Where Do Malware Creators Come From? The Nexus Between Crime Rings, Rogue Governments and More

Over the last ten years in particular, there has been a staggering increase in malware infections to the tune of 87%. On average, malware attacks cost businesses in the United States approximately $2 million per incident, once things like reputational damage and recovery costs are accounted for.

At the same time, all of this does pose the question: where are these attacks coming from? Is the mental image of a stereotypical hacker, sitting in his parent’s basement somewhere surrounded by snacks, actually based on reality? Or is there something far more sinister taking place? Something that brings together the efforts of various crime rings, rogue governments and more?

As you’ve probably guessed, more often than not, it’s actually the latter.

The Origins of Malware

Malware has been around in some form or another since the earliest computer viruses were detected in the 1970s. One of the most famous examples of this is the Creeper Worm: a program that copied itself on remote systems, then would display an irritating message. It was written by a man named Bob Thomas who worked for the company BBN Technologies.

Obviously, the origin of a particular malware strain or attack depends on exactly which one you’re talking about. One of the larger attacks to take place in recent years was called Netwalker. It made its debut in 2019 and was the product of a cybercrime group called Circus Spider. Another example of a malware group making its presence known is REvil. They’re known for targeting not only their competitors with ransomware attacks, but also participants in online hacking forums.

Not all these attacks, however, come from private sources. It has long been speculated that significant amounts of activity are coming either from groups working directly with rogue nation states, or from those malicious governments themselves. In the past, China, Russia and even Iran have been heavily suspected of being behind many of the larger attacks over the last few years.

Thankfully, there are a variety of techniques that can be used to identify the author of certain types of malware. Believe it or not, in many situations, their name and/or location may be exposed by such a small mistake that the experts at Technology.org call them “laughable.” It could be as simple as keeping personal files on a server where the malware is being deployed from.

Malware Around the World: What We Know and What We Don’t

The experts at Kaspersky – the Russian cybersecurity and anti-virus provider – tend to agree that while malware creators can come from anywhere, they’re particularly prominent in countries where laws pertaining to cybercrime are not enforced or may not even exist. This, plus the fact that these regions tend to have many job opportunities for people with a malware skill set, creates a perfect storm in the worst conceivable way. It is also part of the reason much of the malware being released onto the internet these days is designed to make money illegally. Those with malicious intentions have literally created a “day job” for themselves.

Generating an income in this kind of direct way isn’t the only reason why malware creators have become so aggressive. Some create malware as a simple prank, or to participate in some type of political activism or cause. Others are attempting to steal confidential information from a business, potentially for the purposes of reselling it later. Some just want to cause as much damage as possible.

The Stuxnet Worm malware from 2010 is an example of a strain with larger and more politically motivated intentions. Not long after it was released, security experts believed that the Stuxnet Worm was created with the specific purpose of attacking Iran’s nuclear program. Not only could it impact software, but it was targeting hardware as well.

Regardless, statistics like those outlined above point to an issue worldwide that shows an unfortunate trend that shows no signs of slowing down anytime soon. Another recent study indicated that malware, and the cyber-attacks they enable, is the fastest growing crime in the United States. The same may be true of the rest of the world. Increasingly, malware strains find their way online every year. The COVID-19 pandemic has only accelerated this by affording more opportunities for its creators to exploit weak and insecure devices.

Having said all that, perhaps if we can better understand the motives behind these malware creators, we can take better and more meaningful steps to stop them – which is certainly something that would benefit everyone.