# Malware Finances and Operations: a Data-Driven Study of the Value Chain for
Infections and Compromised Access

Juha Nurmi  0000-0003-3071-9027 Tampere UniversityTampereFinland
<EMAIL_ADDRESS><EMAIL_ADDRESS>,  Mikko Niemelä
0000-0001-9321-5235 Cyber Intelligence HouseSingaporeSingapore
<EMAIL_ADDRESS>and  Billy Bob Brumley  0000-0001-9160-0463
Tampere UniversityTampereFinland<EMAIL_ADDRESS>
(2023)

###### Abstract.

We investigate the criminal market dynamics of infostealer malware and publish
three evidence datasets on malware infections and trade. We justify the value
chain between illicit enterprises using the datasets, compare the prices and
added value, and use the value chain to identify the most effective
countermeasures.

We begin by examining infostealer malware victim logs shared by actors on
hacking forums, and extract victim information and mask sensitive data to
protect privacy. We find access to these same victims for sale at Genesis
Market. This technically sophisticated marketplace provides its own browser to
access victim’s online accounts. We collect a second dataset and discover that
91% of prices fall between 1–20 US dollars, with a median of 5 US dollars.

Database Market sells access to compromised online accounts. We produce yet
another dataset, finding 91% of prices fall between 1–30 US dollars, with a
median of 7 US dollars.

Anti-virus Software; Computer Hacking; Malicious Program Traits; Intrusion
Detection

††ccs: Security and privacy Malware and its mitigation††ccs: Security and
privacy Multi-factor authentication††ccs: Security and privacy
Authorization††ccs: Security and privacy Web application security††ccs:
Security and privacy Economics of security and privacy††journalyear:
2023††copyright: rightsretained††conference: The 18th International Conference
on Availability, Reliability and Security; August 29-September 1, 2023;
Benevento, Italy††booktitle: The 18th International Conference on
Availability, Reliability and Security (ARES 2023), August 29-September 1,
2023, Benevento, Italy††doi: 10.1145/3600160.3605047††isbn:
979-8-4007-0772-8/23/08

##  1\. Introduction

Malicious software, or malware, is a persistent executable on a victim system
controlled by an attacker (Grégio et al., 2015). Infostealer malware steals
personal information from the victim (Kaczmarczyck et al., 2020). This
typically includes (but is not limited to) system data, login credentials,
browser cookies, payment card information, and cryptocurrency wallets
(Campobasso and Allodi, 2020). Existing literature classifies malware in a
tree-like structure, and there are distinct families of infostealer malware
(Christodorescu et al., 2007; Park et al., 2013; Esparza, 2019; van Rijn,
2021).

The five most popular infostealers are Taurus, Raccoon, Azorult, Vidar, and
RedLine (Dov Lerner, 2022). We also found active Kpot and Arkei malware family
victims, and all of them are available for sale (Esullivan, 2020). After
purchasing malware control software, the adversary convinces victims to
download malicious code and become infected. Infostealers communicate with a
Command & Control (C&C) Server, which remotely controls the victim’s computer
(Esullivan, 2020; van Rijn, 2021).

Protection software cannot detect all intrusions by malware (Axelsson, 1999;
Kolbitsch et al., 2009), because code obfuscation methods hide the infection
(Borello and Mé, 2008). Predator the Thief, for example, is an infostealer
available on hacking forums, and is constantly updated to include a variety of
mechanisms to evade detection (Cohen, 2020). Updated stealth mechanisms make
detection difficult for anti-virus software (Christodorescu et al., 2005;
Fredrikson et al., 2010).

Unethical software developers provide infostealer control software via
Malware-as-a-Service (MaaS) (Abrams, 2022), which is a form of Cybercrime-as-
a-Service (CaaS). In 2022, prices range from 75 US dollars per week, to
125–200 US dollars per month, to 1,000 US dollars for an unlimited lifetime
subscription for improved versions of RedLine (Abrams, 2022; Toulas, 2022).
Subscribing threat actors gain access to an administration panel enabling them
to customise the malware, retrieve stolen data, and create new malware builds
(Abrams, 2022).

Malicious actors infect victims with infostealer malware using (most
frequently) phishing emails, cracked and pirated software, game cheating
packages, browser extensions, and cryptocurrency-related software (Campobasso
and Allodi, 2020; Duncan, 2022). In 2022, for example, one infostealer spread
via spam emails that included an Excel spreadsheet containing macros that
downloaded a persistent executable (Duncan, 2022).

The malware network owner profits from victim data by gaining access to the
compromised services or by selling the victim data to other criminals who
profit from it (van Rijn, 2021; Esparza, 2019). A study from 2016 indicates,
“Cybercriminals steal access credentials to webmail accounts and then misuse
them for their own profit, release them publicly, or sell them on the
underground market” (Onaolapo et al., 2016). For example, between January 2021
and March 2022, one particular marketplace sold 4,368,909 units of victim data
(Dov Lerner, 2022).

#### Research questions.

We propose the following research questions related to the previously
described actors in the malware ecosystem.

item.:

How do criminal enterprises sell malware, victims, and online account access?

item.:

How are the prices determined for compromised devices?

item.:

Compared to access to a victim’s device, what is the cost of online account
access?

#### Contributions.

These actors form illicit markets, and we study them (in part) using economics
nomenclature: “variables that can be observed in, or derived directly from,
markets (for example, prices of publicly traded securities and interest
rates)” (A926 IFRS 17 Insurance Contracts
manual111https://www.ifrs.org/content/dam/ifrs/publications/pdf-
standards/english/2021/issued/part-a/ifrs-17-insurance-contracts.pdf). Our
interests resemble those of economics literature: “The interest in market
factors is threefold: (1) to identify the factors that influence a product’s
or service’s demand, (2) determine the relationship between the factor and the
product or service, and (3) forecast that market factor for future years.”
(Winston et al., 2013, p. 52).

Contribution 1: Release data describing the value chain. For our research, we
collect, curate, and model three datasets, which we publish under the CC BY
4.0 licence. We represent each victim using a single JavaScript Object
Notation (JSON) data file. Data sources provide sets of victim JSON data files
from which we extract the essential information and omit Personally
Identifiable Information (PII).

#### MalwareInfectionSet: Underground hacking forums for malware logs.

RaidForums222https://raidforums.com/ operated as a forum for unethical hackers
from 2015 until 2022, when the FBI seized the domain. The website was
distributing data breaches and malware tools. We use RaidForums as a starting
point to track criminal profiles, and then add Telegram and Discord channels
based on their posts. This enables us to follow the content criminals share in
a broader fashion.

We discover (and, to the best of our knowledge, document scientifically for
the first time) that malware networks appear to dump their data collections
online. We speculate this could possibly be due to one or more of the
following factors. (i) They exploited the victims and hid their tracks by
attracting others to exploit the victims on a large scale as well. For
example, for at least a decade on pastebin.com, cybercriminals have released
publicly accessible lists to compromised targets (Kelion, 2012). (ii) By
offering free example data, they showcase their skills and specialisation. For
example, spammer botnets distribute free samples and display their
capabilities in this manner (Stone-Gross et al., 2011; Onaolapo et al., 2016).
(iii) A rival adversary leaked information to harm the operations of another
cybercriminal; see (Ainhoren, 2019) for an example case from 2019.

In this study, we utilise 245 malware log dumps from 2019 and 2020 originating
from 14 malware networks. MalwareInfectionSet contains 1.8 million victim
files, with a dataset size of 15 GB.

Contribution 2: Sale of compromised devices. To answer item, we demonstrate
how Infostealer malware networks sell access to infected victims.

#### VictimAccessSet: Genesis Market for compromised access.

Genesis
Market333https://genesis7zoveavupiiwnrycmaq6uro3kn5h2be3el7wdnbjti2ln2wid.onion/
is a cybercriminal marketplace specialising in the sale of web browser data
from malware victims (see “Buying Bad Bots Wholesale: The Genesis Market”
report in 2021444https://www.netacea.com/wp-
content/uploads/2021/04/Genesis_market_report_2021.pdf). The marketplace
operates within the anonymous Tor network but also through the clear web; the
genesis.market domain was accessible until April 2023, before the FBI seized
it.

