How does the cybercrime underground economy work?

The cybercrime underground economy is a loose federation of specialists who sell capabilities, services and resources tailored to abuse. Criminals assemble these parts like a supply chain. Researchers split the market into profit centers, which pull money from victims, and support centers, which supply what the profit centers need.

Where does this framing come from?

A 2015 paper presented at the Workshop on the Economics of Information Security by Kurt Thomas, Stefan Savage, Damon McCoy and colleagues surveyed existing research to systematize understanding of the underground economy. It describes internet crime as increasingly dependent on that economy, in which modern criminal entrepreneurs piece together dozens of à la carte components into new criminal endeavors. The paper is a decade old, so specific markets have changed. The structure it describes still helps.

What are profit centers?

Profit centers are activities that transfer money from victims and institutions into the underground. The paper gives a range from selling products to unwitting customers, in the case of spamvertised goods, to outright theft in financial fraud. Today you can add extortion through ransomware and data theft, which CISA describes as encrypting files and then threatening to sell or leak stolen data. One way to see ransomware as a service is as a profit center that rents out its tooling to affiliates.

What are support centers?

Support centers supply resources that other criminals request to streamline abuse. The paper lists exploit kits, compromised credentials and even human services, such as manual CAPTCHA solvers, that have no credible legitimate use. Add stolen session tokens and access to already-compromised networks and you have the shopping list of a modern attacker.

Constructed example of the chain: one seller harvests credentials with a phishing kit. Another sells those credentials in bulk. A third buys a handful that belong to a company's remote access gateway and sells that access to an affiliate. The affiliate deploys ransomware rented from a fourth party, and uses a payment channel run by a fifth. Nobody in the chain did all of it, and the victim sees only the last step.

Why does it matter to defenders?

The paper's argument is that this dependence creates fragile dependencies. If a profit center needs ten support services and one is disrupted, the whole operation suffers. It argues for a shift away from only protecting users and systems, which it likens to fighting a fire, toward also disrupting the underground relationships that underpin the for-profit abuse ecosystem: actors, infrastructure and access to capital.

Most companies cannot disrupt markets. But you can see where your controls hit the chain:

• Credential theft: multifactor sign-in that resists replay makes stolen passwords worth less.
• Initial access sales: patching internet-facing systems and removing stale remote access shrinks the supply of what brokers sell.
• Tooling: layered detection at the later stages works across many tools, since affiliates differ at the start and converge later, as CISA's advisory on a ransomware-as-a-service operation notes.
• Cash-out: recovery planning and immutable backups remove the pressure that makes extortion pay.

What does the model not tell you?

It is a taxonomy, not a measurement. It does not say how big any market is or how much a given service costs, and this article does not give figures. For current volumes and prices, rely on dated reporting from law enforcement and government agencies, and treat any number without a source and a date with suspicion.

How to check or apply this

1. List the main ways an outsider could get in: stolen credentials, exposed services, phishing, supplier access.
2. For each, ask what a seller of that access would need from you, and how you could make it harder.
3. Rotate and monitor credentials that grant remote access, and remove accounts that no longer have an owner.
4. Check whether your credentials appear in breach corpora through a trustworthy lookup, and force resets.
5. Test your ability to detect late-stage activity, such as bulk file changes and mass data transfers.
6. Rehearse recovery, including the case where stolen data is the threat.
7. Report incidents to law enforcement, since intervention against the underground depends on shared evidence.

Quick check

Sources

• Thomas et al., Framing Dependencies Introduced by Underground Commoditization (WEIS 2015)
• CISA: Ransomware 101
• CISA Advisory AA23-165A: Understanding Ransomware Threat Actors, LockBit

Last reviewed: 18 October 2026.