Hacker Persona: From Gamer to Cybercriminal, A Natural Evolution Spurred by COVID Lockdowns

Concealing myself behind multiple identities, I have been hunting cyber threats on underground platforms for several years, monitoring and interacting with hackers and attackers focusing on online applications. I started monitoring these threat actors since I was a Junior CTI (Cyber Threat Intelligence) researcher and since the tracked subjects were still Script Kiddies (skids). During my research, three questions persistently preoccupied my thoughts:

1. Where do they come from?
2. What are they aiming for today?
3. What personality traits and psychological motivations got them here?

In this ‘Hacker Persona’ series, I will take you back to a ‘high school reunion,’ focusing on the gamer persona and answering the question ‘how (some) gamers evolve from nice fellows into cyber criminals?’

Figure 1: How a gamer turned from nice fellow to cyber criminal

This is the first blog in the series, covering the evolution of ambitious gamers turning into threatening application attackers. The findings are based on an observational study across four underground platforms and a sample of 26 attackers who began their ways as gamers and currently maintain reputable application hacking services on the underground.

By the end of this blog, you will have a better understanding of:

1. How gaming can ‘accidentally’ funnel people into hacker marketplaces
2. How COVID lockdowns incubated one of the most significant hacker baby booms to date
3. The entry gate to the dark side: how are gamers are exposed and start to engage in application hacking

The Gaming Industry: from buy-me-if-you-can into Free-to-Play, Paid-to-Stay

It is impossible to understand the next-gen hackers’ mindset without understanding their world. Here is a crash course on gaming and how the gaming industry fell in love with the freemium business model and how this love affair created new opportunities for application hackers. Let us recap the fundamental changes in the gaming world.

If you spent your teenage years playing PC games in the 90s like me, you remember buying games or downloading a crack or license generator through Kaza, Emule, BitTorrent, LimeWire or Gnutella (choose your age). Your journey into accessing new games did not involve engaging underground hackers. Today, however, if your kid is trying to get a cheaper version of their favorite game, they will most likely buy them from an underground marketplace, the same place where breached credentials and personal information are offered for free.

Why does the road to a cracked gaming account change from “playing in the park” to “walking in the wrong neighborhoods?” The gaming industry changed its business model and monetizing schemes for games. Let us break it down.

Architecture: games used to run entirely locally, requiring expensive hardware with price tags that kept many potential PC gamers away. Currently, the gaming industry uses the cloud, hosting high-end GPUs that render and encode graphics and stream the visuals, while high-end cloud CPUs run the simulation and game logic. Such cloud workloads allow gamers high-quality access to gaming experiences without having to invest in expensive hardware. Another key strategic advantage of the cloud architecture is that the game can get updates such as additional content; therefore, the game never ends.

Business model: Slowly but steadily, the gaming industry fell in love with the freemium business model. Instead of pre-paid experiences, users can play for free and purchase in-game virtual goods with micro-transactions. Some games leverage a pay-to-win model where users can play for free, but to achieve a higher rank, get one of the ‘cool’ skins or a better sword that deals more damage, users need to pay. Payments can be made through micro-transactions, leveraging ‘real’ money to buy in-game currency, or by earning in-game currency through grinding.

In-game Economy: To support this new business model, game publishers created an “in-gaming economy” that incentivizes players to stay engaged in their games. In this model, gamers are paid virtual currency specific to the game for every action performed in the game or every level crossed. This in-game currency allows the purchase of gaming assets such as ranks, skins and weapons. While assets may not hold value in the real world, they are highly desired by young gamers trying to gain status and respect from their friends and the gamer community. Like expensive watches and luxury vehicles are status symbols for wealth in the real world, gaming assets provide social status to gamers.

The combination: Games that implement a successful in-game economy, multiplayer platforms hosted in the cloud, and an active gamer community like Roblox, Star Citizen, Counter Strike, Fortnite, Call of Duty Warzone, PUBG Mobile, etc. can quickly gain billions of gamers combined. Minecraft, the famous 16-year-old game, gathered over 300 million users in total and Roblox reaches over 70 million daily active users worldwide. When the gaming industry saw these numbers, they quickly adopted them.

