By: Dan McNemar
Editor’s Note: Binary Defense does not condone, nor does it offer, the services described in this post. We protect businesses against many of the actions taken by the criminals offering these services.
It is not a new concept that criminals use the Darknet to buy and sell products and information. Everyone has seen the news articles about the criminal underground markets for drugs, guns, stolen credit cards, passwords to social media, and stolen passwords for other accounts like Netflix, to name a few. But, are you aware of another service that can be purchased on the Darknet? Hackers for Hire, which means customized hacking against any company or individual specified by the person paying for the service. The websites advertising Hackers for Hire are not necessarily hard to find, either. While working on a Darknet review to find newly-created sites on the Darknet, I was able to pull up ten different Hacker for Hire pages without much effort.
Who would need or use this service, and how easy it is to find a service like this? A likely buyer would be anyone who does not have the technical ability to perform the types of attacks listed below, or someone who is angry at a person or a company and is willing to pay someone to attack them. If they know where to look, these services can be quite easy to find.
What is the Darknet?
The Darknet is a part of the Internet that requires a unique tool to reach. The Darknet is filled with webpages, just like the Clearnet, or surface-level Internet. One of the significant differences between the Darknet and the Clearnet is the type of pages you can find. Although the Darknet is used for many legitimate purposes such as making news and information available freely to citizens living under repressive regimes, most of the sites on the Darknet host content that is illegal. Most of the users of the Darknet are there because they want to browse, talk, post, and buy/sell anonymously.
Types of Hacker for Hire services
One of the services offered by hackers for hire is social media hacking, with several different options for a customer to choose. Probably the most popular is stealing the social media account’s password. Another option is to have the hacker take over the account. When a hacker takes over the account, they will post things that the customer has asked them to post. They can also send private messages to the people on the target’s friends list, in an attempt to ruin relationships and send content that can make the person be seen in a bad light. The Hacker for Hire pages do not go into detail on how they break into the accounts or how they retrieve the passwords. More than likely, they are doing this by using credential harvesters, phishing emails, or trying leaked passwords that might have been exposed in a third-party data breach.
Social media hacking is becoming more popular every day. For example, Giannis Antetokounmpo of the Milwaukee Bucks had his social media compromised, and the hacker started posting racial comments and derogatory remarks about other players. Jack Dorsey, the CEO and co-founder of Twitter, had his Twitter account compromised, and the hacker posted racial and other derogatory comments.
Email hacking works similarly to social media hacking as far as what the criminals offer as the service. Hacker for Hire groups say that they can provide passwords as well as send out information from that email address. Some hacking groups attempt to disguise their intent by claiming that they offer the service for people who forgot their email password.
Another service that is offered on the Darknet is training for someone to learn how to hack for themselves. This includes a wide variety of classes ranging from defacements to credential harvesting. Typically, they will provide step-by-step instructions or videos for a customer to follow along with. Most will also give an email address that the customer can reach out and ask for help if they are struggling with a particular part.
Website defacements are a service offered by many Hacker for Hire groups—you give them a website, and they will replace the home page with a message that the customer has provided to the hacker.
School hacking offers “customers” the ability to have grades changed, their class schedule changed or provide a teacher’s email password. They offer these services to both K-12 and college levels.
If someone wants some content removed from the Internet, they can hire a hacker to take down the link. Things that the Hackers for Hire specifically call out are mugshot removal, blog links, and Google link removal.
Destroying a company’s reputation is another service offered on the Darknet. The Hacker for Hire groups have multiple ways of doing this: they can start a negative ad campaign, leave bad reviews, deface websites, take down sites, and much more.
Distributed Denial of Service (DDoS) attacks are common, and probably one of the oldest Hacker for Hire service. The prices vary depending on the size of the target and how long the customer wants to take it down.
Hacking Groups
Some of the most prevalent Hacker for Hire groups include:
1 – Hack Group
2 – Rent-A-Hacker
3 – Hacker Group
4 – Black Hat Journal
5 – Hacker for Hire
6 – Stroller
7 – Hackse
8 – Xhacker
9 – Digital Hackers
Don’t get scammed by the scammers
After reading about the “services” offered by Hacker for Hire groups, you may be tempted to test your security by paying one of these groups to see if they can successfully break in. Bottom line: don’t do it.
Just like any other service purchased from the Darknet, purchasing services from a Hacker for Hire group has a much higher chance of being a scam. Don’t forget that whoever is buying these services is giving hackers the information to contact them, and that information can be manipulated. When it comes to the Hacker for Hire specifically, the customer doesn’t know what they are paying for. Some of these hackers have the technical ability and can perform the tasks that they are advertising. However, some are completely fake and are just posting services to steal people’s money. None of them are likely to operate ethically or constrain themselves to doing just the tasks they were hired for, nor is there any guarantee that they won’t take any information they steal and re-sell it to others if they can make a profit.
Finally, there is a real risk of criminal prosecution just as a result of sending money to these groups, especially if they cause significant damage to others as a result of carrying out your orders. Many legitimate and trustworthy security firms, such as TrustedSec, offer penetration testing services to look for gaps in your company’s security in responsible ways that do not expose you or your company to harm.