The German cybercriminal underground is well-developed and -managed by cybercriminals even though it remains a small community in number compared with the Russian1 and Brazilian2 underground markets. It may also be the most developed underground within the European Union (EU) despite the existence of a French underground market.
The Spanish underground, however, merged with the Latin American market. In the German underground, we find a mixed bag of cybercriminal products and services that include crimeware, credentials, fake items, and drugs. Interestingly, it has a similar structure to the Deep Web3; it seems to offer as much as possible to stay up. This could be due to some limitations like language barrier and the market’s overall size. The German underground is indeed a newcomer that offers everything cybercriminals need to start in the cybercrime business. It specifically caters to a regional market, as its offerings (Packstation services; hacked accounts for dropping; German, Austrian, and Swiss credit card and financial account credentials; and malware developed by German coders) would most appeal to German speakers.
