Investigation results
What we discovered in our investigation is that anyone with internet access can hire hackers, employ their services, and even purchase compromised credentials, wallets, and personal information. These threats should be taken seriously, and organizations and individuals should take appropriate action to mitigate these threats before they are actualized.
The offerings our team identified were all deliverable services based on certain exploitation criteria, the hacker’s skill set, and the available tool kit. Additionally, most were reasonably affordable for any individual with the funds and motivation to purchase services. The scope of hacker-for-hire services is limited only by a target’s online presence. Theoretically, anyone can become a hacker’s target for the right price.
Typical customers
According to a report by the cyberthreat intelligence firm Mandiant, the most significant clients for hackers for hire are government-sponsored groups like UNC2589 and APT28.
Government-sponsored groups use hackers for hire to carry out espionage, sabotage, or any other disruption against their rivals. Corporate entities sometimes use hacker-for-hire services to gain access to competitors' trade secrets like recipes or internal documentation, customer financial data, or to even take down a competitor's website through a DDoS attack. Individuals use hacker-for-hire services for personal reasons, most notably for revenge or specific personal goals like self-enrichment.
Potential customers don’t need to understand how DDoS works, why it’s harmful to businesses, or the consequences of carrying out attacks. All they need to provide is a target and payment. Hiring a hacker for DDoS services can be accomplished simply by searching for keywords.
Serious consequences
Attacks carried out by hackers for hire can have devastating effects on organizations and individuals. In addition to the direct financial costs associated with a breach, organizations suffer reputational damage. Customers might lose trust in a business that has been breached, leading to a loss of revenue. According to a 2022 report by IBM, 83% of organizations have experienced more than one data breach.
But hacker-for-hire attacks can also have serious consequences for the hackers themselves when they’re caught. In December 2022, the Federal Bureau of Investigation (FBI) seized approximately 48 domains in relation to DDoS-for-hire services. The domains were run by six individuals, who were later arrested and are facing criminal charges. The FBI linked the 48 domains to DDoS attacks targeting educational organizations, government agencies, and notable gaming platforms between 2014 and 2022. While these sites are no longer active, it is worth noting that they contained wording like “booter” and “stresser.”
Consequences have also rained down on hackers who provide RaaS. In January 2023, the FBI shut down a major Russian crime syndicate known as Hive. The takedown was the culmination of two years of stealth hacking with assistance from other global government entities. Prior to its shutdown, Hive sold ransomware tools and services to affiliates, dating back to spring of 2021.
The importance of pen tests
One of the most effective ways organizations can mitigate the threat of hackers for hire is to hire a hacker – more specifically, a pen tester. Pen testers can evaluate the security of an organization’s external internet presence, its internal network, a specific website or application, and even simulate niche scenarios like ransomware, malware, and social engineering campaigns.
By identifying vulnerabilities through these assessments, organizations can take steps to address them before they can be exploited by malicious hackers. Often, pen tests reveal specific areas in which organizations can make improvements, such as network segmentation, Microsoft Active Directory™ security, and missing security patches attributed to several systems.
Pen testing assessments typically follow a defined structure, with system- and service-specific tools executed to test each set of vulnerabilities. For example, an external pen test almost always begins with service enumeration, port scans, vulnerability scans, exploiting any identified vulnerabilities, and testing any vulnerable methods of privilege escalation in the environment.
Pen testers also create exploit code to evaluate known vulnerabilities, known as proof of concept. After evaluation of a client’s environment, pen testers provide a report detailing any identified findings, thorough descriptions, and detailed steps for remediation of any discovered vulnerabilities.
Pen tests are worth the investment for organizations of all sizes, ranging from restaurants, banks, and e-commerce businesses to large multinational corporations and government organizations. Even the smallest businesses least assumed to be a target can be targeted by hackers for hire, and the costs associated with a breach can be devastating.
Pen tests and getting ahead of threats
The rise of hackers for hire poses a significant threat. These malicious actors offer a range of services, including malware, ransomware, phishing, and DDoS attacks, and can be sourced on the dark web, social media platforms, and messaging apps. What’s more concerning is that such attacks can be sourced by anyone, and contracting a hacker for hire continues to be more accessible every day.
While the types of people who pay for these services vary, the consequences for organizations that fall victim to a cyberattack can be catastrophic, including direct financial costs of billions of dollars and reputational damage. One of the most effective ways for organizations to protect themselves is through regular pen testing, which can identify vulnerabilities in a system or network before they can be exploited by malicious hackers. It is always important for businesses to regularly measure the security of their environment and services and to take proactive, preventive measures to improve their security posture.
