Following Donald Trump’s quick recovery from Covid-19 last month, advertisements appeared on the dark web — the seamy underbelly of the internet — selling what they claimed was Regeneron Pharmaceuticals Inc.’s drug that the president touted as a ‘miracle’ cure – even though it hadn’t yet been approved for public sale.
In May, with coronavirus cases surging around the world and no end in sight, a supposed Spanish laboratory doctor promised Covid-19 infected blood and sputum. It wasn’t clear if it was offered because it might contain protective antibodies or as a way to infect an unwitting enemy. Either way the price for the treatment was $100 for two syringes.
And back in April, when intensive care units worldwide were flooded with Covid-19 patients gasping for air, a seller on the dark web promised ventilators “in bulk supply.” Buyers bought at least 300, according to the seller, identified only as JhonCliff.
Just as the pandemic has upended the buying and selling of goods like toilet paper, airplane seats and Vermont real estate, it has roiled the mostly illegal markets that thrive on the dark web. There, the profiteering and panic buying of a global health crisis is on chilling display.
As deaths have passed 1.2 million globally, hundreds of thousands of ads touting Covid-19 scams have come and gone in dark web markets, which during more normal times are venues for the sale of drugs, guns, pornography and a variety of stolen property, including digital identities.
While accessing the dark web doesn’t involve complex gadgetry or knowledge, it’s not a place where most users find themselves. Many of the transactions there are illegal, and the use of aliases is the norm. For the last few months, Bloomberg News has been exploring these underground sites and channels to investigate the extent Covid-19 has reshaped the dark web’s illicit markets and created new opportunities for its denizens.
In the first months of the pandemic, vendors mostly specialized in hard-to-find Covid commodities, including medical equipment and test kits. By late summer, stolen digital identities were being sold specifically with the purpose of defrauding government programs meant to help small businesses and the unemployed. More recently, dark web profiteers have offered so-called vaccines for those unwilling to wait for final government approvals.
In all, almost $100 million worth of Covid-related goods have been listed for sale on the dark web, according to a forthcoming report by the CTI League, a coalition of cybersecurity researchers investigating the intersection of Covid-19 and the internet. In a survey of 25 of the largest dark web marketplaces, the CTI league found that 10% included Covid-related branding.
It’s virtually impossible to know how lucrative this market has been for sellers. But the United Nations Office on Drugs and Crimes predicted in June that narcotics peddlers would pivot to Covid-themed products, suggesting that enough desperate buyers exist for sellers to make money.
“Covid has been like one big Black Friday sale for the dark web,” said the CTI League’s Sean O’Connor. “It’s a marketing tool on the dark web that’s resulted in a net positive for dark web vendors.”
In April, the U.N. pointed to the trafficking of Covid commodities and financial fraud as an early indicator of what’s to come. As scientists and disease control experts emerge from the diagnosis and testing phase and move into the treatment and prevention phases, so too will scammers, according to the international organization.
Some already have. One recent “vaccine” ad claimed to come from a lab technician with access to treatment that’s been tested but which the ad said wouldn’t be public for years.
“The whole world is panicking about a virus that was made by humans,” reads the ad, selling vials of what it claimed was a successful Covid vaccine for $25,000. “I got access to the lab that is mass producing the vaccine for this disease. It has tested on Israeli patients and it works.”
Another peddles a conspiracy theory about how private labs are hoarding vaccines to drive up their price. But for a lucky few, the seller “snuck vials out of the lab that have been confirmed by Israel’s Minister for Science and Technology.” The vials are on sale for five bitcoin, or about $77,000, hawked by its seller with an apocalyptic claim. This is the “only option to stave off death,” the ad claims. Bloomberg News reached out to this and other sellers of Covid-related products, but none returned messages seeking comment.
Of course, the problem with buying a vaccine on the dark web is there are no guarantees that it’s the real stuff. Not surprisingly, there’s a history of dark web merchants ripping off their customers. For instance, when masks were in short supply early in the disease’s trajectory, scammers in Thailand dug them out of trash cans, repackaged them and sold them as new, according to local media reports.
“Online vendors on darknet markets have adjusted to the Covid-19 pandemic by adding various products and services to their illicit inventories,” said David Maimon, director of Georgia State University’s Evidence-Based Cybersecurity Research Group. “We currently see a relatively low volume of ads advertising Covid-19 commodities, yet a sharp increase in the volume of ads advertising for Covid-related financial scams.”
The Covid gold rush has opened new uses for the vast caches of hacked material available on the dark web: criminals are using it to rip off government programs intended to help people struggling during the pandemic, according to security officials. A popular target is the Pandemic Unemployment Assistance program, which has rushed $260 billion to millions of Americans facing difficulty paying their bills. The Labor Department’s Inspector General estimates the program could lose $26 billion to fraud and waste by the time the program runs dry.
The scams work in a couple different ways but essentially boil down to fraudsters gaining access on the dark web to an individual or company’s personally identifiable information – name, social security, tax ID, date of birth and address – then using the information to fill out an application for Covid-related benefits.
Run the scam often enough and returns can add up to tens of millions of dollars, said Byung J. Pak, U.S. Attorney for the Northern District of Georgia, a region that he says has been a hotbed for both medical products and financial crimes related to the pandemic. The department presently has 40 open investigations related to coronavirus crimes, most of which focus on dark net schemes aimed at stealing money from government welfare programs, Pak said.
In mid-October, the most popular scams included PUA programs in Michigan, Georgia and Arizona, according to dedicated channels on the chat app Telegram dubbed, ‘Unemployment Benefits,’ ‘Darkside Forum,’ and ‘SBA Grants & Unemployment.’ The guides are also directing users to avoid states like Kansas, Nevada and West Virginia because they had stopped paying. Washington, Massachusetts, Illinois and Ohio “can get you tracked and in trouble,” according to one guide distributed for free on the dark web.The reason for all the guidance on the dark web is simple, according to one dark web seller who goes by the name Christopher Gentry. “The PUA pays,” he said.
© Copyright 2023 Bloomberg News. All rights reserved.