Motivations in dark markets --- I understood Eduardo's comment as distinguishing between the criminal motives of dark markets that are hosting the infrastructure and tools for cyberattacks (such as botnets or malware), and the political motives of those that are renting such tools for particular attacks?

In a way, dark markets that provide ransomware-as-a-service try to stay 'criminals only', and not get into how their clients will use their tools and services. I don't think this can them help much in case of prosecution?

But there are two important elements to discuss here: - To what extent such 'as a service' markets, which allow politically-motivated groups to perform attacks, make the forensics and attribution even more complex - or easier? On one hand, this adds a layer of intermediaries; on the other, the cooperation between dark market renters and their clients is 'trust based', so when law enforcement take down such markets, they might be more willing to provide details related to their clients, to stay clean of political motives of their clients?

• Could greater use of rented tools and services, hosted by criminals, for politically-motivated attacks actually make criminals more cautious whom they are renting their services to and for what reasons? The goal of criminals are to stay in the play for as long as possible, undetected; politically motivated attacks raise attention and put them into risk. Ultimately, this may reduce the reliance of politically motivated attacks on rented services.

Any thoughts?

Source author: Vladimir Radunovic vladar@diplomacy.edu