Crime as a Service: Inside the Cybercriminal Economy

In the second episode of Masked Actors: BelArabi_بالعربي , Mohammad Gamal and Mansour Alhmoud follow a single attack from start to finish: a phishing message or stolen password, the access that gets sold on to the next buyer, and the ransomware that follows.

Along the way, they look at how cybercrime has become a marketplace where criminals rent, buy and resell each other’s capabilities, and where an advert selling access to a company’s network can be the only early warning that organization ever gets.

They examine KillSec, a ransomware group Group-IB has tracked since 2024, and Operation KillSwitch, the law enforcement action that took it down. They also cover Operation Ramz, the INTERPOL coordinated effort against phishing and fraud across the region, supported by Group-IB.

Who is buying and selling access to your organization, and what can the market itself tell us about the attacks still to come? And what changes when fraud, phishing and intrusion are treated as one story rather than separate tickets for separate teams?