{"id":6367,"date":"2018-09-27T11:28:58","date_gmt":"2018-09-27T15:28:58","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=6367"},"modified":"2020-12-15T10:57:36","modified_gmt":"2020-12-15T15:57:36","slug":"2018-cybercrime-statistics","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/2018-cybercrime-statistics\/","title":{"rendered":"Re-Hashed: 2018 Cybercrime Statistics: A closer look at the “Web of Profit”"},"content":{"rendered":"\n

Cybercrime will generate at least $1.5 trillion this year\u2014and that\u2019s conservative<\/h2>\n\n\n\n

Two weeks ago we discussed the impressive work done by Dr. Michael McGuire on a cybercrime study<\/a> that found the industry\u2019s profitability to be in excess of $1.5 trillion. But while that\u2019s an impressive figure, it\u2019s hardly the entire story.<\/p>\n\n\n\n

As McGuire said, cybercrime has evolved into an entire economy rife with professionalization and filled with parallels to legitimate industries.<\/p>\n\n\n\n

\u201cThe emergence of a complex and multi-layered cybercrime economy has also begun to suggest a fundamental shift in the very nature of crime itself. In this context, overt acts of crime become less central features of the criminal ecosystem when compared to the services and platforms that feed off and support crime \u2013 which become increasingly low-investment, high-yield and low-risk operations.\u201d<\/p><\/blockquote>\n\n\n\n

The existence of \u201cplatform models of cybercrime\u201d are, in McGuire\u2019s opinion, comparable to \u201cplatform capitalism,\u201d which has been a major trend in the global economy owing to the likes of Google, Facebook, YouTube, Uber, LinkedIn, etc. \u2013 companies that can make money simply by offering a platform to others and collecting data.<\/p>\n\n\n\n

That has led to a spike in profitability that would make Cybercrime \u2013 were it a nation state like the US or Russia \u2013 the 13th<\/sup> largest GDP in the entire world. Let\u2019s take a look at some more of the 2018 Cybercrime Statistics that give us a greater insight into how cybercrime is evolving.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n\n

Cybercrime will create over $1.5 trillion in profits in 2018<\/h2>\n\n\n\n

Before we get to the charts and tables, let\u2019s talk for a second about the methodology that Dr. McGuire used to arrive at this $1.5 trillion figure. Using data from the financial industry and law enforcement, Dr. McGuire attempted to construct a conservative estimate that looked at \u201cthe current state of play.\u201d<\/p>\n\n\n\n

\u201cBy erring on the side of caution, by making projections from a small, rather than large number of revenue categories and by opting for lower, rather than higher points on the estimate range, the aim was to understand whether the assumption that cybercrime is a lucrative form of offending has any basis in what is actually happening within the cybercrime economy. The surprisingly high figures that were eventually derived certainly suggest that we need to think more seriously about the attractions and how these might be tackled. For even if the figure for total revenues from cybercrime is only accurate up to a point, the fact that it is a deliberately conservative one means that its inaccuracies at least involve only underestimates, rather than overestimates.\u201d<\/p><\/blockquote>\n\n\n\n

In other words, there\u2019s a very good chance that the actual numbers skew much, much higher.<\/p>\n\n\n\n

\"Piece<\/figure>\n\n\n\n
Crime<\/strong><\/td>Annual Revenues<\/strong><\/td><\/tr>
Illegal online markets<\/td>$860 Billion<\/td><\/tr>
Trade secret, IP theft<\/td>$500 Billion<\/td><\/tr>
Data Trading<\/td>$160 Billion<\/td><\/tr>
Crime-ware\/CaaS<\/td>$1.6 Billion<\/td><\/tr>
Ransomware<\/td>$1 Billion<\/td><\/tr>
Total Cybercrime Revenues<\/td>$1.5 Trillion<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

FACT:<\/em><\/strong> Over 50% of cybercrime revenues are generated in online markets.<\/em><\/span><\/p>\n\n\n\n

What\u2019s not included in that figure<\/strong><\/p>\n\n\n\n

For the sake of this study, \u201ccybercrime revenues are identified as any revenues arising from crimes where computers play an obviously direct role.\u201d However, there were some categories omitted, things like mass communication scams (phone scams) were not included.<\/p>\n\n\n\n

In the U.K., such frauds earned around \u00a33.6 billion ($4.9 billion) in 2015 (CCFS, 2016), in the U.S. they earned approximately $25 billion (ICE, 2010) and in Australia, they earned around AU$94 million ($74 million) (Whitty, 2015); thereby generating an estimated total of over $29 billion.<\/p><\/blockquote>\n\n\n\n

However, reliable data on these kinds of activities was scant outside of the UK and given that they were unlikely to do much to the $1.5 trillion total figure, they were left out.<\/p>\n\n\n\n

