The cybercriminal underground is a highly specialized economy. Cyberattacks require a diverse set of steps and skills. It is untenable for a single attacker, or even a larger criminal organization, to possess all the skills and resources necessary to carry out a full attack at any scale.
Many underground actors specialize in executing a particular stage of an attack. For example, some threat actors sell stolen goods like credentials and compromised data, and others develop malware and hacking tools. The underground economy also includes experts that provide services like spam, social engineering, selling
compromised accounts, and laundering stolen funds. In this way, anyone with bitcoin and an appetite for a crime can log in to the underground forums and markets and purchase tools and services needed to string together a sophisticated cyberattack.