German cybercrime business owners are developing sophisticated local offerings to better compete with English language and Russian underground marketplaces, according to a new report from Trend Micro.
The security firm’s latest report, U-Markt: Peering into the German Cybercriminal Underground, reveals a small but highly developed cyber black market.
Trend Micro found 10 forums and two marketplaces with over 70,000 registered users, selling crimeware as well as drugs, counterfeit goods, guns, stolen data and more.
Fake IDs are particularly popular on these underground sites, as are crypting services, while most bulletproof hosting services come from Russia, the report claimed.
However, Germany can be said to be something of a leader in the EU when it comes to cybercrime innovations.
Three types of malware—“Sphinx," "Cube6" and "Triple CCC"—first appeared in Germany but have since been made available in the bigger and more mature markets of Russia.
German darknet cybercriminals have also developed a localized version of dropping—cashing out stolen credit cards and online accounts.
They abuse the "DHL Packstation" service to buy products from online retailers via hacked accounts without paying. Some underground operators also use the service to distribute illegal or stolen goods—in a manner which is completely untraceable.
Packstation accounts and other German-specific products can be found on German-plaza.cc and other local marketplaces which deal exclusively in items for the domestic market.
Interestingly, stolen online banking details sometimes come with telephone support—i.e. the seller will provide a service to take care of any banking verification calls.
These providers also offer other services such as threatening phone calls, Trend Micro claimed.
Global threat communications manager, Christopher Budd, likened the German underground to the Japanese cybercrime black market in terms of its maturity and size.
“However, as it matures it is possible it will to grow to become a larger market, similar to those in Russia and China,” he told Infosecurity.
“While there is a potential for growth, these smaller undergrounds are akin to emerging markets where there's no guarantee they will flourish. Furthermore, their success is not linked to their size. Additionally, the German underground is very closed, so gaining access is controlled quite strictly.”
Photo © Thomas Reichhart