Turning up the dial: The evolution of a cybercrime market through set-up, stable, and Covid-19 eras

Anh Vu, Jack Hughes, Ildiko Pete, Ben Collier, Yi Ting Chua, Ilia Shumailov, Alice Hutchings

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract / Description of output

Trust and reputation play a core role in underground cybercrime markets, where participants are anonymous and there is little legal recourse for dispute arbitration. These underground markets exist in tension between two opposing forces: the drive to hide incriminating information, and the trust and stability benefits that greater openness yields. Revealing information about transactions to mitigate scams also provides valuable data about the market. We analyse the first dataset, of which we are aware, about the transactions created and completed on a well-known and high-traffic underground marketplace, Hack Forums, along with the associated threads and posts made by its users over two recent years, from June 2018 to June 2020. We use statistical modelling approaches to analyse the economic and social characteristics of the market over three eras, especially its performance as an infrastructure for trust. In the Set-up era, we observe the growth of users making only one transaction, as well as 'power-users' who make many transactions. In the Stable era, we observe a wide range of activities (including large-scale transfers of intermediate currencies such as Amazon Giftcards) which declines slowly from an initial peak. Finally, we analyse the effects of the Covid-19 pandemic, concluding that while we see a significant increase in transactions across all categories, this reflects a stimulus of the market, rather than a transformation. New users overcome the 'cold start' problem by engaging in low-level currency exchanges to prove their trustworthiness. We observe currency exchange accounts for most contracts, and Bitcoin and PayPal are the preferred payment methods by trading values and number of contracts involved. The market is becoming more centralised over time around influential users and threads, with significant changes observed during the Set-up and Covid-19 eras.
Original languageEnglish
Title of host publicationIMC '20
Subtitle of host publicationProceedings of the ACM Internet Measurement Conference
Place of PublicationNew York
PublisherAssociation for Computing Machinery (ACM)
Number of pages16
ISBN (Print)9781450381383
Publication statusPublished - 27 Oct 2020
EventACM Internet Measurement Conference 2020 -
Duration: 27 Oct 202029 Oct 2020

Publication series

NameProceedings of the ACM Internet Measurement Conference
PublisherPublisher name: Association for Computing Machinery (ACM)


ConferenceACM Internet Measurement Conference 2020
Internet address

Keywords / Materials (for Non-textual outputs)

  • underground economy
  • hacking forums
  • cybercrime market
  • economic evolution
  • coronavirus
  • COVID-19
  • pandemic


Dive into the research topics of 'Turning up the dial: The evolution of a cybercrime market through set-up, stable, and Covid-19 eras'. Together they form a unique fingerprint.

Cite this