How much money does Ransomware make?<\/h2>\n\n\n\n

In 2016, the US Federal Bureau of Investigation estimated that Ransomware payments would reach $1 billion. Two years later that shows no signs of slowing down. Here\u2019s a sampling of some of the highest-profile Ransomware from the past five years as well as how much money it made.<\/p>\n\n\n\n

Ransomware<\/strong><\/td>Date<\/strong><\/td>Profits<\/strong><\/td><\/tr>
CryptoLocker<\/td>2013<\/td>~$3 million<\/td><\/tr>
CryptoWall<\/td>2014-2016<\/td>~$18-320 million<\/td><\/tr>
Locky<\/td><\/td>$7.8-$150 million<\/td><\/tr>
Cerber<\/td><\/td>$6.9 million<\/td><\/tr>
WannaCry<\/td>2016<\/td>$55,000-$140,000<\/td><\/tr>
Petya\/NotPetya<\/td><\/td>$10,000<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

As you can see, some of the higher-profile cases of Ransomware didn\u2019t see much return financially. The Petya\/NotPetya figure in particular is fairly eyebrow-raising given how prolific the ransomware seemed to be at the time. But, there is a distinction to be made between ransomware that was designed to make money and ransomware that was designed primarily for disruption. Petya\/NotPetya would appear to be in the latter category.<\/p>\n\n\n\n

\u201cResearchers who have looked at high profile ransomware \u2013 like WannaCry or the Petya\/NotPetya \u2013 found that monetisation of the ransom demanded has not been conducted very effectively. The implication being that there is a distinction between ransomware products designed for revenue generation and those designed for disruption \u2013 possibly at the behest of state actors.\u201d<\/p><\/blockquote>\n\n\n\n

Cybercrime Operations: Big to Small<\/h2>\n\n\n\n

One of the most interesting aspects of the current cybercrime economy is the way it’s stratified, with large operations functioning almost as multi-national corporations and smaller operations mirroring single proprietor small businesses. Large cybercrime operations can make profits totaling over $1 billion per year while smaller operations tend to make between $30k-$50k.<\/p>\n\n\n\n

\"How<\/figure>\n\n\n\n

How much money do cybercriminals earn?<\/h2>\n\n\n\n

For an individual with the right skillset, cybercrime can be incredibly lucrative. An individual cybercriminal can make upwards of half a million dollars in a year simply by trafficking in stolen data.<\/p>\n\n\n\n

\"A<\/figure>\n\n\n\n

Like real criminality, cyber criminals can generally be broken down into levels. Not every hacker is exceptional. Some, like low-level criminals, are content to execute petty crimes that don\u2019t pay all that well. Others, are highly specialized and only work when the money is good.<\/p>\n\n\n\n

In general, cybercriminals earn about 10-15% more than their counterparts in traditional crime, with high earners taking home upwards of $167k per month, middle earners in the $75k range and low earners making 3.5k per month. Also, while a talented hacker can make somewhere near $30k on a job or two, a platform manager offering multiple card data forums can earn up to $2 million per month.<\/p>\n\n\n\n

\"Yearly<\/figure>\n\n\n\n

FACT:<\/em><\/strong> Ross Ulbricht of Silk Road reputedly made a personal fortune of over $1 billion.<\/em><\/span><\/p>\n\n\n\n

What is a \u201cCybercrime Platform?\u201d<\/h2>\n\n\n\n

To understand this concept, we need to backtrack a bit and start with a quick point on \u201cplatform capitalism<\/strong>.\u201d The cybercrime economy mirrors our global economy in that it has seen a decisive shift towards a platform model, much as the rest of the world has with the likes of social media, Google, Amazon, etc.<\/p>\n\n\n\n

Platforms connect people. It\u2019s easy to get hung up on the terminology, \u201cplatform,\u201d but really all we\u2019re talking about are sites and companies that facilitate connections between suppliers and the consumers in need of their products and services. It makes more sense when you look at a real-world example. AirBnB is a very popular company that offers apps and a website where homeowners looking to rent their properties can connect with people that are looking to rent in their area. Similarly, Facebook connects us to our friends, Google connects advertisers with websites that will get the most out of their ads, Uber connects us a with a ride home. You get the idea.<\/p>\n\n\n\n

\"Logos<\/figure>\n\n\n\n

The platforms themselves produce nothing in this process, whilst the users provide the platforms with the most precious of all commodities within an information economy \u2013 their data.<\/p><\/blockquote>\n\n\n\n

Cybercriminals and the cybercrime economy seem to be embracing this model, too. While there isn\u2019t a ton of definitive research into these areas as of yet, we can get a pretty good top-level idea from Dr. McGuire\u2019s work. Currently there seem to be two ways in which platform economics seem to be playing out in the cybercrime economy.<\/p>\n\n\n\n