As of August 2026, the market for unauthorized access to information systems of Russian companies is demonstrating a paradoxical dynamic: the overall volume of offers continues to grow, but the rate of this growth has slowed significantly. If the market expanded by 150% in the previous year, this figure has dropped to 20% in the current year. Experts attribute this change to market saturation and increased competition among suppliers of "digital keys."
The Economics of Cybercrime: Why Prices Are Falling
In conditions of high competition on the shadow market, sellers are forced to keep prices low to ensure the sale of their services. According to data from the Bi.Zone Threat Intelligence analytical center, the median cost for a typical access to a corporate network ranges from $500 to $600. Most often, this refers to the compromise of external remote access services. The cost of a specific lot varies depending on the relevance of the data, the type of connection, the level of access rights, and the completeness of the technical description. Simple monetization pushes cybercriminals to buy ready-made entry points, as this is significantly easier and faster than independently penetrating protected perimeters.
Sectoral Preferences: Industry and Finance
An analysis of demand structure shows that the systems of industrial enterprises are of the greatest interest to malicious actors. The high cost of such lots is explained by the value of information regarding new technologies, production processes, and developments, making the industrial sector a priority target for industrial espionage. Significant demand is also observed for systems of companies in the retail and financial sectors. IT companies account for about 10% of all listings, while service and construction organizations make up 8% of the market.
The Role of Artificial Intelligence in Lowering the Barrier to Entry
One of the key reasons for the growth in the number of offers on the black market, experts cite the lowering of the barrier to entry for new participants. In 2026, artificial intelligence has become a powerful tool for automating reconnaissance, credential selection, and the exploitation of typical vulnerabilities. This has allowed individuals who previously lacked sufficient technical skills to conduct complex attacks to become involved in cybercriminal activities. However, specialists note that not all sellers on the shadow market fully understand the value and real capabilities of the access they are offering, so the growth in the number of listings does not always correlate with an increase in truly dangerous incidents.
Contradictory Data
There is a certain discrepancy in the assessment of the quality of offers on the market. On the one hand, companies like F6 record thousands of offers to sell access annually, noting a growth in market volume. On the other hand, experts point out that many of these offers may be "empty shells" or outdated data, as new market participants using AI may incorrectly assess the value of captured data. This creates a situation where quantitative market growth (20%) does not guarantee a proportional growth in the qualitative threat to business.
Sales Dynamics and "Premium" Access
The speed of selling lots on the shadow market varies depending on their value. On average, an offer finds a buyer within one to two weeks. If access is in high demand, it can be booked within one to three days and become the subject of a private deal. Expensive offers or specialized access, such as credentials with administrator rights or access to critical business systems, may wait for a buyer for one or two months. The cost of such "premium" positions is significantly higher and is estimated at a sum from $2000 to $5000. Most often, such offers are published by intermediaries, not by those who directly performed the hack.
