Businesses and cybercriminals alike are seeking skilled cybersecurity professionals, with the latter advertising for talent capable of developing dark AI models and penetration-testing tools, commonly used for ransomware. These efforts aim to strengthen their malware and reduce the risk of detection by defenders.
Telegram chats and forums such as the Russian Anonymous Marketplace (RAMP) are popular platforms for recruiting such talent. According to Cato Networks' "Q3 SASE Threat Report," these forums feature advertisements for developers to create malicious versions of tools like ChatGPT, showcasing the growing technical sophistication of cybercriminal operations.
The increasing demand for technical expertise reflects the recent success of law enforcement and private companies in dismantling botnets and aiding victims. "They definitely want to make sure all the effort they're putting into their software is not going to be turned over when somebody finds a vulnerability," said Etay Maor, chief security strategist at Cato Networks. Cybercriminals are now mirroring corporate practices to ensure their tools are robust.
As cybercriminal organizations grow, their structures increasingly resemble legitimate businesses, with specialized roles for software development, finance, and operations. Leading groups such as LockBit, RansomHub, and Akira have adopted these practices to improve efficiency and profitability. "These emerging groups and platforms bring new and interesting ways to attack," stated Recorded Future.
The first half of 2024 witnessed the appearance of 21 new ransomware groups, though many are likely rebranded versions of older entities. During this period, cybercriminals claimed over 2,600 breaches, a 23% rise from 2023, according to Rapid7. Malware development is also evolving, with languages like Rust and Go gaining popularity alongside traditional C and C++.
Roles within these organizations are becoming more specialized, including geographic-focused tasks like mule recruitment for financial fraud. "When you're talking about financial fraud, mule recruitment has always been a key part of the business," Maor explained, highlighting the professionalization of cybercrime.
Recent arrests of members from major ransomware groups like ALPHV/BlackCat and the release of decryption tools by law enforcement agencies illustrate the growing pressure on cybercriminals. These developments push groups to enhance their security measures.
Economic instability in conflict zones has contributed to a growing pool of skilled individuals turning to cybercrime. "There's people losing jobs in Eastern Europe because of the current war situation," Maor noted. For some, joining cybercrime networks becomes a necessity to survive financially.