While news of hackers targeting hospitals with ransomware and others with COVID-19 phishing scams continues to make headlines, a new study has found that there is some honor among thieves in the darkest recesses of the internet.

Alex Guirakhoo, strategy and research analyst at Digital Shadows Ltd. has published a report on the reaction of those of the dark web, a shady part of the internet accessible with special software, to the global COVID-19 pandemic and surprisingly found that some cybercriminals are encouraging others to behave.

Atypical discussions found on dark web forums included users discouraging others from profiting off the pandemic, expressing solidarity with countries affected, particularly Italy, and providing health and safety information.

In one example on the Torum dark web hacking forum, a user who posted asking for advice on the best way to take advantage of the coronavirus pandemic only received responses from other users pleading for the person not to profit off the situation.

“As we’ve seen time and time again, cybercriminals will find ways to take advantage of people’s fears and uncertainties in the wake of major disasters and emergencies,” Guirakhoo noted. “However, the gravity of the COVID-19 pandemic has shown some benevolent reasoning has emerged on some platforms that are typically used for crime — users urging others to avoid taking advantage of an already dire situation.”

On other forums including Cracking King and Cracking Soul, forums dedicated to trading and selling stolen accounts, users were found to be sharing off-topic posts about the global situation and warning fellow forum members to take extra care of at-risk and elderly family members.

Overall, Guirakhoo found that searches for COVID-19 and coronavirus across the dark web had surged 738% since Feb. 19 in line with general internet trends as even cybercriminals seek news on the current state of the pandemic.

Although it’s nice to see some hackers with morals particularly given that COVID-19 doesn’t discriminate, at the same time others continue to take advantage of the situation.

A new report today from Check Point Software Technologies Ltd. found that cybercriminals on the dark web are offering special coronavirus-themed sales and discounts on malware and exploit tools. Some of the offers are even using the terms “COVID19” and “coronavirus” as discount codes.

In one example, a promotion dubbed “CoronaVirus Discount! 10% off ALL products” was offering tools such as a “WinDefender bypass” and a “Build to bypass email and chrome security.”

Image: Digital Shadows