Bestsellers in the Underground Economy

In this talk at the DEF CON 27 Packet Hacking Village, threat intelligence researcher Winnona DeSombre provides a data-driven look into the commercial dynamics and bestseller trends shaping illicit dark web markets. She begins at 04:00 by categorizing commodity malware families, contrasting commodity downloaders, info-stealers, banking trojans, and Remote Access Trojans (RATs) with bespoke nation-state cyber espionage implants, and mapping out the myriad forum aliases used by malware authors.

At 08:00, Winnona presents an empirical methodology for ranking underground software popularity by comparing forum sales threads and customer reviews against telemetry from security operations centers. At 12:00, she illustrates how commodity demand fluctuates seasonally and mirrors geopolitical developments, showing clear spikes in exploit kit acquisitions corresponding to high-profile zero-day disclosures. She explores how commodity malware codebases are continually repurposed and rebranded at 16:00, making them virtually indistinguishable from targeted espionage tools.

Analyzing regional marketplaces at 20:00, Winnona highlights notable cultural and operational divergences between closed Russian-language crime syndicates and English-speaking hacker boards. She wraps up with an audience Q&A session at 24:00, examining buyer reputation systems, escrow mechanisms, and how cyber defenders can utilize illicit market intelligence to proactively hunt threat actor infrastructure. (AI summary — Gemini Flash)