How Malicious Software Serves as a Weapon in Larger Criminal Operations

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 12.11 Free with a free account

How Malicious Software Serves as a Weapon in Larger Criminal Operations

Ethics in Technology · Chapter 12: Cyber Harassment, Cybercrime, and How Digital Criminals OperateSection 12.11 · lesson 77 of 11613 min · free with a free account

← The Many Ways Criminals Use Computers as Instruments to Commit OffensesNext lesson: The Modern Cyber Threat Landscape →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Software, access, and financial services can connect separate criminal specialists.

  • Explain botnets and the rental of compromised computing capacity.
  • Distinguish ransomware operators, affiliates, crimeware kits, and access brokers.
  • Describe the underground economy as a network of specialized roles.
  • Explain laundering stages, money mules, and why financial evidence matters.

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,487 words). Read along, or search it.

Cyber Harassment, Cybercrime, and How Digital Criminals Operate

Malware in Criminal Operations

Malicious software can be one tool inside a larger criminal operation. The broader objective may be stealing information, extorting victims, or collecting usable money. We will examine botnets as coordinated networks of compromised devices. Their capacity can be rented to other criminals. Next, we will distinguish ransomware operators from their affiliates. We will explain crimeware kits, malware-as-a-service, and the sale of unauthorized access. These capabilities connect specialists who need not perform every job themselves. We will then discuss the underground economy and its market features. Finally, we will examine money laundering and supporting financial roles. Placement, layering, and integration describe attempts to disguise criminal proceeds. Following the money can connect participants, while technical evidence and practical defenses remain essential.

The Business View

Malicious Software Can Serve a Larger Criminal Objective

The business view asks what the malware helps someone achieve. In many criminal operations, the aim is financial gain. One specialist may develop software, while another packages it as a service. A third may obtain victim access, and another may conduct the final offense. Financial facilitators can then help disguise or move the proceeds. Updates, support, subscriptions, and reputation can resemble ordinary software businesses. The comparison explains organization; it does not give the activity legitimacy. Victims still face unauthorized access, data theft, service disruption, or extortion. Specialization can reduce the work each participant must perform. However, profit is not the only malware motive; espionage, disruption, and political objectives also occur. Not every incident uses a service marketplace, and one person may perform several roles.

Botnets

Compromised Devices Can Become a Coordinated Resource

A botnet is a network of devices compromised and controlled by an attacker. Each compromised device may be called a bot or zombie. The controlling operator is often called a botmaster. Command-and-control, abbreviated C two, is the communication system that directs those devices. Possible devices include computers, phones, servers, cameras, and routers. An owner may not realize that a device is participating. A device can appear functional while supporting unauthorized activity in the background. Size and available capabilities vary between botnets. Control does not always depend on one central server. Some networks use decentralized, peer-to-peer communication, and devices are not always available at the same moment. The defining feature is coordinated unauthorized control, rather than a guaranteed number or identical device behavior.

Botnet Services

The Same Compromised Capacity Can Support Different Offenses

Botnet capacity can support several different offenses. Distributed denial of service uses traffic from multiple devices to overwhelm a target. Disruption may serve extortionists or others seeking to make a service unavailable. Spam and scam distribution sends unwanted or deceptive messages. Unauthorized mining consumes device resources to generate cryptocurrency for someone else. Information theft collects credentials, payment details, or files. Those assets may be useful to fraudsters, data resellers, or access brokers. Compromised capacity can also deliver additional malware. The operator may rent access to customers instead of selling the entire network. Repeated rental can connect one pool of capacity with several criminal operations. Not every botnet performs every listed task, and neither disruption nor further infection is guaranteed.

Ransomware as a Service

Operators and Affiliates Divide Tools, Attacks, and Proceeds

Ransomware denies access, commonly by encrypting files, while a criminal demands payment. Ransomware-as-a-service divides capabilities and victim attacks between different participants. Operators develop or maintain tools and supporting infrastructure. Their responsibilities may include negotiation, payment, or data-leak services. Affiliates are separate criminals who use supplied capabilities against victims. They may conduct the intrusion and deployment, then share the proceeds. The diagram shows a conceptual relationship rather than one universal payment arrangement. Responsibilities and revenue shares differ between groups. Double extortion combines data theft with denial of access. Victims face pressure to stop publication as well as restore operations. Protected backups can aid recovery, but they cannot retrieve copies that attackers already stole.

Service Features

Commercial Features Can Expand Criminal Reach

Criminal services can imitate several features of legitimate software businesses. Maintenance and updates let affiliates obtain tools without writing every component. Support, documentation, and simpler interfaces can reduce some technical barriers. Pricing may involve fees, subscriptions, a share of proceeds, or combinations. There is no universal percentage applying to every operator. Recognized names and forum discussion can help services attract customers. Reviews or ratings remain untrustworthy claims within an illegal market. A familiar brand in a ransom demand may identify a supplied capability rather than the intruder. The developer, affiliate, and recipient of proceeds may be different people in different jurisdictions. This division complicates attribution and cooperation between investigators. Affiliates still need victim access and operational ability; ready-made software does not guarantee a successful offense.

Crimeware and Access

Capabilities and Victim Access Become Separate Products

A crimeware kit packages capabilities for criminal activity. Some tools are sold once, while others are rented with supporting services. Malware-as-a-service is the broader model of supplying malicious software capabilities. Exploit kits package exploitation capabilities intended to deliver malware through vulnerable software. Phishing kits supply fake page components, message templates, and collection tools. Information-stealer services support collecting credentials, cookies, or payment information. Loaders or droppers introduce additional malware after an initial compromise. Access for sale supplies unauthorized entry into an already compromised organization. An access broker specializes in selling that entry to another criminal. The broker need not conduct the final theft or ransomware incident. Even initial access can become a separate input, illustrating how specialization lowers the work a buyer must perform.

Underground Economy

Specialists Trade Inputs, Services, and Stolen Assets

The underground economy connects criminals trading stolen assets, tools, and services. Forums, encrypted chats, and marketplaces can serve as meeting places. Stolen payment details and account logins are inputs for fraud or unauthorized access. Compromised network access can be sold to someone planning a later offense. Malware kits and subscriptions supply capabilities, updates, or support. Botnet rental provides computing or communication capacity. Financial facilitators may offer help moving or disguising criminal proceeds. Authors, service sellers, brokers, attackers, and launderers can overlap rather than form one mandatory sequence. Advertising, reviews, and intermediaries do not guarantee honest transactions. Supply, demand, asset quality, and defensive changes can influence prices, without one universal pricing rule. Removing a participant can disrupt relationships, although other specialists may replace the missing capability.

Money Laundering

Three Stages Describe the Attempt to Disguise Criminal Proceeds

Money laundering processes criminal proceeds to disguise their illegal origin. The purpose is making funds appear legitimate and reducing connections to the underlying offense. A classic framework describes placement, layering, and integration. Placement introduces criminal proceeds into the financial system. Layering uses transactions or conversions intended to distance funds from their illegal source. Integration presents the proceeds as apparently lawful assets, spending, or business income. In a ransomware example, investigators examine receipt, subsequent movements, and later use of the proceeds. These labels organize questions about the evidence rather than prescribe one mandatory transaction path. Digitally stolen funds may already be inside financial systems. Stages can overlap or differ, so receiving a cryptocurrency ransom is not automatically a separate placement stage in every case. The apparent legitimacy changes; laundering does not make the money’s underlying criminal origin lawful.

Supporting Financial Roles

Mules and Mixers Can Obscure Links Without Erasing Evidence

A money mule receives or moves criminal proceeds for someone else. An account or another transfer method may be used. Some mules participate knowingly, while others are deceived through fake jobs or personal relationships. Requests to move strangers’ money call for independent verification. A mixing service or software aims to obscure links between cryptocurrency transactions. Different mechanisms operate differently, and criminals can misuse them. No mixing capability guarantees an untraceable trail. Many cryptocurrencies retain transaction records on public ledgers. Investigators may combine those records with account, infrastructure, and other evidence. Legal obligations and culpability depend on the actual service, awareness, conduct, and jurisdiction. Privacy software, cryptocurrency, and ordinary transfers are not automatically money laundering simply because of their labels.

Investigate and Defend

Follow the Money and Protect Critical Services

Following the money can reveal connections between otherwise separate criminal specialists. Transaction and account records may identify proceeds, intermediaries, or assets. Lawful international cooperation supports obtaining evidence across jurisdictions. Financial investigation complements technical analysis rather than replacing it. Consider a hospital unable to access patient records after a ransomware incident. The group supplying the software may differ from the affiliate who entered the network. That division complicates attribution, but practical defenses do not depend on learning every criminal’s name first. Strong authentication and prompt patching reduce opportunities for initial unauthorized access. Segmentation and incident response help limit spread, preserve evidence, and support recovery. Tested, protected backups can restore critical data, while stolen copies remain a confidentiality issue. Removing one participant can disrupt an operation, but replacement services may emerge and full recovery is not guaranteed.

Review and Apply

Connect the Tool, the Specialist, and the Financial Evidence

Explain a botnet’s rental model by linking compromised capacity with different criminal customers. Spam distribution and service disruption are two possible uses. Distinguish ransomware operators supplying capabilities from affiliates conducting victim attacks. Responsibilities, payment arrangements, and proceeds shares vary by group. An access broker illustrates specialization because unauthorized entry itself becomes a product. Name the three laundering stages: placement, layering, and integration. They describe introducing proceeds, obscuring their source, and presenting them as legitimate. Digital cases may overlap those stages rather than follow one fixed path. Financial records can connect people and assets, while technical evidence supports a fuller investigation. Software, access, infrastructure, participants, and proceeds each offer points for investigation and defense. Specialized services can expand criminal reach without guaranteeing anonymity, success, or immunity from disruption.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About How Malicious Software Serves as a Weapon in Larger Criminal Operations

What is a botnet, and how do criminals use it?
A botnet is a network of compromised devices, called bots or zombies, controlled by an attacker known as a botmaster through a command-and-control (C2) system. Computers, phones, servers, cameras, and routers can all be recruited, often without their owners noticing. Operators use or rent the capacity for distributed denial-of-service attacks, spam and scam distribution, unauthorized cryptocurrency mining, credential theft, and delivering further malware. Some botnets use peer-to-peer control instead of one central server.
How does ransomware-as-a-service work?
Ransomware-as-a-service splits the crime between operators and affiliates. Operators develop and maintain the ransomware and infrastructure and may handle negotiation, payment, or data-leak sites. Affiliates break into victims, deploy the tools, and share the proceeds, with revenue splits varying by group. Many campaigns use double extortion, stealing data before encrypting it so victims face both lost access and threatened publication. Backups help restore systems but cannot recover copies the attackers already took.
What is an initial access broker?
An initial access broker is a criminal who sells unauthorized entry into already compromised organizations to other criminals, such as ransomware affiliates. The broker need not carry out the final theft or extortion. Brokers are part of a wider crime-as-a-service market that also sells phishing kits, exploit kits, information stealers, and loaders that install more malware. This specialization lowers the skill each buyer needs, though a ready-made tool never guarantees a successful attack.
What are the three stages of money laundering?
The three classic stages are placement, layering, and integration. Placement introduces criminal proceeds into the financial system, layering moves or converts them to distance them from their source, and integration presents them as apparently legitimate assets or income. Digital crimes often blur these stages, since stolen funds may already be inside financial systems. Money mules, knowing or deceived, help move funds, and mixing services try to hide cryptocurrency trails, though public ledgers often allow tracing.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →