How Chinese Cybercriminals Use Business Playbook to Revamp Underground

This report analyzes the rapid maturation of China’s cybercriminal underground, describing its shift from ad‑hoc QQ-based dealings to structured, service-oriented marketplaces offering DDoS, spam, credential and PII sales, and bespoke hacking services. It outlines distinctive practices such as AliPay/bank-transfer payments and a “master–apprentice” recruitment model, notes the move of operations overseas with crypto-enabled laundering, and underscores the growing difficulty in separating cybercrime from espionage as actors sell business dossiers and insider-enabled access targeting global organizations.