Cyber Mercenary Marketplace  Place

The market for Cyber Mercenary Marketplace includes a wide range of services, buyers, sellers, and motives, each of which may overlap with legitimate uses of cyber technologies. Buyers in the cyber mercenary market are often governments seeking to advance their security interests. Since 2011, at least 74 national governments have leveraged cyber mercenaries for the use of spyware alone. Cyber mercenaries may help states disrupt or destroy their adversaries’ infrastructure; censor, harass, or spy on political dissidents; profit from ransomware; or steal classified or proprietary information. Cyber mercenary services may appeal to governments because involving a third party can help conceal responsibility and avoid consequences for illegal and/or destructive behaviors.

Buyers can also be cyber criminals, or private actors hoping to spy on other nonstate actors, such as business rivals or romantic partners. While these buyers may not participate in hostilities, similar products, services, and vendors can be used for both purposes, muddying the boundaries of the cyber mercenary market. Cyber mercenaries employed by nonstate actors can be similarly disruptive to victims’ lives or destructive of civilian infrastructure as those engaged in hostilities between states.

Sellers in the cyber mercenary market—the mercenaries—are often small private firms that develop and sell sophisticated cyber capabilities, such as those featured in Graphic 1. One prominent example is the NSO Group: an Israeli firm that sells spyware technology to governments and has been accused of facilitating numerous human rights abuses, such as the targeting of Jamal Khashoggi and those close to him. Other firms, such as Zerodium, act as middlemen in the cyber mercenary market by buying technology from one firm, or from independent researchers, and reselling it to a separate customer.

Products and Capabilities in the Cyber Mercenary Marketplace

The market for cyber mercenaries includes a broad and evolving range of products, services, capabilities, and operations. The below typology categorizes mercenary activity into five thematic bins, but specific techniques, companies, vulnerability exploits or software may span multiple categories.

-Information warfare

Operations intended to gain an advantage over an opponent by controlling and manipulating information. Cyber mercenary firms may assist with influence operations—online efforts to influence the attitudes, behaviors, or decisions of a target audience—as well as censorship software to restrict what people can view or publish online.

-Commercial spyware

Spyware monitors and extracts sensitive data from devices without the knowledge or consent of users.

-Ransomware

Ransomware blocks access to a computer system until a sum of money is paid.

-Destructive Malware

Mercenaries may leverage cyberattacks to degrade an enemy state’s domestic infrastructure or military capabilities.

-Penetration testing

The same tools used to exploit vulnerabilities in an adversary’s systems can also be used to identify and patch vulnerabilities in friendly networks, adding to the challenge of distinguishing legal and legitimate from illegal and irresponsible cyber capability vendors.