Guides and toolkits that allow a user to accomplish this task are often available on the underground.

In order for actors operating in mainland China to access these services, they need a VPN or similar measure capable of evading government detection. Where is the Underground?įorums hosted on the Tor network have barriers to entry for most Chinese users as the government blocks Tor on the Chinese internet. This leads to the Chinese cybercrime underground being disorderly when compared to others, particularly Russia, which tend to be much more organized.

While the average citizen must follow the heavy handed nature of the government’s surveillance of cyberspace, Chinese threat actors take special precautions to protect their forums, TTPs and themselves. Efforts like “The Great Firewall” or government crackdowns on content related to cybercrime force actors to put in remarkable effort to maneuver around those roadblocks in order to access, create or participate in criminal marketplaces that mirror those more commonly known to the rest of the world.ĭata from Intel 471 show that the Chinese cybercrime underground proliferates through use of common methods or platforms, but behaves differently in large part due to the caution that actors take with regard to their identity. Yet, that hasn’t stopped its population from engaging in cybercrime.ĭespite the various measures the Chinese government has taken to censor and surveil its residents on the internet, a significant cybercrime underground full of financially motivated actors exists. China’s internet is a lot different than the rest of the world.

Telegram web client