Unofficial dark web job market attracting laid-off workers, teenagers, and top professionals with average age of 24

Kaspersky Digital Footprint Intelligence has released a new report, “Inside the Dark Web Job Market: Their Talent, Our Threat.”

In Q1 2024, there were twice as many resumes and job ads posted on “underground” forums as in Q1 2023, and that level remained the same in Q1 2025.

Overall, resumes outnumber job ads by 55% to 45% in 2025, driven by global layoffs and an influx of younger candidates.

Programmers and “money launderers” most wanted

The age distribution shows that the median age of candidates is just 24, with a notable number of teenagers.

Jobs found on the dark web are mostly related to cybercrime or other illegal activities, although legitimate positions can occasionally be found.

According to Kaspersky’s findings, it is a thriving “shadow” economy where 69% of candidates do not specify a preferred field of work, openly indicating that they would accept any paid offer - from programming to running scams or participating in high-risk cyber operations.

The most sought-after IT roles advertised by employers on the dark web reflect a “mature” criminal ecosystem:

• programmers (17% of ads) - create attack tools;

• penetration testers (12%) - examine networks for vulnerabilities;

• money launderers (11%) - “clean” illegally obtained funds through layered transactions;

• carders (6%) - steal and monetize payment data;

• traffickers (5%) - direct victims to phishing sites or infected downloads.

Fraud percentage in addition to salary

Gender-specific patterns were also observed. Female candidates were more likely to apply for interpersonal positions, such as customer support, call center roles, and technical assistance.

Male candidates were more likely to target technical and financial crime positions - programmers, money mules or coordinators of mule networks.

Salary expectations vary significantly by specialization. Reverse engineers have the highest expected compensation, averaging over USD 5,000 per month, followed by penetration testers at USD 4,000 and programmers at around USD 2,000 per month.

Fraudsters generally receive a percentage of the team’s total revenue: money launderers on average 20%, carders around 30%, and traffickers as much as 50% of revenue.

These figures reflect the premium that the criminal ecosystem pays for rare and high-impact skills.

– The shadow labor market is no longer a marginal phenomenon; it absorbs the unemployed, minors and overqualified professionals. Many come thinking that the dark web and the legal market are not significantly different - that proven skills are rewarded instead of degrees, with “advantages” such as offers within 48 hours and no HR interviews. However, few realize that working on the dark web can lead to imprisonment – comments Alexandra Fedosimova, Kaspersky Digital Footprint Intelligence analyst.

Short-term earnings and dangerous consequences

Young people considering employment on the dark web must understand that short-term earnings carry irreversible legal and reputational consequences.

Parents, educators and the community are advised to report any suspicious online offers immediately.

Children should be shown that there are many ways to build skills and careers in legitimate technology sectors, including cybersecurity.

Check out Kaspersky’s special project “What should we with kids who hack?” on how teenagers can be rehabilitated and taught to use their skills for good.

The full report will be available on dfi.kaspersky.com on November 20.

Kaspersky recommends the following protection measures

For individuals:

• Do not follow links that lead to suspicious websites. Never respond to unsolicited offers for “easy money,” especially via Telegram or lesser-known forums. Check the legitimacy of the business through official channels.

• If you are a minor - report suspicious posts to your parents or the relevant authorities. No high salary is worth a criminal record.

For organizations:

• Train employees to recognize phishing and suspicious links.

• Implement dark web monitoring to monitor compromised employee credentials and former employee resumes. Train HR to recognize “shadow experience” in candidate work histories. Implement multi-layered fraud detection mechanisms - mules and carders are often the starting points for more sophisticated attacks.

• Continuous monitoring of dark web sources significantly improves the coverage of potential threat sources and allows organizations to track threat actors’ plans and trends. This type of monitoring is part of the Kaspersky Digital Footprint Intelligence service.

• Use multiple sources of Threat Intelligence information (covering surface, deep and dark web resources) to stay informed about the current TTP methods used by threat actors.

About Kaspersky Digital Footprint Intelligence

Kaspersky Digital Footprint Intelligence is a comprehensive digital risk protection service that helps users monitor their digital assets and detect threats originating from the surface, deep and dark web environments.

With real-time alerts, Kaspersky Digital Footprint Intelligence enables organizations to respond quickly and effectively to potential risks.

Analytical reports complement the data with ready-made intelligence analyses from our experts, providing insight into cybersecurity risks and recommendations for mitigating them.

Kaspersky

Kaspersky

Kaspersky Digital Footprint Intelligence

Alexandra Fedosimova

cyber crime

dark web

hackers

internet fraud

money laundering

data theft

information protection