Cyber criminals earn up to $2m a year, study shows

Cyber criminals are acquiring, laundering, spending and reinvesting about $1.5tn in profits a year, research has revealed.

The highest-earning cyber criminals are making up to $2m (£1.4m) a year, almost as much as a FTSE250 CEO, according to a study commissioned by virtualisation-based security firm Bromium.

Mid-level cyber criminals make up to $900,000 (£639,000), which is more than double the US president’s salary, while entry-level cyber criminals make about $42,000 (£30,000), which is significantly more than the average UK graduate, the research noted.

The findings on how much cyber criminals earn from their illegal activities and what they spend their profits on are part of an 11-month study into the macro economics of cyber crime and how the various elements link together. It has been led by Michael McGuire, senior lecturer in criminology at Surrey University.

The report highlights how cyber crime has become a booming economy, and reveals cyber criminal links to drug production, human trafficking and even terrorism.

The use of ransomware, crime-as-a-service, data theft, illicit online marketplaces and trade secret/IP theft are helping cyber criminals generate huge revenues with relative ease, the report said.

The research also revealed that there are large organisations in the burgeoning cyber crime economy that closely match the structures and business plans of companies such as Uber, AirBnB, Facebook, Twitter and WhatsApp.

These platform owners are acting more like service providers than criminals, leading to a shift from those who commit crime to those who enable and profit from it, the report said.

“Cyber crime is a lucrative business, with relatively low risks compared to other forms of crime,” said Bromium CIO Gregory Webb.

“Cyber criminals are rarely caught and convicted because they are virtually invisible. As criminals further monetise their business, allowing anyone to buy pre-packaged malware or hire hackers on demand, the ability to catch the kingpins becomes even more challenging.”

According to Webb, the cyber security industry, business and law enforcement agencies need to come together to disrupt cyber criminals and cut off their revenue streams. “By focusing on new methods of cyber security that protect rather than detect, we believe we can make cyber crime a lot harder,” he said.

Data gathered by the research team through first-hand interviews with 100 convicted or currently engaged cyber criminals, law enforcement agencies and financial institutions, combined with dark web investigations, reveals that 15% of cyber criminals spend most of their money on immediate needs, such as paying bills.

One-fifth of cyber criminals focus their spending on drugs and prostitution, 15% spend to attain status or impress, but 30% convert some of their revenue into investments. Some 20% spend at least some of their revenue on reinvestments in further criminal activities, such as buying IT equipment.

The proceeds of cyber crime fuel other crimes, such as terrorism and human trafficking, the report said, much like a legitimate business reinvests profits to expand while also contributing towards core philanthropic values.

The research showed that cyber criminals are reinvesting their money to grow their own business, but also to promote other types of crime. Terrorism, human trafficking, drugs manufacturing and firearms trading have all been beneficiaries of cyber crime.