Genesis Market focuses on user-friendliness and continuous supply of
compromised data. Marketplace listings include everything necessary to gain
access to the victim’s online accounts, including passwords and usernames, and
also detailed information which provides a clone of the victim’s browser
session. Indeed, Genesis Market simplifies the import of compromised victim
authentication data into a web browser session.

To utilise the stolen data in a user-friendly way, Genesis Market offers both
a web browser plugin and a dedicated web browser: the Genesis Security Plugin,
a standard browser plugin, or the Genesium Browser, a Chromium-based browser
built specifically for Genesis Market users, featuring the Genesis Security
Plugin pre-installed. Once a customer purchases a victim’s complete access
information, browser technology enables the customer to access the victim’s
stolen online profiles and authenticated sessions.

Contribution 3: Victim prices. To answer item, we measure the prices on
Genesis Market and how compromised device prices are determined.

To build our dataset VictimAccessSet, we crawled the website between April
2019 and May 2022. We use the collected web pages offering the resources for
sale to investigate market factors – in particular those that influence the
sale price. VictimAccessSet contains 0.5 million victim files, with a dataset
size of 3.5 GB.

#### AccountAccessSet: Database Market.

Database
Market555http://database6e2t4yvdsrbw3qq6votzyfzspaso7sjga2tchx6tov23nsid.onion/
specialises in selling credentials to compromised online accounts. The
marketplace operates inside the anonymous Tor network. Vendors offer their
goods for sale, and customers can purchase them with Bitcoins. The marketplace
sells online accounts, such as PayPal and Spotify, as well as private
datasets, such as driver’s licence photographs and tax forms.

To build our dataset AccountAccessSet, we crawled the website between November
2021 and June 2022. AccountAccessSet contains 33,896 victim files, with a
dataset size of 400 MB.

Contribution 4: Account prices. To answer item, we measure the prices on
Database Market and illustrate an increase in value: an attacker with access
to a single victim can sell access to individual accounts at a higher price.

Contribution 5: Value chain. The contributions reveal a broader perspective:
we draw the value chain for the malware economy from our findings and related
prices in the literature.

#### Structure.

Section 2 discusses previous malware-related work in the context of CaaS,
including economic aspects. Section 3 presents our methods, and Section 4
shares the three datasets and provides a step-by-step tutorial to allow anyone
to reproduce our findings. Consequently, Section 5 provides our primary
contributions: we investigate the prices and the value chain between illicit
enterprises. Section 6 establishes coverage metrics to measure the quality and
extensiveness of our datasets. Section 7 discusses ethical and privacy
considerations we account for in our work. We conclude our research in Section
8.

##  2\. Related work

#### Cybercrime economics.

In prior research, the cybercrime value chain has been established in Framing
Dependencies Introduced by Underground Commoditization (Thomas et al., 2015),
however this value chain is justified with circumstantial evidence and the
data are not interconnected, as the research points out: “the future of black
market research lays in developing a better understanding of the tenuous
connections between the actors in this space …we note that research into many
of these profit centers is sorely lacking: we rely on industry and government
estimates of profit in the absence of methodologically sound measurements
…research contributions must shift from analysis based off anecdotal evidence
to thorough investigations of the ecosystem”. In our study, we address this
gap in the literature and we establish robust connections between the malware
networks and the illicit markets.

Already in 2011, Stone-Gross et al. (2011) identify financial variables and
the specialisation of cybercriminals. The authors describe how botnet
operators sell their services, while other vendors only sell email address
lists: “spam-as-a-service can be purchased for approximately $100–$500 per
million emails sent” and “Rates for one million email addresses range from $25
to $50”.

Broadhurst et al. (2018) study MaaS offerings on the illicit Dream Market from
2017 to 2018. During this period, they calculate that 47 AUD is the average
price for a single set of compromised credentials.

Huang et al. (2018) propose a conceptual model describing CaaS. The authors
identify an impressive 24 families of CaaS, including pricing models and
estimated costs. Our dataset MalwareInfectionSet falls under their
categorisation Personal Profile as a Service (PPaaS), for which they provide a
representative price of 4–20 US dollars per record in 2018 (Huang et al.,
2018, Tbl. 1).

Meland and Sindre (2019) study 11 dark web illicit markets offering CaaS. They
explicitly omit compromised credentials from their study, since their focus is
on the sale of offensive services (Meland and Sindre, 2019, Sect. 3).

Bhalerao et al. (2019) study CaaS using machine learning techniques to perform
supply chain detection. They validate their techniques using the same
underground forum as Vu et al. (2020).

Lastly, Campobasso and Allodi (2023) crawl the Russian cybercrime market that
provides user impersonation profiles and estimate a daily trade volume of up
to 700 profiles, equating to daily sales of up to 4,000 US dollars.

#### Security dataset classification.

Zheng et al. (2018) study security-related datasets to provide a taxonomy, as
well as to understand the scholarly ramifications of releasing said datasets.
In their classification, our datasets falls under the “Attacker-Related”
category, and furthermore the “cybercrime activities” subcategory, since they
contain “information on the infrastructure and operations used by malicious
actors to perpetrate attacks” (Zheng et al., 2018, Sect. 3). While the authors
give other examples from this class including data collected from illicit
marketplaces inside the Tor network (Christin, 2013; Dolliver, 2015; Dolliver
and Kenney, 2016; Nurmi et al., 2017), ours is the first study dedicated to
the malware ecosystem.

#### Gathering cybercrime data.

Motoyama et al. (2011) study data from six underground forums dedicated to the
sale of illicit goods and services. They focus on social network aspects,
including connectivity, reputation, and community policies. Furthermore, they
study these marketplaces to determine how the different social network aspects
affect market performance. One of these forums (Carders, German speaking)
specialised in stolen credit card numbers, yet interestingly roughly 3%
(334/9923) of the sale listings were victim logs (Motoyama et al., 2011, Tbl.
5). The original data source for their study was leaked SQL databases
(Motoyama et al., 2011, Sect. 3), sharing conceptual similarities with the
original data source for our MalwareInfectionSet.

Schäfer et al. (2019) build a tool called BlackWidow to monitor illicit
forums. The tool is also capable of machine learning-based information
extraction. The authors apply their tool to seven different forums,
subsequently analysing the cross-forum social network aspects.

Pastrana et al. (2018b) propose CrimeBot, a framework for scalable data
collection from illicit online forums. The authors apply CrimeBot to produce
their CrimeBB dataset (Pastrana et al., 2018b, Sect. 4), containing 48 million
posts and their associated metadata. CrimeBB continues to grow, now
approaching 100 million posts in 2022 (Pete et al., 2022).

#### Cybercrime data creates new research.

As CrimeBB grows, it increasingly fosters academic studies for those with
access to the data through a legal agreement with the University of
Cambridge.666https://www.cambridgecybercrime.uk/process.html The following
CrimeBB usage examples are relevant to our research and motivate us to publish
datasets for the benefit of other researchers.

Pastrana et al. (2018a) utilise CrimeBB data to characterise the key
individuals that are likely to engage in major cybercriminal activities,
aiding law enforcement. In a similar vein with a focus on individuals, Pete et
al. (2020) analyse social network aspects of six dark web forums and use
graph-theoretic similarities to identify properties in individual users that
lead to these actors taking different forum roles. In a CrimeBB followup
study, Collier et al. (2020) investigate cybercrime infrastructure work and
show that botnet administration tasks are a burden and a weak point in the
cybercrime ecosystem, suitable for law enforcement targeting. Vu et al. (2020)
analyse the reputation properties in one particular illicit marketplace, and
Bermudez-Villalva and Stringhini (2021) compare dark web vs. deep web markets.

Lastly, and most relevant to our study, Akyazi et al. (2021) use the CrimeBB
data to analyse various CaaS offerings on one particular illicit marketplace.
The vast majority of these offerings were related to botnets, reputation
boosting, and traffic flooding.

##  3\. Methods

[Malware ecosystem monitoring]A summary of our methods for automated malware
ecosystem monitoring.

Figure 1. (a) Our crawlers authenticate on RaidForums, Genesis Market, and
Database Market for data collection. Our bots follow messages by joining the
Discord and Telegram channels mentioned on RaidForums. They download linked
resources, including malware infection log files. (b) To extract victim
records from the data sources, we use regular expressions. (c) We apply
redaction, replacement, and generalisation to omit PII. (d) Finally, we create
JSON victim record sets for pricing measurements, demonstrate overlap between
infections and for-sale victims, and evaluate our data.

