10 Cybercrime, Botnets & Forensics

Modern attacks are a business. Understanding the economics (who profits, and how) tells you where the defences have to go.

It’s tempting to picture the attacker as a lone figure in a hoodie, breaking in for the challenge of it. That picture is decades out of date. The early viruses were about mischief and notoriety, but the threat that matters today is organised, professional, and about money. Cybercrime has grown into an economy, with suppliers, specialists, marketplaces, and its own currencies. Once you see it as an economy, the defences make more sense. You stop asking “who would do this?” and start asking “who profits from this, and how do I make it unprofitable?” This chapter is about the business behind the attacks, and about how investigators follow the money and the evidence back to its source.

10.1 What this chapter covers

By the end you should be able to:

Explain what a botnet is, and how one is built and monetised.
Describe the cybercrime economy: the division of labour behind modern attacks.
Explain, at a high level, how a real botnet works (credential-stealing and IoT examples).
Connect forensic traces to the attribution of an attack, and explain chain of custody.

10.2 Cybercrime is a business

The single most useful shift in thinking is to treat serious cybercrime as commerce. Attackers have costs, revenues, competitors, and customers. They reinvest profits, offer support, build reputations, and specialise. Specialisation is more efficient, just as in any legitimate economy. The rise of cryptocurrency gave this economy a way to move value that is hard to trace. The result is a mature underground market where almost any capability can be bought.

Seeing crime as business reframes defence. You don’t have to make an attack impossible. You only have to make it unprofitable. Raise the attacker’s cost, lower their expected return, and much of the volume moves to an easier target. A great deal of security is about not being the cheapest victim on the market.

10.3 The division of labour

The defining feature of the modern cybercrime economy is that no single criminal does the whole job. The work is split among specialists, each selling to the next. Malware developers write and sell the tools, often as polished kits with updates and customer support. Initial access brokers specialise in breaking in, then sell the foothold, access to an already-compromised company, to whoever wants to use it. Infrastructure providers rent out “bulletproof” hosting and the command servers that run attacks. Ransomware-as-a-service operators lease their ransomware to affiliates, who run the attacks and hand back a cut. Money mules and launderers turn stolen funds into clean, spendable cash.

This specialisation has three consequences, and they explain why cybercrime is so stubborn. It lowers the barrier to entry: you no longer need to be a skilled hacker to launch an attack, you can rent the capability. It makes the ecosystem resilient: arrest one malware author and the access brokers, hosts, and launderers all carry on, and a competitor fills the gap. And it muddies attribution: with so many hands touching an attack, working out who is responsible is hard. That resilience-through-specialisation is the second question at the end, and it’s the reason takedowns rarely end a threat for long.

10.4 Botnets: crime at scale

A botnet is the workhorse of this economy: a network of many compromised machines (the “bots”) all under the remote control of one operator through a command-and-control (C2) channel. The operator infects machines by whatever means works (a trojan, a worm, an exploit), and each new victim joins the fleet, waiting for orders.

The power, and the answer to the first question at the end, is that a botnet’s value is aggregate. A single compromised home PC is nearly worthless to a criminal. A million of them, acting together on command, are a weapon and a revenue stream: they can blast a target off the internet with a distributed denial-of-service (DDoS) attack (rented out by the hour), send spam and phishing at vast scale, mine cryptocurrency on someone else’s electricity bill, harvest credentials and card numbers, or serve as a haystack of proxies to hide the operator’s location. This is why individuals underestimate the cost of being infected. Your machine may hold nothing worth stealing, but your machine plus a million others is the product being sold.

10.5 How they work: two patterns

Two well-known cases show the pattern without needing any perishable statistics.

The Zeus family was a banking trojan built to steal credentials. It infected huge numbers of ordinary PCs, watched for banking logins, and siphoned them off. When its source code leaked, it spawned a generation of variants. Successful malware becomes a platform that others build on.

Mirai showed a newer front. Instead of PCs, it infected Internet-of-Things (IoT) devices (home routers, security cameras, DVRs) by trying a short list of default passwords the owners had never changed. From those humble devices it assembled a botnet powerful enough to launch some of the largest DDoS attacks ever seen. The lesson is that cheap, insecure, unattended devices with default credentials are now part of your threat model. The humblest gadget on a network can become a weapon.

10.6 Following the trail: forensics and attribution

When an attack succeeds, the work shifts to investigation: digital forensics, the discipline of reconstructing what happened from the traces left behind. And attackers leave more traces than they’d like. System and network logs record activity. File timestamps reveal a sequence of events. Email headers record the path a message travelled, betraying an origin the sender tried to hide. Document metadata stores the author, the software, and the times a file was created and edited. From fragments like these an investigator builds a timeline: a defensible account of who did what, and when.

Two ideas make forensics a discipline rather than a rummage. The first is chain of custody: evidence must be collected and handled so that its integrity is beyond question: who touched it, when, and how, in an unbroken record. Mishandle it and you can know who did it and still lose the case, because you can no longer prove the evidence wasn’t altered. (This is the hard lesson the game module makes you feel.) The second is that attribution is difficult. The same division of labour and the same botnets that power attacks also hide the people behind them: traffic routed through a botnet appears to come from innocent victims, infrastructure is rented and disposable, and false clues are sometimes planted deliberately. Careful defenders talk about attribution in terms of confidence, not certainty.

Still, attackers are human and make mistakes. The thread an investigator pulls first is usually the one the attacker forgot to hide: a log they didn’t clear, a username or server reused across jobs, a document’s metadata, an email header. Which trace that is, and why it’s the first thread to pull, is the last question at the end.

Play it

Incident Zero’s Forensics module has you chase attribution and rebuild a timeline while protecting the chain of custody. Mishandle the evidence trail and you lose the case, even when you know who did it. → incidentzero.retroverse.studio

10.7 Where this connects

This chapter connects to several others. Software security & malware supplies the weapons this economy trades in: the trojans, worms, and ransomware from that chapter. Network security matters because a botnet’s command-and-control and DDoS traffic are what network monitoring exists to spot. Forensics, the investigation stage in this chapter, follows on from the containment and recovery in incident and disaster planning.

10.8 Questions to consider

Why is a botnet so much more valuable to a criminal than a single compromised machine?
Modern cybercrime has a “division of labour”: different people write malware, sell access, rent servers, and cash out. Why does that specialisation make attacks so hard to stop?
What kind of trace does a careless attacker most often forget to hide, and why is that the thread an investigator pulls first?