Exploring Risk Avoidance Practices Among On-Demand Cybercrime-as-Service Operations

Area of Science:

• Cybercrime and Criminology
• Online Illicit Markets
• Cybersecurity

Background:

• Cybercrime-as-a-service markets, particularly those offering distributed denial of service (DRDoS) attacks (also known as stresser or booter services), are increasingly targeted by international law enforcement.
• Limited research exists on how these illicit operations persist and adapt despite increased enforcement and sanctions.

Purpose of the Study:

• To investigate the adaptive strategies employed by operators of distributed denial of service (DRDoS) attack services in response to law enforcement actions.
• To analyze changes in operational tactics, communication platforms, and payment methods within these underground markets.

Main Methods:

• Qualitative analysis of online advertisements from 44 operators of booter and stresser services.
• Examination of shifts in platform usage, service offerings, and marketing strategies.

Main Results:

• Operators of DRDoS services have demonstrated adaptability by altering their preferred communication channels and payment platforms.
• There has been an observable increase in the variety and sophistication of attack methods offered to customers.
• These adaptations enable continued operation despite increased law enforcement scrutiny.

Conclusions:

• Illicit online markets, such as those for DRDoS attacks, are dynamic and resilient, capable of evolving in response to external pressures.
• Understanding these adaptive strategies is crucial for developing effective counter-cybercrime measures.
• The findings offer insights into the decision-making processes and operational resilience of cybercriminals.