Hack-for-hire operation explained

Hack-for-hire operations are services that provide clients with illicit access to information by infiltrating digital systems or networks, typically for a fee. This form of hacking on demand has seen a surge in popularity over recent years, with the trend being attributed to advancements in technology, growing digital connectivity, and increasing demand for corporate espionage and personal data breaches.^[1]

History

The concept of hack-for-hire services can be traced back to the early years of the internet, when hackers were contracted for a variety of reasons, such as to perform penetration tests which was considered "ethical hacking"^[2] . Over time, however, the scope of these operations expanded to include illegal activities, like industrial espionage, personal data breaches, and illicit political interference.^[3]

Operation

Hack-for-hire operations typically involve a client who pays a hacker or a group of hackers to infiltrate a specified digital system or network to gather information. The services offered by these hackers can range from simple password cracking to sophisticated techniques such as phishing, ransomware attacks, or advanced persistent threats (APTs).^[4]

Hack-for-hire operations often utilize the dark web, an encrypted part of the internet that is not indexed by traditional search engines, to advertise their services and connect with potential clients. Transactions are typically made using cryptocurrencies to maintain anonymity.^[5]

Legality

Hack-for-hire services are typically considered illegal, as they involve unauthorized access to private digital systems and computer networks. They are generally punishable under the computer crime laws of many countries, including the Computer Fraud and Abuse Act (CFAA) in the United States and the Computer Misuse Act in the United Kingdom.^{[6] [7]}

Recent developments

In 2023, an extensive Reuters investigation revealed a massive scheme of hack-for-hire operations, uncovering several groups operating globally. The investigative report showed the complex and sophisticated nature of such operations, which often involved multiple layers of hackers subcontracting work to maintain anonymity and evade legal repercussions.^[8]

The London-based National Cyber Security Centre (NCSC) said in a report published on June 22 2023 that it was increasingly seeing "hackers-for-hire" brought in "to gain the upper hand in business dealings or legal disputes."^[9]

Notable cases

Several high-profile hack-for-hire operations have made headlines in recent years:

1. Operation Aurora (2009): A cyber-attack which began in mid-2009 targeted several high-profile organizations, including Google and Adobe. Later investigations linked the attacks to the Chinese government, suggesting state-sponsored hack-for-hire activity.
2. Hacking Team (2015): An Italian cybersecurity firm known for providing hacking services to governments worldwide, Hacking Team itself was hacked in 2015. The breach exposed the company's internal documents and revealed its controversial clients, such as repressive governments. The company was dissolved in 2020.
3. Dark Basin (2020): A group of hack-for-hire operators known as Dark Basin targeted a wide range of industries and individuals worldwide and was uncovered in 2017 by Citizen Lab The group was found to have links to an Indian IT firm called BellTroX.

See also

• Cybersecurity
• Cyber spying / Cyber Espionage
• Advanced Persistent Threat

Notes and References

1. Web site: U.S. hackers' litigation campaign muddies attribution in global cybercrimes. Reuters. July 19, 2023.
2. Web site: History of Ethical Hacking. National Cyber Security Alliance (StaySafeOnline.org). July 19, 2023.
3. Web site: U.S. hackers' litigation campaign muddies attribution in global cybercrimes. Reuters. July 19, 2023.
4. Web site: NIST Cybersecurity Framework. National Institute of Standards and Technology (NIST). 12 November 2013. July 19, 2023.
5. Web site: 12 October 2021 . What it costs to hire a hacker on the dark web . July 19, 2023 . TechRepublic.
6. Web site: Computer Misuse Act 1990. The National Archives - Legislation.gov.uk. July 19, 2023.
7. Web site: Computer Fraud and Abuse Act. United States Department of Justice. 19 February 2015 . July 19, 2023.
8. Web site: U.S. hackers' litigation campaign muddies attribution in global cybercrimes. Reuters. July 19, 2023.
9. Web site: French, UK watchdogs say hackers-for-hire are targeting law firms. Reuters. July 19, 2023.