Cyber criminals using complex financial system, study shows

Cyber criminals are responsible for up to 10% of the total illegal profits being laundered globally, which UN figures indicate equates to about $200bn a year, a study shows.

To achieve this, they are using a combination of cryptocurrencies such as monero, gaming currencies and micropayments, according to a study commissioned by virtualisation-based security firm Bromium.

The findings on cyber criminal money-laundering and cashing-out methods are part of a study into the macro economics of cyber crime and how the various elements link together which has been led by Michael McGuire, senior lecturer in criminology at Surrey University.

“This is the first time the financial flows of cyber criminals have been put together into a composite picture,” said McGuire, who will present the full findings of the nine-month Web of profit study at the RSA Conference in San Francisco from 17-19 in April.

“Law enforcement and cyber security professionals can use the study to understand how revenue generation is feeding into laundering, and how laundering is feeding into more traditional methods of money-laundering and the way cyber criminals are spending their money, so that they look at the intersections between the various networks more carefully,” he told Computer Weekly.

The study, which draws from first-hand interviews with convicted cyber criminals, data from international law enforcement agencies, financial institutions and covert observations conducted across the dark web, found that although cryptocurrencies have become the primary tool used by cyber criminals for money laundering, cyber criminals are moving away from bitcoin to cryptocurrencies such as monero, which provide greater anonymity.

But cyber criminals are not using any one form of digital currency to move their illicit funds around – they are also using micropayments and gaming currencies.

This is done by converting stolen funds into game currencies or in-game items such as gold, which are then converted into bitcoin or other electronic formats. Games such as Minecraft, FIFA, World of Warcraft and GTA 5 are among the most popular options because they allow covert interactions with other players that enable trade of currency and goods.

“Gaming currencies and items that can be easily converted and moved across borders offer an attractive prospect to cyber criminals,” said McGuire.

“This trend appears to be particularly prevalent in countries like South Korea and China – with South Korean police arresting a gang transferring $38m laundered in Korean games, back to China. The advice on how to do this is readily available online and explains how cyber criminals can launder proceeds through both in-game currencies and goods.”

Covert data collection in online forums and interviews with experts and cyber criminals indicate that about 10% of cyber criminals are using PayPal to launder money. A further 35% use other digital payment systems, including Skrill, Dwoll, Zoom and mobile payment systems such as M-Pesa.

Methods such as “micro laundering”, where thousands of small electronic payments are made through platforms such as PayPal to avoid triggering alerts, are increasingly common and more difficult to detect. Another common technique is to use online transactions via sites such as eBay to facilitate the laundering.

“The growing use of digital payment systems by cyber criminals is creating significant problems for the global financial system,” said McGuire.

“Revenues that previously would have flowed within proven and well-established banking systems and could be traced are now outside of its jurisdiction. Digital payment systems are most effective when combined with other digital resources, such as virtual currencies and online banking. This hides the money trail and confuses law enforcement and financial regulators.”

Bromium CEO Gregory Webb said his company commissioned the research to inform a meaningful conversation about how to disrupt the economic systems and poor security practices that enable and support cyber crime.

“It is still too easy for cyber criminals to infect machines, steal data and hold businesses and individuals to ransom – because enterprise defences are not fit for purpose,” he said, adding that protecting applications that access sensitive data is an absolute requirement.

“It is equally easy for cyber criminals to convert ill-gotten electronic funds it into cash – and the rise in use of unregulated, virtual currencies is making this even easier,” said Webb.

“We need to attack the problem in a different way. Law enforcement, the cyber security industry and organisations themselves need to take responsibility for their role in disrupting cyber crime.”