Recently, broader social dynamics, related to gender and nationality, in particular, are shaping the activity of cybercriminal forums. Digital Shadows explored this trend in a new analysis blog, "Unpicking Cybercriminals’ Personalities - Part 1: Gender and Nationality," that looks at how the dynamics of gender and nationality play out in cybercriminal forums and how it’s shaping cybercrime trends as a result. 

In the largely-male dominated world of cybercriminal forums, Digital Shadows’ researchers identified cultures of misogyny that transcend national borders. Researchers observed users commented that even if females are present on cybercriminal forums, they hide their gender and pretend to be male, so they do not attract unwanted attention. Numerous examples of sexism and misogyny include:

• In 2019 a user on the Russian-language cybercriminal forum Exploit initiated a thread in which they posited that all world problems originate from women and that all wars started because of women. If adequately “controlled,” they continued, a woman could be an “angel”, but would be “a messenger from hell” if left to run riot. In the ensuing discussion, although forum members expressed views on both sides of the argument, they posted images such as a woman ready to eat a brain on a plate, with the caption “A woman’s favourite dish.”
• Also in 2019 one Exploit user initiated a thread to wish women a happy March 8 (International Women’s Day, celebrated as a holiday in Russia). A later respondent to the thread specifically called out the fact that two users had replied, “thank you,” saying, “It’s more interesting to me why [they] wrote ‘thank you.’” Another user commented, “Clearly we don’t know anything about them.”
• In July 2020 a user on the Russian-language cybercriminal forum XSS organized a contest with a prize fund of $250 to be awarded to the user who posted in the thread with the best naked picture of a female torso. Thus far, the competition has proven popular, with multiple entries submitted, many of which were sexual or pornographic.

The overwhelmingly male and male-presenting audience on most these of forums reinforce both negative and positive stereotypes of women, even if individual users sometimes push back. It is these cultural norms that likely influenced the launch of DarkMarket, an English-language forum claiming to be the first female-run cybercriminal market. This reveals that even among cybercriminals, ostensibly dedicated to profit alone, are not immune from broader social trends and motivations, and often typify them.

According to Digital Shadows, one of the most common ways in which threat researchers separate and distinguish between cybercriminal forums is to divide them by language or nationality communities. This division may seem counterintuitive in a globally connected world; a cybercriminal in China can just as easily target a victim in New York as a hacker in the southern United States can. Yet cybercriminal forum users congregate in communities with a common language, both because of the ease of communication and the shared values and rules. 

"There is a very prevalent sense of nationality and nationalism on Russian-language cybercriminal forums in particular, say the researchers. "We see frequent arguments about how much these forums should allow the use of English, with many users opining that non-Russian-speaking users should not be catered for and that those without Russian-language skills should be disadvantaged."

In a sense, gender and nationality are two easy personal attributes to conceal, yet providing indications of these two attributed are also two of the most common ways to express individuality on cybercriminal forums, the researchers note. In the second part of the series, Digital Shadows researchers will examine cybercriminal morality and forum dynamics, two "slightly less less straightforward aspects of cybercriminal personalities that may not be as easy to conceal or feign."

For more information, including more details, please visit https://www.digitalshadows.com/blog-and-research/unpicking-cybercriminals-personalities-part-1-gender-and-nationality/