Russia and Ukraine Top Inaugural World Cybercrime Index

Russia, Ukraine and China harbor the greatest cybercriminal threat, according to the first World Cybercrime Index (WCI).

This world-first cybercrime ranking is the result of work by an international team of academic researchers who surveyed 92 leading cybercrime experts and analyzed the results following a scientific methodology.

The research project for the World Cybercrime Index took four years to complete.

The scientific paper backing the Index, titled Mapping the Global Geography of Cybercrime with the World Cybercrime Index, was in the PLOS ONE journal published on April 10, 2024.  

Five Types of Cybercrime

The survey asked the 92 experts to consider five types of financially driven cybercrime, name the countries they consider each of these types of cybercrime to originate from and then rank them according to the impact, professionalism, and technical skill of its cybercriminals.

The five categories of cybercrime are:

1. Technical products/services (e.g. malware coding, botnet access, access to compromised systems, tool production)
2. Attacks and extortion (e.g. DDoS attacks, ransomware)
3. Data/identity theft (e.g. hacking, phishing, account compromises, credit card comprises)
4. Scams (e.g. advance fee fraud, business email compromise, online auction fraud)
5. Cashing out/money laundering (e.g. credit card fraud, money mules, illicit virtual currency platforms)

The researchers attributed a score to every nominated country in each category and then calculated an overall score, called the WCI score, that was used to make the general ranking. A description of the calculations used can be found in the scientific paper.

Top 20 Countries with the Highest Cybercrime Threat Levels

Russia comes as the country where most cybercrime originates, with a WCI score of 58.39, followed by Ukraine (36.44) and China (27.84).

The US (25.01) and Nigeria (21.28) also make the top five. The UK, India, North Korea and Brazil all make the top ten.

WCI Updates and Upgrades Are “Likely”

The World Cybercrime Index was developed as a joint partnership between the University of Oxford and the University of New South Wales in Australia and funded by CRIMGOV, an EU-supported project based at the University of Oxford and Sciences Po Paris.

Jonathan Lusthaus, associate professor at the University of Oxford’s Department of Sociology and Oxford School of Global and Area Studies, is one of the study’s five co-authors.

During a press conference, Lusthaus highlighted the need to unveil where cybercrime originates, which has largely been an invisible phenomenon because offenders often mask their physical locations by hiding behind fake profiles and technical protections.

“If you try to use technical data to map their location, you will also fail, as cybercriminals bounce their attacks around internet infrastructure across the world. The best means we have to draw a picture of where these offenders are actually located is to survey those whose job it is to track these people,” he said.

According to another co-author, Federico Varese, a professor at Sciences Po in Paris, the World Cybercrime Index will likely be updated and upgraded in the future.

He said the researchers are hoping to expand the study in order to determine whether national characteristics like educational attainment, internet penetration, GDP, or levels of corruption are associated with cybercrime.

“Many people think that cybercrime is global and fluid, but this study supports the view that, much like forms of organized crime, it is embedded within particular contexts,” Varese said.

One specific metric the index used, the Technicality score (T-score), characterized how skilled cybercriminals based the top 15 countries those countries are.

“For instance, Russia and Ukraine are highly technical cybercrime hubs, whereas Nigerian cybercriminals are engaged in less technical forms of cybercrime,” read the paper.

“But for countries that lie close to the centre (0), the story is more complex. Some may specialize in cybercrime types with middling technical complexity (e.g., Data/identity theft). Others may specialize in both high- and low-tech crimes,” it continued.