Cybercrime & The Dark Web

 What is cybercrime, and what is the dark web? Many people have vague thoughts about what those two phrases actually mean. This article will detail how cybercriminals use different tools and strategies to get rich anonymously with your money. This research is not intended to promote cybercrime or the dark web but will look at things from the attacker’s perspective. The methodology presented here goes deep into criminals’ steps to stay anonymous, buy credit cards, set up accounts, charge legit and fraudulent transactions through those accounts, and ultimately cash out safely.

 So, what is cybercrime? Somewhat self-explanatory, cybercrime is a crime that involves a computer or computer network. The computer may have been used to commit the crime or be the target. Cybercrime may harm someone’s security or finances. We will primarily focus on fraud and the financial aspect, but hacking and network exploitation are still utilized a great deal to achieve specific goals, especially in obtaining remote connections.

 Now that we have a brief understanding of cybercrime and the dark web, we can go into the first and most crucial step of cybercrime; OPSEC. Short for operational security, and in this case, it basically means how not to get caught. It is vital that cybercriminals have a solid understanding and foundation on how to stay anonymous.

 Cybercriminals are always aware of law enforcement and are prepared for the worst-case scenario, a raid in which their hardware is seized. Usual tactics to prevent digital forensics start with full hard drive encryption and encrypting the virtual machine disks, including the VM manager software. If caught, these measures provide plausible deniability and may take law enforcement ages to crack the encryption.

A popular method to stay safe is to use a virtual machine such as WHONIX on a Linux host operating system. Whonix: Kicksecure–based security-hardened Linux distribution. Its primary goals are to provide strong privacy and anonymity on the Internet. A popular method to stay safe is to use a virtual machine such as WHONIX on a Linux host operating system. The operating system consists of two virtual machines, a “Workstation” and a Tor “Gateway,” running Debian GNU/Linux. All communications are forced through the Tor network.

 Tor, short for The Onion Router, is free and open-source software for enabling anonymous communication. It directs Internet traffic through a free, worldwide volunteer overlay network of more than seven thousand relays to conceal a user’s location and usage from anyone performing network surveillance or traffic analysis. Tor’s intended use is to protect the personal privacy of its users, as well as their freedom and ability to communicate confidentially through IP address anonymity using Tor exit nodes. Using Tor makes it more difficult to trace a user’s internet activity.

Monero (XMR) is a decentralized cryptocurrency. It uses a publicly distributed ledger with privacy-enhancing technologies that obfuscate transactions to achieve anonymity and fungibility. Observers cannot decipher addresses trading Monero, transaction amounts, address balances, or transaction histories. Monero is usually the preferred cryptocurrency on the dark web as it has higher levels of anonymity.

We should now have a basic understanding of the very first steps cybercriminals use to start positioning themselves within the space to steal money and data. Before we move on, there are some standard dark web fraud terms used in online communications in this space that we need to understand.

CC: Short for Credit Card. It may also refer to a credit card without a three-digit security code or other information.

CCV: short for Credit Card Verification, this typically means credit cards sold with the entire credit card number, first and last name, expiration, address, zip, and three-digit security code.

 Now that we have looked at some standard terms, we can move forward to how cybercriminals begin setting up their accounts.

 Once their OPSEC is in a good place and provides an adequate level of safety and anonymity, they can use the dark web to access and create an account on dark web markets.

 They will then fund these accounts with the market’s preferred cryptocurrency so they can make purchases such as personal information, credit cards, and services from others on the platform.

 Cybercriminals will pay for a background check search of your first and last name from the CCV they bought. The information found in the background check is usually sufficient to answer the questions on the free credit score checking sites and view your credit score and report.

 They will then package and neatly organize your information, including the CCV, SSN, background check, and credit report. They have now created an accurate, high-quality Fullz based solely on the CCV they purchased. Let’s move on to the next step of the process, how criminals use Fullz to create financial accounts.

 What is a payment processor? A payment processor is a vendor businesses use to manage the logistics of accepting card payments. It shuttles card data from wherever customers enter their card details to payment networks such as Stripe, PayPal, Venmo, etc. Using payment processors is how cybercriminals steal money directly from your credit card. Money can be siphoned from credit cards directly through the processor’s dashboard, but the most effective way to look legit is by setting up a fake e-commerce store. If cybercriminals put enough effort into creating a convincing enough e-commerce or other type of store, tens of thousands of dollars, if not more, can be charged through it without being shut down. Cybercriminals use the bank account they created with the Fullz they sourced to link the payment processor to their fake e-commerce account. Once their accounts are organized, set up, and aged correctly, they will begin the carding process.

 Cashing out is considered to be the most challenging part of the process. I have read on forums that you should ‘never count your chickens before they hatch,’ meaning, in this case, that even if the money is in the bank account, you don’t have complete control until you cash out to bitcoin or crypto. The bank can still put a hold or outright close the account that you were working with, and all of your funds will be gone. Some criminals will have a physical debit card sent to an address they use to withdraw funds from ATMs. To stay anonymous and 100% virtual, you must have a bank account linked to a crypto exchange.

 Crypto exchange verification: Cryptocurrency exchanges require a scrutinizing verification process.

 This step is where cybercriminals use the services and skills of others on dark web markets to help get through this rigorous verification process.

 Photoshopped Credentials: Scans of the front and back of the driver’s license, along with scans of utility bills matching the address printed on the license, are required.

 People on dark web markets sell their photoshop skills and abilities to forge these documents.

• OPSEC is the most crucial aspect of the process, as staying undetected relies on correctly configured security.
• Almost every next step builds upon the previous, and it is essential a solid foundation is laid from the start.
• Creating high-quality Fullz and accounts with clean connections is crucial in not getting those accounts shut down and having to start over.
• Using CCVs with good BINs to make surefire charges without declines.
• Patients and skill are a must-have; some things take time

                 So, what can you do to protect yourself after learning the fraud process from a cybercriminal’s point of view on how they steal your money? Unfortunately, what you can do on a personal level is limited. Most of the responsibility to keep your personal and financial information safe is in the hands of banks, businesses, and credit card companies. These entities are constantly under attack by malicious hackers to steal vast swaths of personal data and sell it for profit. These companies continuously battle cybercriminals to try and keep your personal information from being compromised. Banks and credit card companies even budget for fraudulent charges because they know fraud is inevitable.

 But I can still leave you with help to secure yourself and your information as best you can. To help protect against credit card fraud, I highly recommend checking your credit statements and reports often. Cybercriminals often use services to check to see if the CC they bought is active; to do this, they often link it to a website that will make small charges of less than a dollar. If you did not recently use your card, this is a huge red flag that your debit or CC has been stolen and is about to be used. People with high credit scores need to stay extra vigilant. Cybercriminals look for high credit scores and will take your personal information, including EIN, to open fake stores/shops online. These can be spotted by checking your credit report frequently and quickly disputing/removing any unknown accounts.

 As for securing your devices, I highly recommend keeping your operating system up to date and ensuring you have all of the latest security patches installed. Hackers will use phishing, exploits, and social engineering to establish remote access to your devices and sell those connections on the dark web. Other criminals will then buy those connections to your computer for nefarious tasks, such as using stolen CCs to make charges or setting up a fake e-commerce store on your home IP address! The best prevention against having your computer compromised is to be extremely careful when opening email attachments. Phishing campaigns are everywhere and are specifically crafted to make you download a file or click a link. The last and easiest method to help prevent your computer from being compromised is to use a VPN; they are cheap, practical, easy to use, and well worth the money.

 This article is not intended to promote cybercrime or encourage the use of the dark web. The information conveyed here results from a ton of research and time spent reading guides and posts on forums by individuals participating in this type of activity. Many steps and bits of information are intentionally left out, such as specific website URLs, vendor names, particular banks with weak security, sms verification bypasses, and much more.