Figure 1 provides a summary of our automated malware ecosystem monitoring: web
crawling, chat message collection, and linked resource downloads. We process
the raw data into victim record files while protecting the user’s privacy. The
privacy protection measures replace the same input with the same ID. For
instance, throughout the dataset, the same IP address has the same ID.
Similarly, if there are passwords for services but the passwords are
identical, the replacement IDs are identical. We curated together datasets to
measure malware infections, the sale of access to victims, and the reselling
of online accounts (see Section 4 on how to download the datasets and scripts
and replicate the results).

###  3.1. Data extraction for MalwareInfectionSet

Our web crawler authenticates with RaidForums in order to gather pages and
extract Discord and Telegram invitations. Then, our bots join channels on
Discord and Telegram to monitor messages. The bots visit the shared links and
download resources, including log files containing malware (if this is not
feasible, the resources are reported for manual human involvement).

We utilise 245 malware log dumps from 2019 and 2020 originating from AZORult,
KPOT, Raccoon, Qulab, Masad, Arkei, Oski, Taurus, Redline, Mystery, Ficker,
Predator, Ducky, and Vidar malware networks. The total size of these original
malware log files is 30 GB. Figure 2 is an example of a victim record file.

The malware logs include system information, login credentials to online
services, user information, credit card numbers, screenshots of victim
desktops, operating system, keyboard languages, IP address, geolocation,
hardware specifications, process list of active software, browser information
and cookies, cryptocurrency wallets, victim files, automatically filled site
forms, gaming software configurations, chat service configurations, clipboard
data, installed software, browsing and download history, and mail, VPN, RDP,
and FTP account information.

We structured and cleaned the data, aggregating the following fields from the
logs to build our dataset MalwareInfectionSet: (1) Identifier for the entry;
(2) A date derived from the logs; (3) IP address replaced with a randomly
generated ID; (4) Machine identifiers replaced with random IDs; (5) A list of
passwords we substituted with random IDs; (6) Total number of one-of-a-kind
passwords; (7) A list of usernames we substituted with random IDs; (8) Total
number of distinct usernames; (9) All domain names in the log, including
browser history; (10) Keyboard layout; (11) A list of compromised services;
(12) Count of compromised services; (13) Country code which is primarily based
on IP address; (14) Operating system; (15) A list of email addresses replaced
with random IDs; (16) Total number of unique email addresses; (17) Possible
endpoint protections.

[Infostealer victim entry]An example JSON file represents a victim entry.

Figure 2. An example JSON file from MalwareInfectionSet depicting victim data.

We remove email addresses, IP addresses, and payment card numbers from raw
text fields, such as those used to list compromised services. This means that
service count (number of distinct services) may exceed the total number of
services listed. In that case, we remove services which contain private
information from the list.

###  3.2. Data extraction for VictimAccessSet

We crawled the Genesis Market between April 2019 and May 2022, collecting the
web pages offering the resources for sale. Figure 3 is an example of a victim
information page.

[Genesis Market]The infostealer malware adds compromised data to the Genesis
Market for sale.

Figure 3. The infostealer malware adds compromised data to the Genesis Market
for sale.

Since the victim page is continuously updated, we use the oldest page as the
reference entry (or entry of record) in VictimAccessSet. As such, Figure 4 is
an example of a file. This record corresponds to the page in Figure 3,
however, due to different capture dates, the price has increased from 14.40 to
15.50 US dollars.

[Genesis Market victim entry]An example JSON file of compromised data on the
Genesis Market.

Figure 4. An example JSON file from VictimAccessSet which represents one
victim.

We consolidated the following fields to build our dataset VictimAccessSet: (1)
Bot identifier from the webpage; (2) URL address; (3) Text of the webpage; (4)
All domain names on the webpage; (5) Country code; (6) Total number of
resources; (7) The malware installation date; (8) Date of victim information
update; (9) Partial IP address; (10) Operating system; and (11) Price of the
access.

###  3.3. Data extraction for AccountAccessSet

We crawled the website between November 2021 and June 2022, collecting the web
pages offering the credentials for sale. Figure 5 is an example of a vendor
advertising compromised credentials for sale on Database Market.

[Database market]Compromised data for sale on Database market.

Figure 5. Compromised data for sale on Database market.

Figure 6 is an example of a file, where we populated the following fields: (1)
URL address of the webpage; (2) Text of the webpage; and (3) Data collection
date.

[Database market victim data]An example JSON file of compromised data on the
Database market.

Figure 6. An example JSON file from AccountAccessSet which represents one
page.

Because vendors can style advertisements in any way they like, it is not
possible to accurately collect price and sale item information across the full
AccountAccessSet in an automated way. We manually inspected a random sample of
599 out of 33,896 pages on Database Market. We carefully verified that our
chosen subset contains individual accounts with price information and no other
products for sale, such as merged accounts, company databases, or stolen
software. Then, we created an extraction script for these 599 pages to
evaluate the prices.

###  3.4. Relationship between malware infections and victims for sale on
Genesis Market

To illustrate the value chain, we compare the malware infections with the
records for sale on Genesis Market by cross-referencing MalwareInfectionSet
with VictimAccessSet. We are identifying unique users based on service and
country data, then comparing their presence in both datasets.

For instance, the victim information for sale on Genesis Market, present in
VictimAccessSet (ID=245092557, 245092557.json) and depicted in Figure 4, has
details matching a record from MalwareInfectionSet (ID=487238, 0487238.json).
This Singaporean victim has the following rare compromised services:
m.qqbb939.com, either.io, wft2288.com, m.9292ft.com, m.1118ft.com,
uob3ds.uobgroup.com, legacy.w-locate.com, and tcnvmms.com.

The matching is as follows: (i) select the victims that have at least five
completely unique services based on the domain names; (ii) calculate the
intersection of three or more of these unique domain names between the
datasets; and (iii) check that the countries are identical.

The matching criteria identify users who are unique based on the services they
use (they use uncommon services that other users do not) and who are present
in both datasets. As a result, the tight matching criterion finds only the
most unique victims in both datasets, not all of the victims in both datasets.

##  4\. Datasets to replicate our results

Using our well-documented scripts, it is straightforward to reproduce our
findings. You can download our datasets, Python scripts, and tutorials on the
Zenodo service for Open Science777https://doi.org/10.5281/zenodo.8047204. It
takes an estimated 1 hour of human time and 3 hours of computing time to
duplicate our key findings from MalwareInfectionSet (malwarevictims.tar.gz,
1.7 GB); around one hour with VictimAccessSet (genesisvictims.tar.gz, 335 MB);
and minutes to replicate the price calculations using AccountAccessSet
(database.tar.gz, 7 MB).

##  5\. Results

item: How do criminal enterprises sell malware, victims, and online account
access?

We discovered information-stealing malware logs from victims of the Taurus,
Raccoon, Azorult, Vidar, RedLine, Kpot, and Arkei families. These MaaS
controlling software are for sale on underground markets with prices ranging
from 75 to 200 US dollars per week and 125 to 200 US dollars per month. After
acquiring an MaaS subscription, the adversary convinces victims to download
malicious code, causing them to become infected.

###  5.1. Malware targets Windows

The infostealers target users of Microsoft’s Windows operating system. Windows
10, Windows 7, and Windows 8 are the main infected operating systems according
to MalwareInfectionSet and VictimAccessSet. Victims in VictimAccessSet employ
one of the following Windows operating systems: 76% (365,676/480,994) use
Windows 10, 7% (32,989/480,994) use Windows 8, and 16% (77,170/480,994) use
Windows 7. We extracted MalwareInfectionSet from heterogeneous text data logs
in which the operating system information is sometimes absent, incorrect, or
described in multiple ways; nonetheless, if we search os:NT* or os:Windows*,
we obtain 62% (1,115,263/1,809,384) of the infection victims.

Stealth mechanisms are making malware difficult to detect for anti-virus
software. According to MalwareInfectionSet, some users have installed popular
anti-virus software: Avast, Mcafee, Symantec, Microsoft Security Essentials,
Bitdefender, Microsoft/Windows Defender, F-secure anti-virus, Zonealarm anti-
virus, and Kaspersky anti-virus. The infection occurred, regardless.

###  5.2. Credentials and password reuse

Password reuse is a common problem for security: We study credential reuse
with MalwareInfectionSet, and find that 50% of victims have 1–8 unique
passwords.

Furthermore, Figure 7 also shows that the majority of victims have few
distinct usernames. In total, 9% of victims have a single unique username
across services, while 10% have two. The majority of victims have between 1–9
usernames and between 1–5 unique email addresses.

[Credentials]Cumulation of unique passwords, usernames, and email addresses.

Figure 7. Cumulation of unique passwords, usernames, and email addresses for
each victim in MalwareInfectionSet.

If we perform linear regression on the number of unique usernames and unique
passwords across all victims, we discover that a typical user has 1.12 times
as many unique usernames as unique passwords:

$Usernames=1.12*Passwords+1.78$

Investigating the correlation between the number of unique credentials and
compromised services similarly with linear regression, we obtain:

$EmailAddresses=0.11*Services+3.67$ $Usernames=0.36*Services+6.19$
$Passwords=0.31*Services+4.43$

This means that a typical user creates a new unique password and username for
every third service.

###  5.3. Commonly compromised services

The top 10 services that are most frequently compromised in
MalwareInfectionSet are: google.com, facebook.com, live.com, roblox.com,
twitter.com, discord.com, twitch.tv, epicgames.com, instagram.com, and
paypal.com.

Because each of these is a well-known web service (c.f. Similarweb’s “Most
Visited Websites Ranking Analysis”888https://www.similarweb.com/top-
websites/), the results are consistent with expectations.

[Financial services]Financial services, cryptocurrency exchanges and online
banking.

Figure 8. Financial services in MalwareInfectionSet: cryptocurrency exchanges
and online banking. 13.5% of the victims have their PayPal online payment
account compromised.

###  5.4. Compromised financial services

The victims used the financial services listed in Figure 8, consisting of
online banking services and cryptocurrency exchanges. In total, 13.5% of the
victims in MalwareInfectionSet have their PayPal online payment account
compromised.

###  5.5. Victim records for sale

Adversaries may attempt to profit from stolen credentials, e.g., by the owner
of the bot network using them, or the adversary selling the access information
forward. We now provide evidence of the latter with our matching criteria
described in Section 3 (methods).

We first automatically extract and identify unique domain names (compromised
services) from VictimAccessSet, and select records that contain at least five
of these distinct domain names. This selection yields 2,116 records from
VictimAccessSet. We then search for matches from MalwareInfectionSet.

As an example of our selection criteria, consider 1502766.json from
MalwareInfectionSet and 1814801285.json from VictimAccessSet. Here, countries
(IT and IT) match, and both records contain a total of 11 distinct services:
gravel.ltd, bitminer.biz, shamining.com, coincity.in, navminer.biz,
luckfarm.fun, ethereum-master.com, aristabank.com, flovin.ltd, getdoge.io, and
xcryptos.io.

As a result, we discover that 5% (106/2,116) of the malware-infected victims
are present in both datasets. Please note that this method only provides
evidence that infostealer malware victims are available for purchase on
Genesis Market; the exact percentage must be higher than this. This
unequivocally establishes a link in the supply chain: Infostealer malware
infections are a supplier for cybercriminal marketplaces that sell access to
victim data.

###  5.6. Access to a malware victim: ask prices

item: How are the prices determined for compromised devices?

Genesis Market sells access to victim information, with stolen credentials
from victims serving as the primary pricing factor. Addressing item, we
discover that the number of compromised services seems to dictate the ask
price. Using linear regression to determine the price-to-services correlation,
we obtain:

$Price=0.05*Services+6.26$

Interestingly, there is no effect of country on pricing. We determined this by
creating separate linear regression models for each nation, then comparing
them.

Finally, we examine price distribution to conclude our study of item. Rounding
the prices to the nearest dollar, the range of prices is from 1 to 350 US
dollars, and prices over 125 US dollars each have fewer than 10 victims.
Figure 9 illustrates these ask prices, where 91% fall between 1 and 20 US
dollars, with a median of 5 US dollars.

[Price of access]Price of access to compromised devices and accounts.

Figure 9. Price of access to compromised devices (VictimAccessSet) and
accounts (AccountAccessSet). In the former, 91% fall between 1 and 20 US
dollars, with a median of 5 US dollars. In the latter, 91% fall between 1 and
30 US dollars, with a median of 7 US dollars.

###  5.7. Access to an online account: ask prices

item: Compared to access to a victim’s device, what is the cost of online
account access?

AccountAccessSet reveals the prices of compromised online account access,
where we chose a subset of 599 account advertisement pages. We manually
confirmed these contain individual accounts with price information, and no
other items for sale, such as accounts combined into a single item,
organisation databases, or stolen software.

Figure 9 illustrates these ask prices, where 91% fall between 1 and 30 US
dollars, with a median of 7 US dollars. This data provides quantitative
estimates for the costs of individual online accounts, addressing item.

In summary, after purchasing access to a victim’s device for 1–20 US dollars,
a cybercriminal is able to verify working online accounts of the victim and
resell the harvested online accounts for 1–30 US dollars per account.

###  5.8. Malware supply chain

Malware suppliers, infections, victim sales, and online account sales form the
value chain in Figure 10.

[Malware value chain]Malware value chain: malware suppliers, infections,
victim sales, and online account sales.

Figure 10. Malware value chain: malware suppliers, infections, victim sales,
and online account sales.

Malware victim and account access are both perishable goods, so the
manufacturer must sell them before they grow stale. To sell victims, the
manufacturer needs economies of scale (roughly, an economics concept
formalising cost advantages) and a streamlined production process. In Table 1,
we display the known costs and projected earnings for the operations.

[Malware value chain]Prices and profitability in the malware economy value
chain.  Actor Price (US dollars) Pricing model Monthly profit is revenues
minus total costs Malware-as-a-Service 125–200 / monthly license Monthly
subscription $\sum{Pay\textrm{-}per\textrm{-}subscriptions}$ Spam-as-a-Service
100–500 / million sent emails Pay-per-million
$\sum{Pay\textrm{-}per\textrm{-}million\textrm{-}emails}$ Email Target List
Supplier 25–50 / million addresses Pay-per-million
$\sum{Pay\textrm{-}per\textrm{-}million\textrm{-}addresses}$ Infection
Manufacturing Bulk sale of victims Pay-per-victim-access
$\sum({Pay\textrm{-}per\textrm{-}victim\textrm{-}access}-comission)$ Access
Wholesaler 1–20 / victim access Commission pricing (?)
$\sum{Pay\textrm{-}per\textrm{-}commission}$ Account Retailer 1–30 / stolen
record Pay-per-access
$\sum({Pay\textrm{-}per\textrm{-}account\textrm{-}access}-Pay\textrm{-}per\textrm{-}victim\textrm{-}access/48)$
Criminal Consumer Exploits individual accounts Per-victim-revenue
$\sum({Account\textrm{-}revenue}-{Pay\textrm{-}per\textrm{-}account\textrm{-}access})$

Table 1. Prices and profitability in the malware economy value chain. Many
goods, such as licences, have fixed costs and zero per-unit production costs
at scale. The average number of compromised services for victims in the
Genesis Market is 48.

#### Cause interruption.

Victim wholesale is precisely what Genesis Market offers. Wholesale is the
single weakest link in the chain: As access to victim devices is a single
point of failure through one marketplace, law enforcement should focus effort
there.

##  6\. Limitations and quality metrics

###  6.1. MalwareInfectionSet: representativeness

Here we study the geographic distribution of entries in MalwareInfectionSet.
The World Bank publishes open access to world
statistics999https://doi.org/10.1596/978-1-4648-0382-6_open_data, including
estimated number of Internet users. This statistic allows us to calculate the
proportion of victims per million Internet users (International
Telecommunication Union (ITU) World Telecommunication/ICT Indicators Database,
CSV file)101010https://doi.org/10.5281/zenodo.3969472. We compared the number
of victims to that estimate for each country. Figure 12 illustrates the
country distribution across this dataset, which ranks countries by the number
of victims per million Internet users.

[Infections in countries]The number of infections per million Internet users,
using a base-10 logarithmic scale.

Figure 11. Countries in MalwareInfectionSet by the number of victims per
million Internet users, using a base-10 logarithmic scale.

ZZ

[Victims in countries]The number of Genesis Market victims per million
Internet users, using a base-10 logarithmic scale.

Figure 12. Genesis Market sells access to victims. Countries in
VictimAccessSet by the number of victims per million Internet users, using a
base-10 logarithmic scale.

Although the distribution of victims varies between countries, nearly every
country has victims. The number of victims may vary due to the country- or
language-specific nature of some infection sources. For example, Niger,
France, and Australia have a disproportionately high number of cases in
comparison to their Internet user populations.

MalwareInfectionSet contains compromised credentials for 424 unique onion
domains from 293 victims, i.e. addresses from TorBrowser for use within the
Tor anonymity network. We opened onion domains to view them: Most of them are
offline, but the online onion services appear to be marketplaces, based on the
landing page. Typically, marketplaces on Tor sell illegal substances and goods
(Caciuloiu et al., 2020).

The Tor Network has an estimated 3 million concurrent users, based on daily
data collection of the Tor Project for
2022111111https://metrics.torproject.org/userstats-relay-country.html. This
equates to 0.075% of the total 4 billion Internet
users121212https://data.worldbank.org/indicator/NY.GDP.PCAP.CD?most_recent_value_desc=true.
We now compare this percentage to what our dataset indicates. Using
MalwareInfectionSet, we are aware of the percentage of victims who
authenticate on onion websites (the total number of victims using Tor is
greater than this), which is 0.016% (293/1.8 million). The proportions have
the same order of magnitude, and MalwareInfectionSet also represents
anticipated Tor users.

According to a Google study in conjunction with Harris Poll in 2018, 13% of US
adults use a single password for all of their
accounts131313https://services.google.com/fh/files/blogs/google_security_infographic.pdf.
We conducted a similar study using MalwareInfectionSet, and Figure 7 depicts
the results. We observe that 13% of victims use a single password for all
services, strikingly consistent with the aforementioned study.

In summary, it is fair to say MalwareInfectionSet represents global Internet
users.

###  6.2. MalwareInfectionSet: accuracy

We compare MalwareInfectionSet to other data sources, including the number of
active Facebook users. Given that there are 2.9 billion monthly active users,
Facebook estimates that 60% of the world’s active Internet users log in each
month in 2021141414https://investor.fb.com/investor-news/press-release-
details/2022/Meta-Reports-Fourth-Quarter-and-Full-
Year-2021-Results/default.aspx. In MalwareInfectionSet, 46%
(829,630/1,809,384) of victims had their Facebook accounts compromised
(matching in services:*.facebook.com).

#### Multi-victim entries.

It is possible that the infected device is a shared computer with dozens of
users in a library, school, or business. In MalwareInfectionSet, 3.3% of
entries (60,163) have over ten distinct email addresses, over 50 passwords,
and over 100 compromised services. As such, multiple victims are almost
certainly represented by these particular entries. However, in 96.7% of cases
it appears as though one infected device equates to one human victim in
MalwareInfectionSet.

#### Not all timestamps are accurate.

The primary reason is that text extractors are interpreting the victim’s
information incorrectly. For instance, we noticed that a victim has a computer
named 2011-01-1, and because this information is near the actual time field,
the extractor chose it. The second reason is that the timestamp appears to be
incorrect (perhaps it uses the victim’s clock time).

#### Empty victim entries.

0.6% of entries (11,157) contain no detailed victim information. This
indicates that the extractors did not discover any timestamps, IP addresses,
domain names, or email addresses. We retain these empty entries in
MalwareInfectionSet because they represent victims that had no meaningful data
stolen.

#### Anti-virus information is only indicative.

Although the anti-virus field contains snippets of potential endpoint
protection software, it does not always show if the device is running the most
recent protection. This field is also populated if the victim is merely a
customer of a security company (e.g., credentials for my.kaspersky.com).
Consequently, we do not attempt to quantify the effectiveness of endpoint
protection with our dataset.

#### Malware also stores incorrect credentials for services.

In the raw data, there are numerous credentials for the same service where the
username (which can be an email address) and password vary slightly. When
victims enter their credentials incorrectly, malware obliviously stores these
incorrect credentials for services. For instance, it is common for victims to
have usernames and email addresses like<EMAIL_ADDRESS>and<EMAIL_ADDRESS>
###  6.3. VictimAccessSet: representativeness

Here we study the geographic distribution of entries in VictimAccessSet.
Figure 12 illustrates the country distribution across this dataset, which
ranks countries by the number of victims per million Internet users (i.e.,
analogous to Figure 12, but for VictimAccessSet).

According to Figure 12, nearly every country is in VictimAccessSet. Although
the distribution of victims varies between countries, nearly every country has
victims. The number of victims may vary due to the country- or language-
specific nature of some infection sources.

For example, Portugal, Hungary, Romania, Italy, and Bulgaria have a
disproportionately high number of cases in comparison to their Internet user
populations. In contrast, Uzbekistan (post-Soviet state), China, and
Tajikistan (post-Soviet state) have a disproportionately low number of cases.

Certain countries do not appear in VictimAccessSet at all: For example, the
lack of Russian victims is clear from Figure 12. This indicates that Genesis
Market operates from Russia, where cybercriminals are actually allowed to
operate freely as long as they do not target Russian citizens. Furthermore,
this explains the two post-Soviet state outliers previously mentioned, as well
as the following post-Soviet states that are absent from VictimAccessSet:
Ukraine, Belarus, and Kazakhstan. Lastly, North Korea is also absent from
VictimAccessSet.

This marketplace sells access to devices in all major countries except Russia
(and several post-Soviet states), and indeed the Genesis Market domain
resolved to an IP address there (before the FBI seized it in 2023).

Authorities in Russia will not investigate cybercrime unless a Russian company
or person files a formal complaint as a victim (Schneier, 2021). The simplest
way for these criminals to remain undetected is to ensure that their malware
does not infect people in their home country. For instance, DarkSide malware
does not spread within the Commonwealth of Independent States (CIS) or former
Soviet satellites, and many malware strains do not infect computers with a
Cyrillic keyboard (Schneier, 2021).

In summary, it is fair to say VictimAccessSet represents global Internet
users, sans the noted omissions.

###  6.4. VictimAccessSet: accuracy

Here we describe a number of validations to demonstrate that VictimAccessSet
accurately represents global Internet users (by comparison to anticipated
numbers).

#### Compromised services.

In VictimAccessSet, 50% (239,622/480,994) of victims had their Facebook
accounts compromised. This corresponds to the expected number of Facebook
users in the dataset, as Facebook estimates that 60% of the world’s active
Internet users log in each month.

#### Operating systems.

Windows 10 has a 72.23% market share among Windows operating systems,
according to Statcounter GlobalStats in
2022151515https://gs.statcounter.com/os-version-market-
share/windows/desktop/worldwide. We calculate the percentage of Windows 10
users within our VictimAccessSet. According to our data, the proportion of
Windows 10 users is directly analogous, at 76% (365,676/480,994).

#### Web browsers.

The Chrome web browser has a market share of 79.9% according to W3Schools’
Browser Statistics for
2022161616https://www.w3schools.com/browsers/default.asp. Likewise, 71%
(340,933/480,994) of the victims in VictimAccessSet are Chrome users.

##  7\. Research ethics and privacy

Open Data is an unqualified good, but sometimes it can identify individuals.
For example, Tran and Scholtes (2015) suggest that avoiding the collection of
certain types of data can protect against civil rights violations, and
countries with a history of data misuse have resolved not to collect data that
associates an individual with a vulnerable group.

We obtained the original information for our research from public sources,
even though some sources are difficult to locate and access. Bear in mind that
at least some of the original logs have been available online for three years.
Worse yet, as we demonstrated in Section 5, this information is partially
available for sale. As a result, an adversary can locate the original
information and identify the victims from the original data, as their real
names are typically included in the available data logs.

Our research results use anonymised victim data, which contains no personal
information. The original data sources for VictimAccessSet and
AccountAccessSet are anonymous and do not contain personal information, hence
require no protection. The original data logs for MalwareInfectionSet contain
private and sensitive information. We process MalwareInfectionSet while
protecting the anonymity of victims (see Section 3).

Malevolent actors would simply use the original data source, not our datasets.
By making our structured datasets publicly available with privacy protections
in place, researchers can study malware without accidental exposure to
sensitive victim information, nor the security risks of collecting the
original data.

##  8\. Conclusion

We now summarise the entire infostealer malware ecosystem of actors and their
operations. We find that cybercrime is specialising in several roles within
the illicit economy and for the first time give a comprehensive illustration
of the malware value chain with exact pricing information.

First, unethical software developers create malware. They sell software
licenses via the Internet, where the cost of the MaaS model is between 125–200
US dollars per month.

Second, the owner of the malware network infects victims via popular methods,
such as email attachments and macros. This attacker may utilise spam-as-a-
service, which costs between 100–500 US dollars per million emails sent, and
targeted email lists, which costs between 25–50 US dollars per one million
email addresses.

Third, once malware infects victims, the network operator sells access to
their devices on Genesis Market.

One key new finding is a full understanding of the precise monetary value of
victims from a criminal perspective: The price range is between 1–350 US
dollars, and the value of a victim’s record depends on the number of
compromised services. This provides insight into the malware network owner’s
direct retail value of the victim’s information. Typically, access to a
malware victim costs between 1–20 US dollars, with a median of 5 US dollars.

Fourth and finally, a buyer of victim access ultimately profits by gaining
access to the victim’s online accounts or by reselling individual credentials.
Database Market operates inside the anonymous Tor network, and resells access
to compromised online accounts. We show how resale prices are typically
between 1–30 US dollars, with a median of 7 US dollars.

##  9\. Future work

#### Use datasets for interdisciplinary research.

With our datasets, it is possible to investigate completely new research
topics outside of security and malware. We provide one example here: studying
the effectiveness of Internet censorship. In several nations, including the
Philippines, the popular adult website Pornhub is
blocked171717https://www.cnnphilippines.com/news/2017/01/16/government-blocks-
major-porn-websites.html. Although using the service without creating an
account is free, additional paid features are available after logging in. We
investigate this using MalwareInfectionSet, and provide a Python script for
this with the published data. 0.47% (133/27,978) of victims in the Philippines
have a premium account on Pornhub although the service is censored.
Comparatively, 1% (1,861/1,864,61) of victims in the United States and 0.2%
(108/56902) of victims in Turkey have premium Pornhub accounts. As a way to
use these datasets further, we just showed that Internet filtering in the
Philippines does not prevent many people from using a popular adult website.

#### User guidelines and security technologies.

We propose a study of novel guidelines and techniques for businesses that
should account for the fact that infostealer malware undermines multi-factor
authentication (MFA) and endpoint security, thereby rendering the end-user
defenceless. If we compare our malware victim data to the National Institute
of Standards and Technology’s (NIST) guidelines for the prevention and
management of malware incidents, we find that infostealer malware undermines
these suggestions (Mell et al., 2005; Souppaya and Scarfone, 2013). According
to the guidelines, network-based anti-virus software, host-based anti-virus
software, and spyware detection and removal software are the most effective
approaches for preventing malicious code (Mell et al., 2005, p. 77). A typical
victim uses Windows 10, which by default has Microsoft’s most recent endpoint
defences. Microsoft Office macros remains a common infection method, after
decades of security patches against these exploits. A typical victim has 1–8
unique passwords, indicating that the typical user finds it too challenging to
use a unique password for each account. A user may employ MFA, but Genesis
Market duplicates the victim’s authenticated web session, hence weakening MFA
protection.

###### Acknowledgements.

This project has received funding from the European Union’s Horizon 2020
research and innovation programme under grant agreement No 952622 (SPIRS), and
grant agreement No 804476 (SCARE).

## References

  * (1)
  * Abrams (2022) Lawrence Abrams. 2022\.  Raccoon Stealer malware suspends operations due to war in Ukraine.  https://www.bleepingcomputer.com/news/security/raccoon-stealer-malware-suspends-operations-due-to-war-in-ukraine/
  * Ainhoren (2019) Ariel Ainhoren. 2019\.  Massive ’Collection #1’ Data Dump: What’s In It and How Did it Happen?  https://intsights.com/blog/massive-collection-1-data-dump-whats-in-it-and-how-did-it-happen
  * Akyazi et al. (2021) Ugur Akyazi, Michel van Eeten, and Carlos Hernandez Gañán. 2021\.  Measuring Cybercrime as a Service (CaaS) Offerings in a Cybercrime Forum. In _21st Annual Workshop on the Economics of Information Security, WEIS 2021, Virtual Event, 28-29 June, 2021_.  http://resolver.tudelft.nl/uuid:01cb117a-339c-42e9-9691-8456a12e3947
  * Axelsson (1999) Stefan Axelsson. 1999\.  The Base-Rate Fallacy and Its Implications for the Difficulty of Intrusion Detection. In _CCS ’99, Proceedings of the 6th ACM Conference on Computer and Communications Security, Singapore, November 1-4, 1999_ , Juzar Motiwalla and Gene Tsudik (Eds.). ACM, 1–7.  https://doi.org/10.1145/319709.319710
  * Bermudez-Villalva and Stringhini (2021) Adrian Bermudez-Villalva and Gianluca Stringhini. 2021.  The shady economy: Understanding the difference in trading activity from underground forums in different layers of the Web. In _APWG Symposium on Electronic Crime Research, eCrime 2021, Boston, MA, USA, December 1-3, 2021_. IEEE, 1–10.  https://doi.org/10.1109/eCrime54498.2021.9738751
  * Bhalerao et al. (2019) Rasika Bhalerao, Maxwell Aliapoulios, Ilia Shumailov, Sadia Afroz, and Damon McCoy. 2019\.  Mapping the Underground: Supervised Discovery of Cybercrime Supply Chains. In _2019 APWG Symposium on Electronic Crime Research, eCrime 2019, Pittsburgh, PA, USA, November 13-15, 2019_. IEEE, 1–16.  https://doi.org/10.1109/eCrime47957.2019.9037582
  * Borello and Mé (2008) Jean-Marie Borello and Ludovic Mé. 2008.  Code obfuscation techniques for metamorphic viruses.  _J. Comput. Virol._ 4, 3 (2008), 211–220.  https://doi.org/10.1007/s11416-008-0084-2
  * Broadhurst et al. (2018) Roderic Broadhurst, David Lord, Donald Maxim, Hannah Woodford-Smith, Corey Johnston, Ho Woon Chung, Samara Carroll, Harshit Trivedi, and Bianca Sabol. 2018.  Malware Trends on Darknet Crypto-Markets: Research Review.  _SSRN Electronic Journal_ (2018).  https://doi.org/10.2139/ssrn.3226758
  * Caciuloiu et al. (2020) Alexandru Caciuloiu, Pawinee Parnitudom, Mikko Niemelä, Joshua James, Juha Nurmi, and Praphaphorn Tamarpirat. 2020.  Darknet cybercrime threats to Southeast Asia.  https://www.unodc.org/documents/southeastasiaandpacific//Publications/2021/Darknet_Cybercrime_Threats_to_Southeast_Asia_report.pdf
  * Campobasso and Allodi (2020) Michele Campobasso and Luca Allodi. 2020.  Impersonation-as-a-Service: Characterizing the Emerging Criminal Infrastructure for User Impersonation at Scale. In _CCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13, 2020_ , Jay Ligatti, Xinming Ou, Jonathan Katz, and Giovanni Vigna (Eds.). ACM, 1665–1680.  https://doi.org/10.1145/3372297.3417892
  * Campobasso and Allodi (2023) Michele Campobasso and Luca Allodi. 2023.  Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Scale. In _32nd USENIX Security Symposium_. USENIX Association.  https://atc.usenix.org/system/files/sec23fall-prepub-383-campobasso.pdf
  * Christin (2013) Nicolas Christin. 2013\.  Traveling the Silk Road: a measurement analysis of a large anonymous online marketplace. In _22nd International World Wide Web Conference, WWW ’13, Rio de Janeiro, Brazil, May 13-17, 2013_ , Daniel Schwabe, Virgílio A. F. Almeida, Hartmut Glaser, Ricardo Baeza-Yates, and Sue B. Moon (Eds.). International World Wide Web Conferences Steering Committee / ACM, 213–224.  https://doi.org/10.1145/2488388.2488408
  * Christodorescu et al. (2007) Mihai Christodorescu, Somesh Jha, and Christopher Kruegel. 2007\.  Mining specifications of malicious behavior. In _Proceedings of the 6th joint meeting of the European Software Engineering Conference and the ACM SIGSOFT International Symposium on Foundations of Software Engineering, 2007, Dubrovnik, Croatia, September 3-7, 2007_ , Ivica Crnkovic and Antonia Bertolino (Eds.). ACM, 5–14.  https://doi.org/10.1145/1287624.1287628
  * Christodorescu et al. (2005) Mihai Christodorescu, Somesh Jha, Sanjit A. Seshia, Dawn Xiaodong Song, and Randal E. Bryant. 2005.  Semantics-Aware Malware Detection. In _2005 IEEE Symposium on Security and Privacy (S &P 2005), 8-11 May 2005, Oakland, CA, USA_. IEEE Computer Society, 32–46.  https://doi.org/10.1109/SP.2005.20
  * Cohen (2020) Ben Cohen. 2020\.  Predator the Thief.  https://www.cyberark.com/resources/threat-research-blog/predator-the-thief
  * Collier et al. (2020) Benjamin Collier, Richard Clayton, Alice Hutchings, and Daniel Thomas. 2020.  Cybercrime is (often) boring: maintaining the infrastructure of cybercrime economies. In _20th Annual Workshop on the Economics of Information Security, WEIS 2020, Virtual Event, 14-15 December, 2020_.  https://doi.org/10.17863/CAM.53769
  * Dolliver (2015) Diana S. Dolliver. 2015\.  Evaluating drug trafficking on the Tor Network: Silk Road 2, the sequel.  _International Journal of Drug Policy_ 26, 11 (Nov. 2015), 1113–1123.  https://doi.org/10.1016/j.drugpo.2015.01.008
  * Dolliver and Kenney (2016) Diana S. Dolliver and Jennifer L. Kenney. 2016.  Characteristics of Drug Vendors on the Tor Network: A Cryptomarket Comparison.  _Vict. Offenders_ 11, 4 (May 2016), 600–620.  https://doi.org/10.1080/15564886.2016.1173158
  * Dov Lerner (2022) Dov Lerner. 2022\.  Painless Steal: The Malware of Choice for Initial Access Brokers.  https://www.cybersixgill.com/blog/painlessstealinitialaccessbrokers/
  * Duncan (2022) Brad Duncan. 2022\.  Windows MetaStealer Malware.  https://isc.sans.edu/diary/Windows+MetaStealer+Malware/28522
  * Esparza (2019) Jose Miguel Esparza. 2019\.  Understanding the credential theft lifecycle.  _Computer Fraud & Security_ 2019, 2 (2019), 6–9.  https://doi.org/10.1016/S1361-3723(19)30018-1
  * Esullivan (2020) Esullivan. 2020\.  TAU-TIN - Kpot InfoStealer.  https://community.carbonblack.com/t5/Threat-Advisories-Documents/TAU-TIN-Kpot-InfoStealer/ta-p/88517
  * Fredrikson et al. (2010) Matt Fredrikson, Mihai Christodorescu, Jonathon T. Giffin, and Somesh Jha. 2010.  A Declarative Framework for Intrusion Analysis.  In _Cyber Situational Awareness - Issues and Research_ , Sushil Jajodia, Peng Liu, Vipin Swarup, and Cliff Wang (Eds.). Advances in Information Security, Vol. 46. Springer, 179–200.  https://doi.org/10.1007/978-1-4419-0140-8_9
  * Grégio et al. (2015) André Ricardo Abed Grégio, Vitor Monte Afonso, Dario Simões Fernandes Filho, Paulo Lício de Geus, and Mario Jino. 2015.  Toward a Taxonomy of Malware Behaviors.  _Comput. J._ 58, 10 (2015), 2758–2777.  https://doi.org/10.1093/comjnl/bxv047
  * Huang et al. (2018) Keman Huang, Michael D. Siegel, and Stuart E. Madnick. 2018\.  Systematically Understanding the Cyber Attack Business: A Survey.  _ACM Comput. Surv._ 51, 4 (2018), 70:1–70:36.  https://doi.org/10.1145/3199674
  * Kaczmarczyck et al. (2020) Fabian Kaczmarczyck, Bernhard Grill, Luca Invernizzi, Jennifer Pullman, Cecilia M. Procopiuc, David Tao, Borbala Benko, and Elie Bursztein. 2020.  Spotlight: Malware Lead Generation at Scale. In _ACSAC ’20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020_. ACM, 17–27.  https://doi.org/10.1145/3427228.3427273
  * Kelion (2012) Leo Kelion. 2012\.  Pastebin: Running the site where hackers publicise their attacks.  https://www.bbc.com/news/technology-17524822
  * Kolbitsch et al. (2009) Clemens Kolbitsch, Paolo Milani Comparetti, Christopher Kruegel, Engin Kirda, Xiao-yong Zhou, and XiaoFeng Wang. 2009.  Effective and Efficient Malware Detection at the End Host. In _18th USENIX Security Symposium, Montreal, Canada, August 10-14, 2009, Proceedings_ , Fabian Monrose (Ed.). USENIX Association, 351–366.  http://www.usenix.org/events/sec09/tech/full_papers/kolbitsch.pdf
  * Meland and Sindre (2019) Per Hå Meland and Guttorm Sindre. 2019.  Cyber Attacks for Sale. In _2019 International Conference on Computational Science and Computational Intelligence (CSCI)_. IEEE, 54–59.  https://doi.org/10.1109/csci49370.2019.00016
  * Mell et al. (2005) Peter Mell, Karen Kent, and Joseph Nusbaum. 2005.  _Guide to malware incident prevention and handling_.  National Institute of Standards and Technology.  https://doi.org/10.6028/NIST.SP.800-83
  * Motoyama et al. (2011) Marti Motoyama, Damon McCoy, Kirill Levchenko, Stefan Savage, and Geoffrey M. Voelker. 2011\.  An analysis of underground forums. In _Proceedings of the 11th ACM SIGCOMM Internet Measurement Conference, IMC ’11, Berlin, Germany, November 2-, 2011_ , Patrick Thiran and Walter Willinger (Eds.). ACM, 71–80.  https://doi.org/10.1145/2068816.2068824
  * Nurmi et al. (2017) Juha Nurmi, Teemu Kaskela, Jussi Perälä, and Atte Oksanen. 2017.  Seller’s reputation and capacity on the illicit drug markets: 11-month study on the Finnish version of the Silk Road.  _Drug and Alcohol Dependence_ 178 (Sept. 2017), 201–207.  https://doi.org/10.1016/j.drugalcdep.2017.05.018
  * Onaolapo et al. (2016) Jeremiah Onaolapo, Enrico Mariconti, and Gianluca Stringhini. 2016\.  What Happens After You Are Pwnd: Understanding the Use of Leaked Webmail Credentials in the Wild. In _Proceedings of the 2016 ACM on Internet Measurement Conference, IMC 2016, Santa Monica, CA, USA, November 14-16, 2016_ , Phillipa Gill, John S. Heidemann, John W. Byers, and Ramesh Govindan (Eds.). ACM, 65–79.  http://dl.acm.org/citation.cfm?id=2987475
  * Park et al. (2013) Young Hee Park, Douglas S. Reeves, and Mark Stamp. 2013\.  Deriving common malware behavior through graph clustering.  _Comput. Secur._ 39 (2013), 419–430.  https://doi.org/10.1016/j.cose.2013.09.006
  * Pastrana et al. (2018a) Sergio Pastrana, Alice Hutchings, Andrew Caines, and Paula Buttery. 2018a.  Characterizing Eve: Analysing Cybercrime Actors in a Large Underground Forum. In _Research in Attacks, Intrusions, and Defenses - 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings_ _(Lecture Notes in Computer Science, Vol. 11050)_ , Michael Bailey, Thorsten Holz, Manolis Stamatogiannakis, and Sotiris Ioannidis (Eds.). Springer, 207–227.  https://doi.org/10.1007/978-3-030-00470-5_10
  * Pastrana et al. (2018b) Sergio Pastrana, Daniel R. Thomas, Alice Hutchings, and Richard Clayton. 2018b.  CrimeBB: Enabling Cybercrime Research on Underground Forums at Scale. In _Proceedings of the 2018 World Wide Web Conference on World Wide Web, WWW 2018, Lyon, France, April 23-27, 2018_ , Pierre-Antoine Champin, Fabien Gandon, Mounia Lalmas, and Panagiotis G. Ipeirotis (Eds.). ACM, 1845–1854.  https://doi.org/10.1145/3178876.3186178
  * Pete et al. (2022) Ildiko Pete, Jack Hughes, Andrew Caines, Anh V. Vu, Harshad Gupta, Alice Hutchings, Ross J. Anderson, and Paula Buttery. 2022\.  PostCog: A tool for interdisciplinary research into underground forums at scale. In _IEEE European Symposium on Security and Privacy, EuroS &P 2022 - Workshops, Genoa, Italy, June 6-10, 2022_. IEEE, 93–104.  https://doi.org/10.1109/EuroSPW55150.2022.00016
  * Pete et al. (2020) Ildiko Pete, Jack Hughes, Yi Ting Chua, and Maria Bada. 2020\.  A Social Network Analysis and Comparison of Six Dark Web Forums. In _IEEE European Symposium on Security and Privacy Workshops, EuroS &P Workshops 2020, Genoa, Italy, September 7-11, 2020_. IEEE, 484–493.  https://doi.org/10.1109/EuroSPW51379.2020.00071
  * Schäfer et al. (2019) Matthias Schäfer, Markus Fuchs, Martin Strohmeier, Markus Engel, Marc Liechti, and Vincent Lenders. 2019.  BlackWidow: Monitoring the Dark Web for Cyber Security Information. In _11th International Conference on Cyber Conflict, CyCon 2019, Tallinn, Estonia, May 28-31, 2019_ , Tomás Minárik, Siim Alatalu, S. Biondi, M. Signoretti, I. Tolga, and G. Visky (Eds.). IEEE, 1–21.  https://doi.org/10.23919/CYCON.2019.8756845
  * Schneier (2021) Bruce Schneier. 2021\.  Adding a Russian Keyboard to Protect against Ransomware.  https://www.schneier.com/blog/archives/2021/05/adding-a-russian-keyboard-to-protect-against-ransomware.html
  * Souppaya and Scarfone (2013) Murugiah Souppaya and Karen Scarfone. 2013.  _Guide to malware incident prevention and handling for desktops and laptops_. Vol. 800.  National Institute of Standards and Technology. 83 pages.  https://doi.org/10.6028/NIST.SP.800-83r1
  * Stone-Gross et al. (2011) Brett Stone-Gross, Thorsten Holz, Gianluca Stringhini, and Giovanni Vigna. 2011.  The Underground Economy of Spam: A Botmaster’s Perspective of Coordinating Large-Scale Spam Campaigns. In _4th USENIX Workshop on Large-Scale Exploits and Emergent Threats, LEET ’11, Boston, MA, USA, March 29, 2011_ , Christopher Kruegel (Ed.). USENIX Association.  https://www.usenix.org/conference/leet11/underground-economy-spam-botmasters-perspective-coordinating-large-scale-spam
  * Thomas et al. (2015) Kurt Thomas, Danny Yuxing Huang, David Y. Wang, Elie Bursztein, Chris Grier, Tom Holt, Christopher Kruegel, Damon McCoy, Stefan Savage, and Giovanni Vigna. 2015\.  Framing Dependencies Introduced by Underground Commoditization. In _14th Annual Workshop on the Economics of Information Security, WEIS 2015, Delft, The Netherlands, 22-23 June, 2015_.  http://www.econinfosec.org/archive/weis2015/papers/WEIS_2015_thomas.pdf
  * Toulas (2022) Bill Toulas. 2022\.  New Meta information stealer distributed in malspam campaign.  (2022).  https://www.bleepingcomputer.com/news/security/new-meta-information-stealer-distributed-in-malspam-campaign/
  * Tran and Scholtes (2015) Emmie Tran and Ginny Scholtes. 2015.  Open data literature review.  _Barkeley School of Law, University of California_ (2015).  https://www.law.berkeley.edu/wp-content/uploads/2015/04/Final_OpenDataLitReview_2015-04-14_1.1.pdf
  * van Rijn (2021) H. W. J. van Rijn. 2021\.  _An In-depth Analysis of the AZORult Infostealer Malware Capabilities_.  Master’s thesis. Eindhoven University of Technology.  https://research.tue.nl/en/studentTheses/an-in-depth-analysis-of-the-azorult-infostealer-malware-capabilit
  * Vu et al. (2020) Anh V. Vu, Jack Hughes, Ildiko Pete, Ben Collier, Yi Ting Chua, Ilia Shumailov, and Alice Hutchings. 2020.  Turning Up the Dial: the Evolution of a Cybercrime Market Through Set-up, Stable, and Covid-19 Eras. In _IMC ’20: ACM Internet Measurement Conference, Virtual Event, USA, October 27-29, 2020_. ACM, 551–566.  https://doi.org/10.1145/3419394.3423636
  * Winston et al. (2013) William Winston, Robert E Stevens, Philip K Sherwood, and John Paul Dunn. 2013.  _Market analysis: Assessing your business opportunities_.  Routledge.  https://archive.org/details/marketanalysisas0000stev
  * Zheng et al. (2018) Muwei Zheng, Hannah Robbins, Zimo Chai, Prakash Thapa, and Tyler Moore. 2018.  Cybersecurity Research Datasets: Taxonomy and Empirical Analysis. In _11th USENIX Workshop on Cyber Security Experimentation and Test, CSET 2018, Baltimore, MD, USA, August 13, 2018_ , Christian S. Collberg and Peter A. H. Peterson (Eds.). USENIX Association.  https://www.usenix.org/conference/cset18/presentation/zheng


