How IT jobs and recruiting on the dark web might trick you

A
new
Kaspersky
report
sheds
light
on
why
some
tech
pros
look
for
jobs
on
the
dark
web
and
how
to
spot
suspicious
and
likely
illegal
positions
from
recruiters
in
that
environment.

IT
professionals
are
actively
recruited
on
the
dark
web
with
job
ads
that
are
often
similar
to
legitimate
ones
from
regular
recruitment
websites.
According
to

Kaspersky’s
new
research,
this
tech
job
recruiting
environment
is
only
an
illusion
—
legal
jobs
are
rare
on
the
dark
web.

Jump
to:

Why
are
some
IT
pros
looking
for
jobs
on
the
dark
web?

The
number
of
ads
offered
on
the
dark
web
as
collected
by
Kaspersky
on
155
different
dark
web
forums
from
January
2020
to
June
2022
is
close
to
200,000,
with
peaks
during
the
COVID-19
pandemic
in
2020.

Some
reasons
that
might
prompt
someone
to
look
for
a
new
job
on
cybercriminals
forums,
even
when
considering
the
risks
of
being
caught
by
law
enforcement,
are:

• Getting
  laid
  off.
• Pay
  cuts.
• Lack
  of
  education
  requirements.
• A
  military
  service
  record.
• A
  criminal
  record
  that
  might
  prevent
  them
  from
  working
  in
  a
  particular
  area
  of
  expertise.

Sadly,
some
people
are
also
unaware
of
the
consequences
of
such
illegal
jobs
and
do
not
think
they
might
be
prosecuted.

How
recruiting
on
the
dark
web
usually
works

Employers
on
the
dark
web
market
rely
on
test
assignments
to
recruit
skilled
people.
Some
ads
are
more
specific
about
the
tests
and
allow
checking
the
required
level
(Figure
A);
people
are
often
paid
to
take
these
tests.

Figure
A

Employers
also
do
interviews,
and
a
few
job
offers
mention
a
probationary
period.
One
unusual
requirement
is
that
only
people
without
addictions
will
be
selected.

To
attract
profiles,
dark
web
recruiters
mention
advantages
such
as
remote
working,
full-time
employment
or
flexible
schedules.
Yet
people
could
fall
prey
to
cybercriminal
organizations
such
as

FIN7,
whose
managers
do
not
hesitate
to
threaten
their
employees
who
did
not
appear
at
work
enough
or
thought
of
leaving
the
criminal
organization.

Most
recruited
tech
job
roles
on
the
dark
web

Developers
are
in
the
most
demand
in
this
environment,
followed
by
attack
specialists
(Figure
B).

Figure
B

Threat
actors
are
especially
looking
for
these
tech
professionals:

• Malware
  developers,
  since
  most
  attacks
  use
  malware
  to
  compromise
  companies
  or
  exfiltrate
  data
  for
  example.
• Penetration
  testers
  who
  help
  malware
  developers
  by
  debugging
  malware
  and
  helping
  improve
  anti-security
  measures.
• Attack
  specialists
  who
  are
  able
  to
  perform
  the
  initial
  intrusion
  on
  the
  target
  and
  extend
  it
  inside
  the
  network.
• Reverse
  engineers
  for
  reversing
  tools,
  creating
  derived
  ones
  or
  analyzing
  code
  that
  needs
  to
  be
  targeted.
• IT
  administrators
  to
  configure
  and
  maintain
  the
  group’s
  IT
  infrastructure
  and
  make
  sure
  it
  is
  anonymized
  and
  running.
• Designers
  who
  create
  fake
  websites
  and
  phishing
  emails.
• Analysts
  who
  gather
  information
  on
  the
  targeted
  companies
  and
  provide
  useful
  information
  to
  help
  launch
  the
  attack.

Median
salaries
for
these
jobs
on
the
dark
web

The
salaries
for
these
jobs
vary
depending
on
the
invested
effort
and
the
experience.
Salaries
are
often
paid
via
cryptocurrency.
While
the
salary
range
varies
from
$200
to
$20,000
per
month,
median
salaries
show
that
it
is
rare
to
find
such
high
pay
(Figure
C).
Kaspersky’s
research
reveals
that
contrary
to
popular
belief,
cybercriminals’
jobs
are
not
paid
significantly
more
than
legitimate
jobs.

Figure
C

How
to
spot
a
suspicious
job
offer
from
the
dark
web

Some
jobs
ads
on
the
dark
web
do
look
similar
to
legitimate
postings,
so
users
should
always
be
careful
if
they
decide
to
follow
up
on
a
posting.
When
you’re
talking
to
the
recruiter,
it
will
likely
be
obvious
that
something
is
wrong
with
the
offer.
Here
are
red
flags
to
watch
with
such
job
offers.

• A
  real
  employer
  provides
  a
  full
  identity
  that
  can
  be
  verified.
• A
  real
  employer
  offers
  a
  real
  contract
  and
  generally
  does
  not
  pay
  in
  cryptocurrency.
• A
  real
  employer
  can
  provide
  legal
  documents
  to
  prove
  the
  existence
  of
  a
  company,
  depending
  on
  the
  country
  where
  the
  company
  is
  built,
  which
  seems
  hard
  to
  provide
  for
  a
  cybercriminal
  threat
  actor.

Read
next:

Mobile
device
security
policy
(TechRepublic
Premium)