usually require intervention by service providers.

Hosted infrastructures are also used to send phishing emails, trade illegal goods on online shops, and host virtual private systems (VPS) that can be used to launch attacks from.
Click to expand...

In the first part of our underground hosting research series, we’ll be looking into the underground marketplaces to see what goods and services they offer to hacker communities and how criminal sellers conduct their transactions with criminal infrastructure buyers.

The upcoming second part of this research series will explore how cybercriminals acquire and use criminal infrastructure components, such as compromised assets and dedicated hosting servers.
Click to expand...

Better awareness of the underground is crucial in helping organizations, the InfoSec community, and law enforcement to manage and reduce cybercrime. Detailed findings can be read in our full paper, “The Hacker Infrastructure and Underground Hosting: An Overview of the Cybercriminal Market,” which provides insights into the workings of an underground economy and the foundations of online criminal infrastructure.
Click to expand...

The Hacker Infrastructure and Underground Hosting: An Overview of the Cybercriminal Market
(PDF): https://documents.trendmicro.com/assets/white_papers/wp-the-hacker-infrastructure-and-underground-hosting.pdf

mirimir · Jul 22, 2020

Huh, it's pretty useless without actual URLs and other specific information.

guest · Sep 1, 2020

Commodified Cybercrime Infrastructure: Exploring the Underground Services Market for Cybercriminals
September 1, 2019
https://www.trendmicro.com/vinfo/us...nderground-services-market-for-cybercriminals

The provision of services, as well as the way criminals operate in the underground, have gone through many changes over the years to cater to the market’s different infrastructure demands.
Click to expand...

Beyond standard underground offerings such as malware and exploit kits, cybercriminals also value having a stable hosting infrastructure that underpins all their activities. Such an infrastructure could host malicious content and the necessary components for controlling their operations (e.g., bulletproof hosting that run backend hacker infrastructure or a rented botnet of compromised machines).

In many respects, transactions among cybercriminals occur in ways similar to those in legitimate businesses. Amateurs and professionals alike rely on marketing their products across various platforms — some use social media, while some only do so in controlled, vetted underground forums.
Click to expand...

Our first article in this research series provided an overview of the underground market, where services, infrastructures, and tools used to conduct illegal activities are bought and sold. Offerings are diverse and cater to every need.
This part of the research series provides a look into the dynamics of the cybercrime ecosystem: the services offered in the underground and how infrastructures are set up for certain criminal applications.
Click to expand...

The Hacker Infrastructure and Underground Hosting: Services Used by Criminals
(PDF): https://documents.trendmicro.com/assets/white_papers/wp-the-hacker-infrastructure-and-underground-hosting-services-used-by-criminals.pdf

guest · Oct 8, 2020

Inside the Bulletproof Hosting Business
Cybercriminal Methods and OpSec
October 6, 2020
https://www.trendmicro.com/vinfo/us...oof-hosting-business-cybercrime-methods-opsec

Many cybercriminal operations have some level of organization, planning, and some form of foundation that reflects the technical acumen of the individual or group behind them. The use of underground infrastructure is inherent to the modus operandi of a cybercriminal.
In our Underground Hosting series, we have differentiated how cybercrime goods are sold in marketplaces and what kinds of services are offered. In this final part of the series, we will explore the methods criminals employ to secure their assets and survive in the business.

Criminal sellers use different mechanisms to protect their businesses. The offerings of these "businesses" are often suited to the respective requests and demands of the criminals. Bulletproof hosting (BPH) services, also known as abuse-resistant services, and in some cases, offshore hosting, usually comprises compromised assets and infrastructures with a high level of resistance to abuse.
A bulletproof host employs various ways to sustain crimes operating under its wing and offer protection from law enforcement agencies.
Click to expand...

BPH providers also appear to be well-informed of the regional legalities and how law enforcement agencies respond and cooperate internationally. It is common for operators to minimize the number of useful log files and to access the system from anonymous sources like Tor networks.
Criminal Approaches to Avoid DDoS Attacks and Forum Scraping
Forum operators also employ various mechanisms to avoid automated scraping of their content. Forum scraping is often done by threat researchers and law enforcement investigators to analyze the activities of underground actors.

Like legitimate sites, criminal forums also use Captcha systems to protect its pages from automatic scraping and visits by search engines and bots. For some underground actors, however, they have come up with creative replacements for Captcha.
Click to expand...

As infrastructure-providing platforms diversify, malicious sources have proved to be tricky to uncover. Our research paper, "The Hacker Infrastructure and Underground Hosting: Cybercrime Modi Operandi and OpSec," aims to shed light on the ecosystem of bulletproof hosting from a criminal perspective. In particular, we outline major survival principles and key weaknesses that can help researchers and law enforcement undermine BPH providers. This way, readers will be able to understand the cybercriminal mindset and frame an appropriate response.
Click to expand...

The Hacker Infrastructure and Underground Hosting: Cybercrime Modi Operandi and OpSec
(PDF): https://documents.trendmicro.com/assets/white_papers/wp-the-hacker-infrastructure-and-underground-hosting-cybercrime-modi-operandi-and-opsec.pdf

Log in or Sign up

Hacker Infrastructure and Underground Hosting 101

guest Guest

mirimir Registered Member

guest Guest

guest Guest

Log in or Sign up

Hacker Infrastructure and Underground Hosting 101

guest Guest

mirimir Registered Member

guest Guest

guest Guest

Useful Searches