In the Market for a Botnet? An In-Depth Analysis of Botnet-Related Listings on Darkweb Marketplaces

The Darkweb is highly popular and widely used for several types of cybercrime. Darkweb marketplaces in particular, are meeting places that provide anonymity, illegal product and service variety, and ease of use. Botmasters can utilize these platforms to acquire the necessary components needed to set up and maintain a botnet infrastructure, but also provide their services to clients. Since botnets can also be viewed from a business perspective, these components can be characterized as elements of a business model, each associated with a different botnet set of activities. In this paper, we crawl 26 marketplace and with focus on botnet-related listings form a dataset of 36,314 listings, along with 1,163 vendors. We present our aggregated findings in regard to marketplace characteristics, listings, and vendors. Additionally, we utilize the botnet Value Chain Model to correlate the targeted listings to specific model segments. With this approach we gain insight on how the business model relates to the botnet market in real time, and what significance this holds from a botmaster’s point of view. Our results suggest that botmasters have a wide variety of options on all of the activities related to the botnet setup, maintenance, and revenue generation, all available within the marketplaces, at quite low prices. Lastly, we utilize the usernames and PGP keys of the vendors, in an effort to detect their potential cross-platform activity throughout the 26 platforms.