Cyber Criminals Have Ingenious Money Laundering Methods

Cyber criminals are using a combination of new cryptocurrencies, gaming currencies and micro-payments to launder up to $200bn in ill-gotten gains, research has revealed.

Cyber criminals are responsible for up to 10% of the total illegal profits being laundered globally, which UN figures indicate equates to about $200bn a year, a study shows.

To achieve this, they are using a combination of crypto-currencies such as Monero, gaming currencies and micropayments, according to a study commissioned by virtualisation-based security firm Bromium.

The findings on cyber-criminal money-laundering and cashing-out methods are part of a study into the macro economics of cyber-crime and how the various elements link together which has been led by Michael McGuire, senior lecturer in criminology at Surrey University.

“This is the first time the financial flows of cyber criminals have been put together into a composite picture,” said McGuire, who will present the full findings of the nine-month Web of profit study at the RSA Conference in San Francisco from 17-19 in April.

“Law enforcement and cyber security professionals can use the study to understand how revenue generation is feeding into laundering, and how laundering is feeding into more traditional methods of money-laundering and the way cyber criminals are spending their money, so that they look at the intersections between the various networks more carefully,” he told Computer Weekly.

The study, which draws from first-hand interviews with convicted cyber criminals, data from international law enforcement agencies, financial institutions and covert observations conducted across the dark web, found that although crypto-currencies have become the primary tool used by cyber criminals for money laundering, cyber criminals are moving away from bitcoin to crypto-currencies such as Monero, which provide greater anonymity.

But cyber criminals are not using any one form of digital currency to move their illicit funds around, they are also using micro-payments and gaming currencies.

This is done by converting stolen funds into game currencies or in-game items such as gold, which are then converted into bitcoin or other electronic formats. Games such as Minecraft, FIFA, World of Warcraft and GTA 5 are among the most popular options because they allow covert interactions with other players that enable trade of currency and goods.

“Gaming currencies and items that can be easily converted and moved across borders offer an attractive prospect to cyber criminals,” said McGuire.

“This trend appears to be particularly prevalent in countries like South Korea and China, with South Korean police arresting a gang transferring $38m laundered in Korean games, back to China. The advice on how to do this is readily available online and explains how cyber criminals can launder proceeds through both in-game currencies and goods.”

Covert data collection in online forums and interviews with experts and cyber criminals indicate that about 10% of cyber criminals are using PayPal to launder money. A further 35% use other digital payment systems, including Skrill, Dwoll, Zoom and mobile payment systems such as M-Pesa.

Methods such as “micro laundering”, where thousands of small electronic payments are made through platforms such as PayPal to avoid triggering alerts, are increasingly common and more difficult to detect. Another common technique is to use online transactions via sites such as eBay to facilitate the laundering.

“The growing use of digital payment systems by cyber criminals is creating significant problems for the global financial system,” said McGuire.

“Revenues that previously would have flowed within proven and well-established banking systems and could be traced are now outside of its jurisdiction. Digital payment systems are most effective when combined with other digital resources, such as virtual currencies and online banking. This hides the money trail and confuses law enforcement and financial regulators.”

Bromium CEO Gregory Webb said his company commissioned the research to inform a meaningful conversation about how to disrupt the economic systems and poor security practices that enable and support cyber-crime.

“It is still too easy for cyber criminals to infect machines, steal data and hold businesses and individuals to ransom, because enterprise defences are not fit for purpose,” he said, adding that protecting applications that access sensitive data is an absolute requirement.

“It is equally easy for cyber criminals to convert ill-gotten electronic funds it into cash – and the rise in use of unregulated, virtual currencies is making this even easier,” said Webb.

“We need to attack the problem in a different way. Law enforcement, the cyber security industry and organisations themselves need to take responsibility for their role in disrupting cyber-crime.”

Property purchases

Many cyber criminals are using virtual currency to make property purchases which convert illegal proceeds into legitimate cash and assets, the study found.

Websites such as Bitcoin Real Estate offer a wide range of property investments that can be made using crypto-currencies, but unlike cash purchases which are subject to regulation and scrutiny, properties bought with crypto-currency are not as closely scrutinised because cryptocurrencies are not regulated by any central banks or governments.

About a quarter of all property sales are predicted to be in crypto-currency within the next few years, but this has raised concerns among financial analysts that allowing swifter, more covert transactions, many with criminal connections, will disrupt global property markets.

However, the report highlights that law enforcement agencies are monitoring bitcoin, causing many cyber criminals to seek alternatives. Information on bitcoin transactions can leak during web transactions, the report said, typically via web trackers or cookies. This means that connecting transactions to individuals is possible in up to 60% of bitcoin payments.

“It is therefore no surprise to see cyber criminals using virtual currency for money laundering,” said McGuire.

“The attraction is obvious. It’s digital, so is an easily convertible way of acquiring and transferring cyber-crime revenue. Anonymity is also key, with platforms like Monero designed to be truly anonymous, and tumbler or mixing services like CoinJoin that can obscure transaction origins. Targeted organisations must do more to protect their customers.”

McGuire also believes law enforcement must focus more effort and resources on the use of cryptocurrencies and digital payment systems by cyber criminals. “UK law enforcement, for example, has only a handful of specialist officers looking at this, which is shocking and astounding,” he said.

In this regard, McGuire said US law enforcement is much more advanced and has set up specialised units, which have had a fair amount of success. “In the UK, and probably elsewhere in Europe, law enforcement is not taking this area of investigation seriously enough in terms of understanding and resource allocation,” he said.

Despite the fact that politicians say repeatedly that tacking cyber-crime is a priority, McGuire said there is still not enough money allocated to doing so. “But in addition, UK law enforcement is not allocating enough officers internally to understanding and investigating crypto-currencies, and does not appreciate where it is going,” he said, adding that this has to change if the problem is to be dealt with adequately in future.

Comuterweekly:     Image: Nick Youngson

You Might Also Read:

Inside the Big Business Of Cyber Crime: