The last decade has seen the rise of the darknet, a set of networks that allow the anonymous sharing of encrypted data inaccessible to traditional search engines. But who works on the Darknet, what are the most sought-after profiles?
To answer these questions, Kaspersky’s Digital Footprint Intelligence (DFI) team studied the specific darknet job market. After analyzing 200,000 ads published between 2020 and 2022, it appears that the professionals most sought after by the cybercriminal community happen to be the profiles of developers, attackers and designers.
According to the experts who carried out this study, among the professional skills required in the job advertisements screened, the study reveals the creation of malware and phishing pages, the compromise of the digital infrastructure of companies, or the hacking of web and mobile applications. The median compensation levels offered for these professionals range between $1,300 and $4,000 per month, the study said. MoroccoLatestNews UK.
For example, the Kaspersky (DFI) team reviewed job offers and CVs posted on 155 dark web forums between January 2020 and June 2022, analyzing information regarding the characteristics of long-term or full-time jobs. .
According to the data collected, a total of around 200,000 job offers were published on the dark web during the period studied. 41% of these ads were published in 2020, with a peak in activity in March, possibly due to the drop in income suffered by part of the population as a result of the pandemic, underlines the study.
The study specifies that the experts analyzed in detail more than 800 job offers in the IT sector on the dark web, and selected the advertisements explicitly mentioning a salary (around 160), even if most of the advertisements indicate a salary. approximate salary. As for the median salary levels mentioned, they are between 1,300 and 4,000 dollars per month, with the highest median salary being offered to retro-engineer profiles.
But not only ! The study reveals that the highest salary noted by the experts is for a developer position valued at $20,000 per month, the lowest salary not exceeding $200, before noting that some of these advertisements include bonuses and commissions on completed projects (a completed ransom note, for example)
Most in-demand jobs on the dark web
Developers are the most sought-after specialists on the darknet representing 61% of all ads, the study points out, noting that among the latter, web developers, essential to the development of various digital products, such as phishing pages, are the most searched (60% of developer offers), while malware coders are also popular.
This job description may include developing Trojans, ransomware, thieves, backdoors, botnets and other types of malware, as well as creating and modifying attack vectors, points out the study.
Breakdown of offers by specialization
According to the same study, the attackers “, IT specialists who carry out attacks on networks, web applications and mobile devices, are the second most sought-after position in the cybercriminal job market, with 16% of advertisements. The job that comes closest to a legitimate job in this setting is a pentester (penetration tester), the study says, noting that most attacker jobs on the darknet are associated with activities aimed at compromising business infrastructure.
The objectives of these activities are the distribution of ransomware, the theft of data or even the theft of money directly from compromised accounts, continues the same study, before specifying that certain cybercriminal groups recruiting attackers aim to sell the access to compromised systems to other cybercriminal entities, or to hack web and mobile applications.
With 10% of ads, designers are the third most demanded professional category, the study reveals, noting that designers are usually in charge of creating a malicious product, such as a phishing page or letter, which would be difficult to be distinguished from its legitimate version.
On the darknet, employers are also looking for IT administrators, reverse engineers, analysts, testers and other less common IT professional profiles: engineers and architects, maintenance workers, technical writers, forum moderators, or even executives and project managers.
” The search for specialized IT profiles is one of the many topics constantly discussed on the Darknet. For companies that want to react proactively to cyberattacks and maintain their IT security at the highest level, it is essential today to monitor the interests of the cybercriminal community and to analyze their activities on an ongoing basis. The more you know about your opponent, the better prepared you are said Polina Bochkareva, security services analyst at Kaspersky, quoted in the study.
To protect against business threats, Kaspersky researchers recommend implementing several measures, including continuous monitoring of resources available on the dark web, which significantly improves coverage of different sources of potential threats, and allows customers to follow the plans of the actors of the threat, and the trends which their activities follow.
Also, the same researchers advocate using various sources of threat intelligence (with coverage of surface web, deep web, and dark web resources) to stay abreast of the actual TTPs used by threat actors.