An estimated $100 million worth of corona-virus related goods and services offered for sale
After Donald Trump’s rapid recovery from the corona-virus last month, Advertisements appeared on the dark web that offered for sale Regeneron Pharmaceuticals Inc.’s medication the president touted as a ‘miracle’ cure – even though it had not yet been approved for public sale.
In May, with coronavirus cases surging across the world and no end in sight, a supposed Spanish lab physician asserted corona-virus infected blood and sputum. It was not clear if it had been offered because it may contain protective antibodies or as a means to infect an unwitting enemy. Either way, the cost for the treatment was $100 for two syringes.
And back in April, when intensive care units worldwide were flooded with corona-virus patients gasping for air, a vendor on the dark web promised ventilators “in bulk supply.” Buyers purchased at least 300, according to the seller, identified only as JhonCliff.
As the pandemic has upended the buying and selling of products like toilet paper, plane seats and Vermont property, it has roiled the largely illegal markets that thrive on the dark web. There, the profiteering and panic buying of a worldwide health crisis is on frightening display.
As deaths have passed 1.2 million internationally, hundreds of thousands of advertisements touting corona-virus scams have come and gone in dark web markets, which during more normal times are places for the sale of drugs, firearms, pornography and an assortment of stolen property, such as digital identities.
While obtaining the dark web does not involve complicated gadgetry or knowledge, it is not a place where many users find themselves. Lots of the trades there are prohibited, and the use of aliases is the standard. For the last couple of months, Bloomberg News has been researching these underground sites and stations to research the scope coronavirus has reshaped the dark web’s illegal markets and created new opportunities for its residents.
In the initial weeks of the pandemic, sellers mostly specialized in hard-to-find corona-virus commodities, including medical equipment and test kits. By late summer, stolen electronic identities were being marketed specifically with the objective of defrauding government programs intended to help small businesses and the unemployed. More recently, dark web profiteers have provided so-called vaccines for those unwilling to wait for final government approvals.
In all, nearly $100 million worth of corona-virus related products are listed for sale on the dark web, according to a forthcoming report from the CTI League, a coalition of cybersecurity researchers exploring the intersection of coronavirus and the net. In a survey of 25 of the biggest dark web marketplaces, the CTI league discovered that 10% comprised coronavirus related branding.
It’s practically impossible to understand how lucrative this market has been for vendors. However, the United Nations Office on Drugs and Crimes predicted in June that narcotics peddlers would pivot to corona-virus themed goods, suggesting that sufficient desperate buyers exist for vendors to earn money.
“corona-virus was like one big Black Friday sale for the dark web,” stated the CTI League’s Sean O’Connor. “It is a marketing tool on the dark web that’s led to a net positive for dark web sellers.”
In April, the U.N. pointed to the trafficking of corona-virus commodities and financial fraud as an early indicator of what is to come. As scientists and disease management specialists emerge from the identification and testing stage and move into the prevention and treatment periods, so too will scammers, according to the worldwide organization.
Some already have. One recent “vaccine” ad claimed to come from a laboratory technician using a treatment that has been tested but that the advertisement said would not be public for ages.
“The planet is panicking about a virus which was created by people,” reads the advertisement, selling vials of what it claimed was a prosperous corona-virus vaccine for $25,000. “I got access to the laboratory that’s mass producing the vaccine for this disease. It’s analyzed on Israeli patients and it works.”
Another peddles a conspiracy theory about how personal labs are hoarding vaccines to drive up their cost. But for a lucky few, the vendor “snuck vials from the lab which were supported by Israel’s Minister for Science and Technology.” The vials are available for five bitcoins, or about $77,000, hawked by its vendor with an apocalyptic claim. This is the “only option to stave off death,” the advertisement claims.
Bloomberg News reached out to this and other vendors of corona-virus associated products, but none returned messages seeking comment.
Needless to say, the problem with purchasing a vaccine on the dark web is there are no guarantees that it is the actual stuff. Unsurprisingly, there is a history of dark web merchants ripping off their clients. For example, when masks were in short supply early in the disease’s trajectory, scammers in Thailand dug them from garbage cans, repackaged them and sold them as new, according to local press reports.
“Online vendors on darknet markets have adjusted to the coronavirus pandemic by incorporating a variety of services and products to their illegal inventories,” said David Maimon, director of Georgia State University’s Evidence-Based Cybersecurity Research Group. “We now see a relatively low quantity of advertisements advertising corona-virus commodities, yet a sharp rise in the quantity of ads advertisements for corona-virus related financial scams.”
According to security officials, the corona-virus gold rush has opened new applications for the huge caches of hacked material available on the dark web: offenders are using it to tear off government programs meant to help people fighting throughout the pandemic. A favorite target is the Pandemic Unemployment Assistance program, which has hurried $260 billion to millions of Americans facing difficulty paying their bills. The Labor Department’s Inspector General quotes the program could lose $26 billion to fraud and waste by the time the program runs dry.
The scams operate in a few different ways but basically boil down to fraudsters gaining entry on the dark web to an individual or business’s personally identifiable information – name, social security, tax ID, date of birth and address – then using the data to complete an application for coronavirus related advantages.
Run the scam frequently enough, and yields can add up to tens of millions of dollars,” stated Byung J. Pak, U.S. Attorney for the Northern District of Georgia, a region he says has been a hotbed for both health care products and financial crimes associated with the pandemic. The department currently has 40 open investigations associated with corona-virus crimes, the majority of which concentrate on dark web schemes aimed at stealing cash from government welfare programs, Pak said.
In mid-October, the most popular scams contained PUA programs in Michigan, Georgia and Arizona, based on dedicated channels on the chat program Telegram dubbed, ‘Unemployment Benefits,’ ‘Darkside Forum,’ and ‘SBA Grants & Unemployment.’ The manuals also direct users to prevent states like Kansas, Nevada and West Virginia since they’d stopped paying. Washington, Massachusetts, Illinois and Ohio “can get you monitored and in trouble,” according to a guide distributed at no cost on the dark web.
According to a dark web seller who goes by the name Christopher Gentry, the reason for all of the advice on the dark web is easy. “The PUA pays,” he said.