Chinese DDW Threat Actors' Relationship with Other DDW Communities

No ratings

Presented at CODEBLUE2018@TOKYO 2018 by

Mark Schaefer

Flashpoint analysts have increasingly observed Chinese Deep and Dark Web (DDW) threat actors indicate that they procure knowledge on tactics, techniques, and procedures (TTPs) pertaining to illicit activity, tutorials, tools and malware from threat actors who reside in non-Chinese DDW communities. This presentation will explore the types of information Chinese DDW threat actors procure from other communities as well as the possible motivations for obtaining such information from non-Chinese sources. This talk will also identify barriers-to-entry that Chinese-speaking DDW actors experience when attempting to operate in other DDW communities.The research will look at both native Chinese and non-Chinese DDW communities. Analysts have observed Chinese-speaking DDW threat actors not only divulge their relationships with non-Chinese DDW communities on the Chinese language DDW forum Deep Web Chinese, but have also been located in DDW sites such as AlphaBay, Dream Market, and WWH-Club.As of this writing, analysts have uncovered a few examples that can be used as case studies. For instance, Chinese threat actors involve themselves in ransomware partnerships maintained by Russian actors. They also discuss and vend English-language carding tutorials. Additionally, analysts have discovered that there is a demand among Chinese-speaking threat actors for guidance on how to access, create and account, and leverage data sold in Joker’s Stash, a prolific underground marketplace that vends compromised credit card data.