Cybercriminals hold online competitions to recruit experts and develop attacks

Cyber ​​crime groups sponsor Research contests in illegal forums to discover new cyber attack tools and ways to avoid detection. This is a summary of a study published at the end of August. Sophos.

According to the company that specializes in security software and hardware, the contests run by hackers mimic a legitimate conference called the “Call for Papers.” Amounts are distributed along with the promise of employment and recognition of the criminal community quite high for winners.

Participants contribute to the success of the malicious campaign by helping develop valuable resources to efficiently bypass targets’ security barriers. These disputes developed over the years, according to the report.

Initially, championships included simple graphic design competitions, guessing games and quizzes. Now, contestants must submit complete technical aspects, including source code, videos and/or screenshots detailing their methodsEveryone has the right to vote, although the evaluation criteria are not entirely clear.

different possibilities

To conduct the research, researchers from Sophos X-Ops division analyzed two contests on illegal forums. One of them, The one organized by the Russian group Exploit in 2021 distributed 80,000 US dollars (R $ 393,000 at the price of the day), while the other, on the XSS forum in 2022, had a prize pool of 40,000 US dollars (R $ 196,000).

According to experts, the focus of the competition managed by Exploit was cyber attacks targeting cryptocurrencies. The other had a wide variety of topics. Topics like social engineering, attack vectors, and recommendations for detecting and avoiding fraud.

The report notes that some of the winning projects aimed to explore tools such as Cobalt Strike, which are used to evaluate cyber defense mechanisms.

Other prominent offerings included tutorials on how to disable Windows Defender by manipulating privilege tokens and how to illegally raise funds for a new cryptocurrency.