Abstract

The underground cybercriminal space is very fragmented. Dozens of forums and hundreds if not thousands of groups and channels on Telegram (not to mention `deep-web’ websites, Discord servers, and others) make a cybercriminal’s life more complicated than not: which community(ies) to join, when, and what for? The decision is riddled with uncertainties: law enforcement presence, risk of exit scams, trustworthiness of buyers and sellers, quality of products, transaction assurances, short and mid-term economic prospects and associated costs; the list goes on.

In this talk we discuss preliminary evidence that criminals may, in the aggregate, prefer communities with a certain set of characteristics for the trade of highly-effective technology. Further, we explore the role of Telegram in this ecosystem and compare it to the mainly forum-based model of the past. If time allows, we then zoom out and discuss what economic theory can tell us about `migration’ decisions across (in our case, criminal) communities, and how to possibly approach the evaluation of cybercriminal spaces from that angle.

Zoom link: https://cam-ac-uk.zoom.us/j/87272614363?pwd=FDKSIgk354DY8Z9InowbfSlUbMHu48.1

Meeting ID: 872 7261 4363 Passcode: 925499