A recent Sophos X-Ops investigation reveals that cybercriminals are increasingly investing their illegal profits in real-world businesses — including coffee shops, construction firms, real estate, education, and even cybersecurity startups.
The research analyzed thousands of discussions on Russian- and English-language cybercrime forums, exposing how criminals launder cryptocurrency and reinvest funds through apparently legitimate ventures.
Key findings:
- Criminals often convert crypto assets into tangible investments such as gold, diamonds, or shell companies.
- Forum users exchange guides on money-laundering and investment strategies.
- Some are launching or funding cybersecurity companies, blurring the line between attackers and defenders.
- The trend indicates a move from "quick profit" cybercrime toward sustainable criminal entrepreneurship.
Money laundering through legitimate enterprises complicates law enforcement tracking, and insider risks grow when cybercriminals gain stakes in security-related businesses. The situation highlights the need for enhanced vendor vetting, KYC procedures, and financial due diligence to detect hidden criminal influence.
"It's concerning when people with criminal motives invest in businesses meant to protect others from cybercrime." — John Shier, Sophos Field CISO