Where is Dmitry going? Framing 'migratory' decisions in the criminal underground

TL;DR

This paper investigates the factors influencing cybercriminals' decisions to migrate between underground forums and platforms, emphasizing trust signals and economic incentives within a fragmented and evolving ecosystem.

Contribution

It introduces a framework for understanding migration decisions in cybercriminal communities by analyzing trust signals and platform roles, including preliminary Telegram channel analysis.

Findings

Trust signals influence migration choices

Telegram channels exhibit distinct trust and role patterns

Ecosystem fragmentation impacts criminal migration behavior

Abstract

The cybercriminal underground consists of hundreds of forum communities that function as marketplaces and information-exchange platforms for both established and wannabe cybercriminals. The ecosystem is continuously evolving, with users migrating between forums and platforms. The emergence of cybercrime communities in Telegram and Discord only highlights the rising fragmentation and adaptability of the ecosystem. In this position paper, we explore the economic incentives and trust-building mechanisms that may drive a participant (hereafter, Dmitry) of the cybercriminal underground ecosystem to migrate from one forum or platform to another. What are the market signals that matter to Dmitry's decision of joining a specific community, and what roles and purposes do these communities or platforms play within the broader ecosystem? Ultimately, we build towards our thesis that by studying these mechanisms we could explain, and therefore act upon, Dmitry's choice of joining a criminal community rather than another. To build this argument, we first discuss previous work evaluating differences in trust signals depicted in criminal forums. We then present preliminary results evaluating criminal channels on Telegram using those same lenses. Further, we analyze the different roles these channels play in the criminal ecosystem. We then discuss implications for future research.