The Lockdown Baby Boom

Thanks to the core changes in the gaming industry, it was the only industry that was well-prepared for a pandemic. By the time the global pandemic sent teenagers all over the world into lengthy quarantines with half-functioning educational frameworks, the gaming industry provided virtual hang-out spaces and became the social equivalents of the shopping malls in the 80s.

PC games turned into endless shopping malls where you do not have to pay at the entrance because they spend while they are in and are encouraged to stay. Modern online games allow people to co-operate or compete with other people, without physical or geographic boundaries. Gamers do not have a ‘pause’ option without getting killed in the game or being summoned by their friends and community. Therefore, there is no ending. If you are a parent to a gamer, you probably understand this very well.

Low barrier of access: the access to gaming moved the threshold from owning 1000-2000$ hardware and 60$ for a game to 0$ for the hardware thanks to Cloud computing and 0$ for the game, a descend mobile phone is all that is required to get access to one of the many gaming titles with large communities.

The onset of COVID-19 coincided with a significant growth in video game usage, with 2.7 billion players in 2020. Gaming and streaming platforms provided a social and safe alternative during lockdowns and social isolations.

From Game Cracks to Account Takeover

What about those gamers that seek to get fast and free status and replace their “noob” avatar with a highly ranked one?

Ten years ago, the goal was to gain access to games illegally while modern gamers’ goal is to access highly ranked accounts with high currency balances. As a result, hackers have shifted their focus from game cracks and key generators to breaching gamer accounts. This created a high demand for stolen gamer accounts on underground marketplaces and criminals rushed to supply this demand.

The figure below shows that almost a third of the “cracked.io,” a notorious marketplace, referrals come from gaming-related websites. Furthermore, “lolz.guru,” a gateway marketplace for breached accounts, sees 89% of their referrals coming from gaming-related websites.

The Gamer-to-Hacker evolution scale

Although less than half of a percent of all gamers start the evolution and an even smaller fraction completes eventually become full-time hackers, it is worth mentioning there are 1.5 billion gamers today and based the latest research papers research papers, it is estimated millions of them have joined since the pandemic. Half a percent represents millions of “new bloods” in hacker marketplaces and several thousands of new tools created.

Who is the “new blood,” and what differentiates them from past generations of application threat actors?

The Gamer Persona

What type of wheat is getting into the hacking marketplace oven?

Gamer To Hacker Timeline

Step 1: Exposure – The Gamer’s first exposure to an underground marketplace.

Incentives: low-cost gaming accounts with a high amount of assets (virtual coins/rank/level)

Figure 4: pre-requisites for exposure to underground marketplaces

Underground marketplaces lure gamers with offers of 1$ for breached gaming accounts. One of the gateway marketplaces is lolz.guru, a Russian-speaking marketplace selling breached Fortnite accounts. Right next to the breached gaming accounts, subscriptions are sold to operate Infostealer malware that runs stealthily for months before being detected. Marketplaces like these identified a constant influx of inexperienced users and, over the years, started adopting some of the traits of the gaming world. Each forum member now has a rank, points, levels, and credits. Members are incentivized for their activity, especially for sharing content.

Higher levels and more points will gain members access to more exclusive content.

As can be seen in Figure 5, threat actors that sell hacking tools create hacking tutorials and share assets such as easy target lists for DDoS (Distributed Denial of Service) to gain marketplace credits and attract buyers for their DDoS tools or services. Some threat actors target new and inexperienced members by selling tools that can be found for free in GitHub (i bought a DDoS attack on the DARK WEB (don’t do this) (youtube.com)).

What to expect in part 2

We have covered the foundations of the evolution from gamers to application hackers and the drivers that initiated this evolution. In the second part of the blog series, I will dive into the five steps of the application hacker’s evolution: from choosing their hacking domains and specialties, through developing their reputation up to creating and managing application attack tools as a service.

Stay ahead, stay tuned.

Figure 7: Fortnite gamer turned threat actor bragging about his botnet-as-a-service

Gaming and Covid Stats Resources:

Research Papers:

Media Reports: