Behind every cybercrime is a supply chain

The underground economy supporting cybercrime has matured significantly in the last few years. The PwC Threat Intelligence team has observed increased stealer log distribution despite law enforcement operations, a shift toward as-a-service phishing affiliate schemes, and a growing reliance on initial access brokers for insider access brokerage, ransomware, and business email compromise (BEC). These trends are directly relevant to organisations across the globe, including Australia, which remains a high-value target. 

Analysis of the deep and dark web is more than isolated screenshots or forum posts. Underground cybercrime operates as a connected supply chain in which stealer logs, phishing kits, credential markets, and initial access brokers function as linked services that enable ransomware, business email compromise, account takeover, and real-world fraud. This ecosystem is further sustained by providers offering malicious generative AI tools such as WormGPT and similar services, alongside deepfake capabilities, cloaking services, aged social media accounts, and malware development.

The presentation begins with a primer on the deep and dark web, covering the criminal services and exposures commonly observed by PwC's Threat Intelligence team. It then explains how stealer logs, phishing kits, underground markets, and initial access brokers each function within the broader attack lifecycle, supported by quantitative observations on stealer log volumes, access pricing trends, and initial access broker targeting patterns, with spotlight on Australian stealer log exposures.

We will also look at a ransomware case conducted by the threat actor White Veles, based on real-world PwC Threat Intelligence observations that trace the full attack chain. Starting with credentials likely harvested by an infostealer and sold on a prominent marketplace, the attack chain continued when White Veles purchased them, used them to gain access to the corporate environment, and ultimately deployed ransomware, causing significant operational disruption. The case study maps each step to observable indicators, showing where defenders have opportunities to detect and disrupt the chain.

We have also observed how the cybercrime ecosystem is increasingly enabling real-world fraud. The underground supply chain does not distinguish between these motivations; they use the same stealer logs, credential markets, and access brokers to serve both cybercrime and real-world fraud. Yet often cybersecurity and fraud are traditionally thought of separate functions with limited intelligence sharing, creating exploitable blind spots. The presentation challenges defenders to reconsider this separation and offers practical recommendations for bridging the gap.

This talk is designed for a broad audience, with enough technical detail to be useful to practitioners, while remaining accessible to executives and business stakeholders. Attendees will leave with a clearer understanding of how the underground cybercriminal ecosystem functions, how key criminal services connect, and how threat intelligence teams can turn this information into actionable intelligence for prioritisation, triage, and strategic decision making. It also provides practical guidance on applying these insights in real-world settings to support improving overall security outcomes.