An army of IT professionals constantly working in the dark Internet. Their job is to create malicious pages, phishing, hacking into corporate infrastructure, web applications and mobile applications. In the top of the list of the most demanded IT specialties in their field cybercrimeaccording to a study by digital security company Kaspersky, these are developers, attackers and web designers.

His Digital Footprint Intelligence team Kaspersky studied 200,000 job postings posted on 155 darknet forums from January 2020 to June 2022, further analyzing those that contained information about long-term or full-time jobs. Salaries offered to IT professionals ranged from $1,300 to $4,000 per month. The highest salary of $4,000 was offered to reverse engineers. 40% of the ads were placed in 2020, with the peak of publications being in March 2020, possibly due to the financial hardship that some of the population faced due to the pandemic.

Salary up to $20,000

The highest monthly salary found by Kaspersky Lab experts in ads was $20,000 for a developer position. The minimum fee offered was only $200. Some job postings on the dark web included bonuses and commissions for successful projects, such as receiving a ransom from a compromised organization.

Developers are also the most in-demand jobs on the dark web. 61% of all ads were aimed directly at developers. Among them, the category of web developers with experience in creating a number of online products, such as phishing pages, was the most in demand (accounting for 60% of developers’ advertising). Demand for malware encoders has also been high. This specialty may include the development of Trojans, ransomware, stealers, backdoors, botnets, and other types of malware, as well as the creation and modification of attack tools.

Attackers, or IT professionals who carry out attacks on networks, web applications and mobile devices, were the second most popular category of workers wanted by cybercriminals, accounting for 16% of all ads. The closest legitimate example of this position is the role of a penetration tester. Most of the messages on the dark web were related to activities that could compromise corporate infrastructure. The purpose of these actions is to infect with ransomware, steal data or steal cash directly from accounts. Some of the hacking skills in high demand include accessing compromised systems and hacking web and mobile apps that cybercriminal employers sell to other cybercriminals.