Beyond the kill chain: What cybercriminals do with their money

Keypoints

• Cybercriminals are diversifying their investments into legitimate industries, including real estate, gold, restaurants, and even cybersecurity, to launder money and increase profits.
• Common money laundering methods include shell companies, offshore banking, and the use of money mules.
• Cybercrime forums reveal discussions about a wide range of illegal and ethically questionable business activities, such as selling spyware, traffic generation, pornography, gambling, pharmaceuticals, and counterfeit currency.
• Some discussions on criminal forums contain information that could potentially be used to track and identify threat actors.
• Understanding the financial aspects of cybercrime is crucial for effective disruption and attribution, going beyond the traditional “kill chain” model.
• Greater collaboration between the cybersecurity industry, law enforcement, and regulators is necessary to address the financial ecosystem of cybercrime.
• The “kill chain” model should be expanded to include the financial aspects of cybercrime, specifically addressing cashing out, money laundering, spending, and investment.The series highlights the involvement of more people in criminal networks due to the expansion into legitimate industries, complicating investigations.