Wages Dominate Cybercrime Groups' Operating Expenses

Rhea-AI Summary

Trend Micro's new research reveals that as criminal organizations grow, they start to mimic legitimate businesses, facing challenges like management issues and internal politics. The report highlights that large organizations allocate 80% of their operating expenses to wages, a trend mirrored in smaller criminal groups (78%). Three organizational sizes are identified: small (<$500K turnover), medium (up to $50M turnover), and large (>$50M turnover), each with distinct structures. Understanding these sizes can aid law enforcement in targeting high-impact cybercrime operations. For the full report, visit Trend Micro.

Positive

• Research highlights a growing complexity in criminal organizations, providing valuable insights for law enforcement.
• Identifying the size of criminal entities could enhance prioritization in targeting interventions.

Negative

• Larger criminal organizations may become harder to manage internally, mirroring corporate challenges.
• Potential issues could arise from increased internal competition and trust challenges among members.

Trend Micro report shows how criminal organizations come to resemble legitimate businesses

DALLAS, April 3, 2023 /PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today published new research detailing how criminal groups start behaving like corporations as they grow bigger, but that this comes with its own attendant costs and challenges.

A typical large organization allocates 80% of its operating expenses to wages, according to the report.

To read a full copy of the report, Inside the Halls of a Cybercrime Business, please visit: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/inside-the-halls-of-a-cybercrime-business

Jon Clay, VP of threat intelligence at Trend Micro: "The criminal underground is rapidly professionalizing – with groups beginning to mimic legitimate businesses that grow in complexity as their membership and revenue increases. However, larger cybercrime organizations can be harder to manage and have more 'office politics,' poor performers, and trust issues. This report highlights to investigators the importance of understanding the size of the criminal entities they're dealing with."

A typical large organization allocates 80% of its operating expenses to wages, with the figure similarly high (78%) for small criminal organizations, according to the report. Other common expenses include infrastructure (servers/routers/VPNs), virtual machines, and software.

The study outlined three types of organizations based on size, using examples where Trend Micro collected the most data from law enforcement and insider information.

Small criminal businesses (e.g., Counter Anti-Virus service Scan4You):

• Typically, one management layer, 1-5 staff members, and under $500K in annual turnover.
• Their members often handle multiple tasks within the group and also have a day job on top of this work.
• Comprise the majority of criminal businesses, often partnering with other criminal entities.

Medium-sized criminal businesses (e.g., bulletproof hoster MaxDedi):

• Typically have two management layers, 6-49 employees, and up to $50m in annual turnover.
• They usually have a pyramid-style hierarchical structure with a single person in charge.

Large criminal business (e.g., ransomware group Conti):

• Typically have three management layers, 50+ staff, and $50m+ in annual turnover.
• Feature relatively large numbers of lower management and supervisors.
• Implement effective OPSEC and partner with other criminal organizations.
• Those in charge are seasoned cyber-criminals and hire multiple developers, administrators, and penetration testers – including short-term contractors.
• They may have corporate-like departments (e.g., IT, HR) and even run employee programs, such as performance reviews.

According to the report, knowing the size and complexity of a criminal organization can provide critical clues to investigators, such as what types of data to hunt for.

For example, larger criminal entities may store employee lists, financial statements, company guides/tutorials, M&A documents, employee crypto wallet details, and even shared calendars to probe.

Understanding the size of targeted criminal organizations can also allow law enforcers to prioritize better which groups should be pursued for maximum impact.

About Trend Micro
Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's cybersecurity platform protects hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, the platform delivers a powerful range of advanced threat defense techniques optimized for environments like AWS, Microsoft, and Google, and central visibility for better, faster detection and response. With 7,000 employees across 65 countries, Trend Micro enables organizations to simplify and secure their connected world. www.TrendMicro.com.  

View original content to download multimedia:https://www.prnewswire.com/news-releases/wages-dominate-cybercrime-groups-operating-expenses-301787819.html

SOURCE Trend Micro Incorporated

FAQ

What does Trend Micro's April 2023 report reveal about cybercrime organizations?

The report shows that criminal organizations are starting to resemble legitimate businesses as they grow.

How do criminal organizations manage their operating expenses according to Trend Micro?

Typically, they allocate 80% of their operating expenses to wages.

What are the three types of criminal organizations identified in the report?

The report categorizes them as small, medium, and large criminal businesses.

What is the significance of understanding the size of criminal organizations?

It helps law enforcement prioritize which groups to pursue for maximum impact.

Where can I find the full report by Trend Micro?

The full report can be accessed on Trend Micro's official website.