{"id":44238,"date":"2021-12-02T23:15:00","date_gmt":"2021-12-02T23:15:00","guid":{"rendered":"https:\/\/www.darkreading.com\/attacks-breaches\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes"},"modified":"2021-12-02T23:15:00","modified_gmt":"2021-12-02T23:15:00","slug":"ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/","title":{"rendered":"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/beta.darkreading.com\/images\/og-image.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>Group-IB, one of&nbsp;the global cybersecurity leaders, has presented its research into global cyberthreats in&nbsp;the report&nbsp;<a href=\"https:\/\/www.group-ib.com\/resources\/threat-research\/2021-reports.html?utm_source=press_release&amp;utm_campaign=htct-reports-2021-en&amp;utm_medium=organic&amp;utm_content=global\">Hi-Tech Crime Trends 2021\/2022<\/a>&nbsp;at its annual threat hunting and intelligence conference,<a href=\"https:\/\/cybercrimecon.com\/?utm_source=press_release&amp;utm_campaign=htct_apac&amp;utm_medium=organic\">&nbsp;CyberCrimeCon<\/a>\u201921. In&nbsp;the report, which explores cybercrime developments in&nbsp;H2 2020\u2014H1 2021, Group-IB researchers analyze the increasing complexity of&nbsp;the global threat landscape and highlight the ever-growing role of&nbsp;alliances between threat actors. The trend manifests itself in&nbsp;partnerships between ransomware operators and initial access brokers under the Ransomware-as-a-Service model. Scammers also band together in&nbsp;clans to&nbsp;automate and streamline fraudulent operations. Conversely, individual cybercrimes such as&nbsp;carding are in&nbsp;decline for the first time in&nbsp;a&nbsp;while.<\/p>\n<p>For the 10th&nbsp;consecutive year, the Hi-Tech Crime Trends report analyzes the various aspects of&nbsp;the cybercriminal industry\u2019s operations, examines attacks, and provides forecasts for the threat landscape for various sectors. For the first time, the report was divided into five major volumes, all with a&nbsp;different focus: ransomware, the sale of&nbsp;access to&nbsp;corporate networks, cyberwarfare, threats to&nbsp;the financial sector, and phishing and scams. The forecasts and recommendations outlined in&nbsp;Hi-Tech Crime Trends 2020-2021 seek to&nbsp;prevent damage and downtime for companies worldwide.<\/p>\n<p><b><strong>Initial Access Brokers: US&nbsp;Companies Among the Most Frequent Targets<\/strong><\/b><\/p>\n<p>One of&nbsp;the underlying trends on&nbsp;the cybercrime arena is&nbsp;a&nbsp;sharp increase in&nbsp;the number of&nbsp;offers to&nbsp;sell access to&nbsp;compromised corporate networks. Pioneered by&nbsp;the infamous hacker&nbsp;<a href=\"https:\/\/www.group-ib.com\/media\/fxmsp\/\">Fxmsp<\/a>, who was charged by&nbsp;the US&nbsp;Department of&nbsp;Justice in&nbsp;2020, the market of&nbsp;corporate initial access grew by&nbsp;almost&nbsp;16% in&nbsp;H2 2020\u2014H1 2021, from $6,189,388 to&nbsp;$7,165,387. The number of&nbsp;offers to&nbsp;sell access to&nbsp;companies almost tripled over the review period: from 362 to&nbsp;1,099. This exclusive data was obtained by&nbsp;Group-IB\u2019s Threat Intelligence &amp;&nbsp;Attribution system, which gathers even deleted information from cybercriminal underground forums.<\/p>\n<p>This segment of&nbsp;the cybercriminal underground has a&nbsp;relatively low entry barrier. Poor corporate cyber risk management combined with the fact that tools for conducting attacks against corporate networks are widely available both contributed to&nbsp;a&nbsp;record-breaking rise in&nbsp;the number of&nbsp;initial access brokers. In&nbsp;H2 2019\u2014H12020, the Group-IB Threat Intelligence team detected only 86&nbsp;active brokers. In&nbsp;H2 2020\u2014H1 2021, however, this number skyrocketed to&nbsp;262, with 229 new players joining the roster.<\/p>\n<p>Most companies affected belonged to&nbsp;the manufacturing (9%&nbsp;of&nbsp;all companies), education (9%), financial services (9%), healthcare (7%), and commerce (7%). In&nbsp;the review period, the number of&nbsp;industries exploited by&nbsp;initial access brokers surged from 20&nbsp;to&nbsp;35, which indicates that cybercriminals are becoming aware of&nbsp;the variety of&nbsp;potential victims.<\/p>\n<p>The geography of&nbsp;initial access brokers\u2019 operations has also expanded. In&nbsp;H2 2020\u2014H1 2021, the number of&nbsp;countries where cybercriminals broke into corporate networks increased from 42&nbsp;to&nbsp;68. US-based companies are the most popular among sellers of&nbsp;access to&nbsp;compromised networks&nbsp;\u2014 they account for&nbsp;30% of&nbsp;all victim-companies in&nbsp;H2 2020\u2014H1 2021, followed by&nbsp;France (5%), and the&nbsp;UK (4%).