Key Findings

• Due to anonymity, gender plays a smaller role in underground cybercriminal forums, where people are valued more for their skillsets and experience.
• Approximately 30% of cybercriminal forum participants are women.
• Compared to previous years, there are now more women involved in science, technology, engineering and mathematics (STEM) jobs, and this will spill over to the underground as it also follows real-world/offline societal and business changes.
• Gender biases can hinder law enforcement and industry investigations, and security practitioners should not assume that the criminals are always male.
• We cannot conclude that the underground community has become more accepting of different gender profiles. Instead, it would be more accurate to say that gender is not an issue when conducting business in the underground.
• We have not seen any evidence that an actor was disqualified from participating in a job role based on gender.

With the anonymity of cybercrime and the groups behind them, gender plays a much less important role than in other online communities. In many ways, it is one of the most meritocratic communities online, where developers are valued for their skills and experience, and not necessarily for their gender when it comes to conducting business in the underground. In this research paper, we will show that while female cybercriminals are (still) in the minority, they most certainly do exist, and an investigator should be open to this possibility from the start.

It is generally accepted that most cybercriminals are male. Following law enforcement bulletins and media reports, it is more common to hear investigators use the terms “he” or “him” when referring to a cybercriminal that has yet to be attributed. In Trend Micro, research teams have had a long-standing policy of using “them” or “they” to refer to threat actors, long before this became more common in gender discussions. At the minimum, this allows for the hacker handles discovered to be observed or thought of being operated by a group. But looking at this usage from a bigger picture, we found that this practice removes gender bias — an unconscious tendency that we strongly believe can lead an investigator down the wrong path. Gender bias, whether explicit or implicit, can severely undermine a criminal investigation. In many cases, investigating and interviewing a female suspect requires a different mindset.

Gender is one of the important factors in dealing with different kinds of crimes. For women, there is not one dominant path that leads them to commit or be involved in criminal activities. According to an Inquiries Journal article, consistent research findings over the years from criminologists, legal scholars, and sociologists have found that men and women differ in criminal behavior and sentences received, resulting in a “gender gap” in criminality rates and prison populations. The same study also cites that the crimes most often committed by women are non-violent and carry milder sentences. On comparing past and current situations, we observed that the cybercriminal underground economy was less accepting of those who identified as women then, based on discussions in forums. Over the last few years, however, gender has been discussed less when it comes to business.

Different theories exist regarding the general lack of women's involvement in cybercrime, including the lower numbers of women engaging with online forum communities and the gap in internet access. According to a study conducted by the World Wide Web Foundation in 2020, women are less likely to create online content, comment, or post about political events when they get online, and 29% are more likely to sell or advertise a product. Another theory is the product of having low numbers of women practicing in cybersecurity as part of the workforce as cybercrime offenses are usually technical in nature. Technical offenses require a particular skillset or knowledge about computer systems. Cybersecurity Ventures predicts women will represent 30% of the global cybersecurity workforce by 2025, and up to 35% by 2031. The report mentioned that as of 2021, women held 25% of cybersecurity jobs globally, reflecting an annual increase of female practitioners even on average. It is important that we understand the relationships between gender and cybercrime to understand the issues investigators can and will face later: Cybercrime is not gender-neutral.

For the purposes of this research, cybercrime is defined by and limited to the different types of incidents and activities such as gaining unauthorized access to a computer system with a criminal motive, fraud, money laundering, denial of service attacks, ransomware attacks, identity theft, cryptocurrency mining, and the development and supply of malware. We predominantly focus on cyber-dependent crime while also looking at some cyber-enabled crimes. We will not investigate interpersonal cybercrime offenses such as harassment, child sexual exploitation, and stalking.

It is important to mention that while carrying out this research, we made every effort to consider the wider definition of gender to include non-cisgender (to note, cisgender denotes a person whose biological sex and gender identity match) profiles. However, as will be shown throughout the study, specific profiles on a technical-level are also difficult to ascertain from the anonymous community that cybercrime represents. With some exceptions where this was possible, most of our commentary will refer to male and female gender profiles simply as that is what the data presented. On this theme, we encourage the security community to explore this further should other techniques become available later on.

In cybercrime, gender influences peoples’ different experiences and shapes their roles among cybercriminal groups or hackers. Online cybercrime patterns mimic the offline world. Due to the lack of readily available national cybercrime arrest data, we looked at the overall incarceration data for both men and women in the United Kingdom, US, and Russia. The data was compiled from the World Prison Brief, an online database providing free access to information on prison systems around the world, hosted by the Institute for Crime & Justice Policy Research at Birkbeck, University of London.

The rate at which women are incarcerated varies greatly by country, but overall still account for less than 10%. Women are accused and convicted of less serious crimes and are less likely to be incarcerated compared to their male criminal counterparts. Today, the number of women committing crimes is on the rise globally. A 2017 report by the Institute for Criminal Policy Research at Birkbeck, University of London, showed that the global female prison population has surged by more than half since the turn of the century, while the male prison population increased by just a fifth over that same period. In the US alone, women made up only 6.8% of the prison population in the first half of 2022. In the United States, women commit more drug and property offenses, making up more than half of the offenses for which women are incarcerated.

It is widely assumed that most cybercriminals are male. Over time, however, female cybercriminals have been making their presence known. In underground cybercriminal forums, jobs for women include roles as money mules and for money laundering purposes.

In Russia, women make up 8% of the total prison inmate population. The country has one of the highest incarceration rates in Europe, reaching over 356 prisoners per 100,000 of their population in 2020. Most criminal offenses in the country were considered “crimes of little gravity” (that is, minor crimes borne of negligence), while the share of “grave crimes” stood at approximately 6%.

In 2021, there were approximately 75,000 males and almost 3,200 women prison inmates in England and Wales, with females accounting for 4% of the total prison population. TV license evasion was the most common offense for which women were convicted in 2019. Theft from shops was also the most common indictable offense committed, for which 34% of females and 14% of males were convicted in 2019.

Figure 1. Male and female prison population percentage by gender (data taken from World Prison Brief)

Data from a 2020 study on women shows that men are 21% more likely to be online and use the internet globally, rising up to 52% in a gap to women in least developed countries. A lack of digital skills emerged as the biggest factor keeping women offline. Women are also less likely to create certain types of online content, compared to men being 29% more likely than women to post comments about political, social, or economic issues, and 29% more likely to sell or advertise a product or service online.

Figure 2. Prison population count by gender (data taken from World Prison Brief)

Another way gender imbalance in cybercrime can be seen and explained is due to the accessibility to formal knowledge. We have consistently seen lower numbers of female students studying STEM-based (science, technology, engineering, and mathematics) degrees than men. According to a study conducted by the International Labour Organization (ILOSTAT) in 2019, the country of Georgia had the highest share of women employed in STEM fields, with 55.6% of all those employed in STEM fields being women. In the United States, women accounted for 48% of all STEM jobs compared to the United Kingdom’s count at 40%. This is considering the already-low numbers of STEM occupations, which comprise less than 20% of employment in all 69 countries included in the study, ranging from low decimal percentages in several African countries to 15% in the US and in the UK, and 17% in Austria.

Figure 3. Percentage of women working in STEM fields in 2021 by country. Data taken from ILOSTAT.

Gender gaps such as access to the internet and mobile phones, employment, and education affect how users interact with the internet, and therefore in committing cybercrime. Women remain 7% less likely than men to own a mobile phone and are 16% even less likely to use mobile devices to access the internet. According to the International Telecommunication Union (ITU), 62% of men are using the internet, compared to 57% of women in 2022.

Given that authorities’ public identification of cybercriminals is already at a relatively low volume occurrence, identifying specifically female cybercriminal members would be even more unusual. However, when it does happen, this unusual aspect means these stories will frequently generate more media coverage than their male counterparts. Here is an overview of some of the most high-profile cases on female cybercriminals charged in recent years.