Crowdsourcing The Dark Web: A One-Stop Ran$om Shop

Ransom attacks are at an all-time high; more and more criminals are using common tools to steal data and extort data owners. But this type of attack can be risky for the cybercriminal because, unlike stealthy advanced attacks, such operations require interaction with the victim. Furthermore, even if the victim is willing to pay to get their stolen data back, monetizing these attacks isn't so easy: not every criminal knows how to find a trustworthy Bitcoin launderer, or how to monetize their crime with minimal risk.

One cyber underground group saw this as a golden opportunity and created Ran$umBin, a Dark Web service that acts as a one-stop shop for monetizing ransomware. The website is dedicated to criminals and victims alike: it lets criminals upload stolen data (embarrassing information, user credentials, credit data, stolen identities, and any other kind of cyber-loot), and lets victims pay for the removal of said stolen data from the Dark Web, where it could be bought by any cybercriminal who's willing to pay.  

Ran$umBin has been active for under two months; it is very user-friendly and its business model is simple: hackers can upload stolen data and either sell it to other criminals or extort the data's owner – while the site takes commission. The site's cut is based on who the data owner is: criminals who want to buy data belonging to a pedophile would pay $100 and the site would take a 30% commission; if a criminal is looking for data belonging to a celebrity or a law enforcement representative, the price could be double and the commission would climb to 40%. Alternatively, the hacker who uploads the data can choose their own ransom demand and simply send their victim instructions on how to log in to Ran$umBin and pay. I've seen several Dox markets, but this one truly stands out: it’s a platform where any criminal can use what other criminals have stolen, like a cyber-ransom Uber or AirBnB.

Honor among thieves?

The people behind Ran$umBin define their initiative as a new kind of one-stop ransom market. They don't send extortion messages to victims, and see themselves as responsible only for the safety and privacy of their users. But what if a victim is being extorted over and over again using Ran$umBin? The operators say they try to make sure nobody is extorted more than 10 times, in order to keep their offerings fresh (but don't make any promises). While the operators mentioned that the stolen data is validated to make sure it's not old or irrelevant, they did not explain how this is done.

It is unknown who runs this operation, but their language and lingo, and the service's structure, suggest that these are American players. They try to promote Ran$umBin using a designated Twitter account, and have already gained some traction among cybercriminals: the service has been recommended on different forums, Dark Web and listed sites alike.

The cyber underground is teeming with markets of all kinds, so this type of service was certain to evolve. Ransom tools are cheaper and more available than ever before, and many criminals use them. The ability to sell Dox with minimal risk might appeal to many criminals, especially newcomers who don't have the right connections and can't tell who to trust. If Ran$umBin's operators are indeed Americans, their initiative might not hold for long; the North American underground market is less secretive than similar markets in Russia, Brazil, or the Far East. Therefore, websites are taken down more often by authorities. For the victims' sake, lets hope that this one will suffer a similar fate.

Related Content: