Holding the World to Ransom: The Top 5 Most Dangerous Criminal Organizations Online Right Now

In April, REvil stole technical data on unreleased Apple products from Quanta Computer, a Taiwanese company that assembles Apple laptops. A ransom of US$50 million was demanded to prevent public release of the stolen data. It hasn’t been revealed whether or not this money was paid.

Clop
The ransomware Clop was created in 2019 by a financially-motivated group responsible for yielding half a billion US dollars.

The Clop group’s specialty is “double-extortion”. This involves targeting organizations with ransom money in exchange for a decryption key that will restore the organization’s access to stolen data. However, targets will then have to pay extra ransom to not have the data released publicly.

Historical examples reveal that organizations which pay a ransom once are more likely to pay again in the future. So hackers will tend to target the same organizations again and again, asking for more money each time.

Syrian Electronic Army
Far from a typical cybercrime gang, the Syrian Electronic Army has been launching online attacks since 2011 to promote political propaganda. With this motive, they have been dubbed a hactivist group.

While the group has links with Bashar al-Assad’s regime, it’s more likely made up of online vigilantes trying to be media auxiliary for the Syrian army.

Their technique is to distribute fake news through reputable sources. In 2013, a single tweet sent by them from the official account of the Associated Press, the world’s leading news agency, had the effect of wiping billions from the stock market.

The Syrian Electronic Army exploits the fact that most people online have a tendency to interpret and react to content with an implicit sense of trust. And they’re a prime example of how the boundaries between crime and terror groups online are less distinct than in the physical world.

FIN7
If this list could contain a “super villain”, it would be FIN7. Another Russian-based group, FIN7 is arguably the most successful online criminal organization of all time. Operating since 2012, it mainly works as a business.

Many of its operations have been undetected for years. Its data breaches have exploited cross-attack scenarios, wherein the data breach serves multiple purposes. For example, it may enable extortion through ransom while also allowing the attacker to use data against victims, such as by reselling it to a third party.

In early 2017, FIN7 was alleged to be behind an attack targeting companies providing filings to the US Security and Exchange Commission. This confidential information was exploited and used to obtain ransom which was then invested on the stock exchange.

As such, the groups made huge sums of money by trading on confidential information. The insider trading scheme facilitated by hacking went on for many years — which is why it’s not possible to quantify the exact amount of economic damage. But it’s estimated to be well over US$1 billion.

Organized Crime vs Organized Criminals
When it comes to complex criminal organizations, techniques evolve and motives vary.

The way they organize themselves and commit crimes online is very different from your local offline gang. Ransomware can be launched from anywhere in the world, so it’s very difficult to prosecute these criminals. Matters are made even more complicated when several parties coordinate across borders.

It’s no wonder the challenge for law enforcement agencies is significant. It’s crucial that authorities investigating an attack are sure it was indeed perpetrated by who they suspect. But to know this, they need all the help they can get.

Roberto Musotto is Research fellow, Edith Cowan University. This article is published courtesy of The Conversation.