In this paper we exploit market features proper of a leading Russian cybercrime market for user impersonation at scale to evaluate attacker preferences when purchasing stolen user profiles, and the overall economic activity of the market. We run our data collection over a period of $161$ days and collect data on a sample of $1'193$ sold user profiles out of $11'357$ advertised products in that period and their characteristics. We estimate a market trade volume of up to approximately $700$ profiles per day, corresponding to estimated daily sales of up to $4'000$ USD and an overall market revenue within the observation period between $540k$ and $715k$ USD. We find profile provision to be rather stable over time and mainly focused on European profiles, whereas actual profile acquisition varies significantly depending on other profile characteristics. Attackers' interests focus disproportionally on profiles of certain types, including those originating in North America and featuring $crypto$ resources. We model and evaluate the relative importance of different profile characteristics in the final decision of an attacker to purchase a profile, and discuss implications for defenses and risk evaluation.

翻译：本文利用一个主流俄罗斯身份冒用黑市的市场特性，大规模评估黑客购买已窃取用户档案时的偏好及该市场的整体经济活动。我们进行了为期161天的数据采集，从该时间段内11,357个已发布的商品中收集了1,193份已售用户档案样本及其特征。估计市场日交易量高达约700份档案，对应日销售额最高约4,000美元，观测期内市场总收益介于54万至71.5万美元之间。研究发现档案供应在时间维度上相对稳定且主要集中于欧洲档案，而实际档案收购行为因其他档案特征差异显著。黑客对特定类型档案表现出不成比例的兴趣，包括源自北美且包含加密资源的档案。我们建模并评估了不同档案特征在黑客最终购买决策中的相对重要性，并讨论了对于防御策略和风险评估的启示。