<\/p>\n<p>One of&nbsp;the main driving forces for initial access market growth is&nbsp;the steep increase in&nbsp;the number of&nbsp;ransomware attacks. Initial access brokers remove the need for ransomware operators to&nbsp;break into corporate networks on&nbsp;their own.<\/p>\n<p><b><strong>Lock, Lock Who\u2019s There? Corporansom<\/strong><\/b><\/p>\n<p>The unholy alliance of&nbsp;initial access brokers and ransomware operators as&nbsp;part of&nbsp;Ransomware-as-as-a-Service (RaaS) affiliate programs has led to&nbsp;the rise of&nbsp;the ransomware empire. In&nbsp;total, data relating to&nbsp;2,371 companies were released on&nbsp;DLSs (Data Leak Sites) over H2 2020\u2014H1 2021. This is&nbsp;an&nbsp;increase of&nbsp;an&nbsp;unprecedented 935% compared to&nbsp;the previous review period, when data relating to&nbsp;229 victims was made public.<\/p>\n<p>Thanks to&nbsp;the Threat Intelligence &amp;&nbsp;Attribution system, Group-IB researchers were able to&nbsp;trace how the ransomware empire has evolved since it&nbsp;appeared. Group-IB\u2019s team analyzed private Ransomware affiliate programs, DLSs where they post exfiltrated data belonging to&nbsp;victims who refused to&nbsp;pay the ransom, and the most aggressive ransomware strains.<\/p>\n<p>Over the review period, Group-IB analysts identified 21&nbsp;new Ransomware-as-a-Service (RaaS) affiliate programs, which is&nbsp;a&nbsp;19% increase compared to&nbsp;the previous period. During the review period, the cybercriminals mastered the use of&nbsp;DLSs, which are used as&nbsp;an&nbsp;additional source of&nbsp;pressure on&nbsp;their victims to&nbsp;make them pay the ransom by&nbsp;threatening to&nbsp;leak their data. In&nbsp;practice, however, victims can still find their data on&nbsp;the DLS even if&nbsp;the ransom is&nbsp;paid. The number of&nbsp;new DLSs more than doubled during the review period and reached&nbsp;28, compared to&nbsp;13&nbsp;in&nbsp;H2 2019\u2014H1 2020.<\/p>\n<p>It&nbsp;is&nbsp;noteworthy that in&nbsp;the first three quarters of&nbsp;2021, ransomware operators released&nbsp;47% more data on&nbsp;attacked companies than in&nbsp;the whole of&nbsp;2020. Taking into account that cybercriminals release data relating to&nbsp;only about&nbsp;10% of&nbsp;their victims, the actual number of&nbsp;ransomware attack victims is&nbsp;likely to&nbsp;be&nbsp;dozens more. The share of&nbsp;companies that pay the ransom is&nbsp;estimated at&nbsp;30%.<\/p>\n<p>Having analyzed ransomware DLSs in&nbsp;2021, Group-IB analysts concluded that Conti was the most aggressive ransomware group: it&nbsp;disclosed information about 361 victims (16.5% of&nbsp;all victim-companies whose data was released on&nbsp;DLSs), followed by&nbsp;Lockbit (251), Avaddon (164), REvil (155), and Pysa (118). Last year\u2019s top 5&nbsp;was as&nbsp;follows: Maze (259), Egregor (204), Conti (173), REvil (141), and Pysa (123).<\/p>\n<p>Country-wise, most companies whose data was posted on&nbsp;DLSs by&nbsp;ransomware operators in&nbsp;2021 were based in&nbsp;the United States (968), Canada (110), and France (103), while most organizations affected belonged to&nbsp;the manufacturing (9.6%), real estate (9.5%), and transportation industries (8.2%).<\/p>\n<p><b><strong>Carding: The Joker\u2019s Last Laugh<\/strong><\/b><\/p>\n<p>Over the review period, the carding market dropped by&nbsp;26%, from $1.9 billion to&nbsp;$1.4 billion compared to&nbsp;the previous period. The decrease can be&nbsp;explained by&nbsp;the lower number of&nbsp;dumps (data stored on&nbsp;the magnetic stripe on&nbsp;bank cards) offered for sale: the number of&nbsp;offers shrank by&nbsp;17%, from 70&nbsp;million records to&nbsp;58&nbsp;million, due to&nbsp;the infamous card shop Joker\u2019s Stash shutting down. Meanwhile, the average price of&nbsp;a&nbsp;bank card dump fell from $21.88 to&nbsp;$13.84, while the maximum price surged from $500 to&nbsp;$750.<\/p>\n<p>An&nbsp;opposite trend was recorded on&nbsp;the market for the sale of&nbsp;bank card text data (bank card numbers, expiration dates, names of&nbsp;owners, addresses, CVVs): their number soared by&nbsp;36%, from 28&nbsp;million records to&nbsp;38&nbsp;million, which amongst others can be&nbsp;explained by&nbsp;the higher number of&nbsp;phishing web resources mimicking famous brands during the pandemic. The average price for text data climbed from $12.78 to&nbsp;$15.2, while the maximum price skyrocketed 7-fold: from $150 to&nbsp;an&nbsp;unprecedented $1,000.<\/p>\n<p><b><strong>The Scamdemic<\/strong><\/b><\/p>\n<p>Another cohort of&nbsp;cybercriminals actively forging partnerships over the review period were scammers. In&nbsp;recent years, phishing and scam affiliate programs have become highly popular. The research conducted by&nbsp;Group-IB revealed that there are more than 70&nbsp;phishing and scam affiliate programs. Participants aim to&nbsp;steal money as&nbsp;well as&nbsp;personal and payment data. In&nbsp;the reporting period, the threat actors who took part in&nbsp;such schemes pocketed at&nbsp;least $10 million in&nbsp;total. The average amount stolen by&nbsp;a&nbsp;scam affiliate program member is&nbsp;estimated at&nbsp;$83.<\/p>\n<p>Affiliate programs involve large numbers of&nbsp;participants, have a&nbsp;strict hierarchy, and use complex technical infrastructures to&nbsp;automate fraudulent activities. Phishing and scam affiliate programs actively use Telegram bots that provide participants with ready-to-use scam and phishing pages. This helps scale phishing campaigns and tailor them to&nbsp;banks, popular email services, and other organizations.<\/p>\n<p>Phishing and scam affiliate programs, initially focused on&nbsp;Russia and other CIS countries, recently started their online migration to&nbsp;Europe, America, Asia, and the Middle East. This is&nbsp;exemplified by&nbsp;<a href=\"https:\/\/www.group-ib.com\/media\/classiscam-in-europe\/\">Classiscam<\/a>: an&nbsp;automated scam-as-a-service designed tosteal money and payment data. Group-IB is&nbsp;aware of&nbsp;at&nbsp;least 71&nbsp;brands from 36&nbsp;countries impersonated by&nbsp;affiliate program members. Phishing and scam websites created by&nbsp;affiliate program members most often mimic marketplaces (69.5%), delivery services (17.2%), and carpooling services (12.8%).<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/attacks-breaches\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Report explores cybercrime developments from the second half of 2020 through the first half of 2021. Read More <a href=\"https:\/\/www.darkreading.com\/attacks-breaches\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-44238","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-02T23:15:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/beta.darkreading.com\/images\/og-image.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes\",\"datePublished\":\"2021-12-02T23:15:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/\"},\"wordCount\":1476,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/beta.darkreading.com\\\/images\\\/og-image.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/\",\"name\":\"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/beta.darkreading.com\\\/images\\\/og-image.jpg\",\"datePublished\":\"2021-12-02T23:15:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/#primaryimage\",\"url\":\"https:\\\/\\\/beta.darkreading.com\\\/images\\\/og-image.jpg\",\"contentUrl\":\"https:\\\/\\\/beta.darkreading.com\\\/images\\\/og-image.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-12-02T23:15:00+00:00","og_image":[{"url":"https:\/\/beta.darkreading.com\/images\/og-image.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes","datePublished":"2021-12-02T23:15:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/"},"wordCount":1476,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/#primaryimage"},"thumbnailUrl":"https:\/\/beta.darkreading.com\/images\/og-image.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/","url":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/","name":"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/#primaryimage"},"thumbnailUrl":"https:\/\/beta.darkreading.com\/images\/og-image.jpg","datePublished":"2021-12-02T23:15:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/#primaryimage","url":"https:\/\/beta.darkreading.com\/images\/og-image.jpg","contentUrl":"https:\/\/beta.darkreading.com\/images\/og-image.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-carding-and-initial-access-brokers-group-ib-presents-report-on-trending-crimes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Ransomware, Carding, and Initial Access Brokers: Group-IB Presents Report on Trending Crimes"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=44238"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44238\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=44238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=44238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=44238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}