# Magnetic anisotropy of the van der Waals ferromagnet Cr2Ge2Te6 studied by
angular-dependent XMCD

M. Suzuki  Department of Physics, The University of Tokyo, Bunkyo-ku, Tokyo
113-0033, Japan  B. Gao  Rutgers Center for Emergent Materials and Department
of Physics and Astronomy, Rutgers University, Piscataway, New Jersey 08854,
USA  G. Shibata  Department of Physics, The University of Tokyo, Bunkyo-ku,
Tokyo 113-0033, Japan  Department of Applied Physics, Tokyo University of
Science, Katsushika-ku, Tokyo 125-8585, Japan  S. Sakamoto  Department of
Physics, The University of Tokyo, Bunkyo-ku, Tokyo 113-0033, Japan  Y. Nonaka
Department of Physics, The University of Tokyo, Bunkyo-ku, Tokyo 113-0033,
Japan  K. Ikeda  Department of Physics, The University of Tokyo, Bunkyo-ku,
Tokyo 113-0033, Japan  Z. Chi  Department of Physics, The University of Tokyo,
Bunkyo-ku, Tokyo 113-0033, Japan  Y.-X. Wan  Department of Physics, The
University of Tokyo, Bunkyo-ku, Tokyo 113-0033, Japan  T. Takeda  Department
of Electrical Engineering and Information Systems, The University of Tokyo,
Bunkyo-ku, Tokyo 113-8656, Japan  Y. Takeda  Materials Sciences Research
Center, Japan Atomic Energy Agency (JAEA), Sayo, Hyogo 679-5148, Japan  T.
Koide  Photon Factory, Institute of Materials Structure Science, High Energy
Accelerator Research Organization, Tsukuba, Ibaraki 305-0801, Japan  A. Tanaka
Department of Quantum Matter, ADSM, Hiroshima University, Higashi-hiroshima
739-8527, Japan  M. Kobayashi  Department of Electrical Engineering and
Information Systems, The University of Tokyo, Bunkyo-ku, Tokyo 113-8656, Japan
Center for Spintronics Research Network, The University of Tokyo, Bunkyo-ku,
Tokyo 113-0033, Japan  S.-W. Cheong  Rutgers Center for Emergent Materials and
Department of Physics and Astronomy, Rutgers University, Piscataway, New
Jersey 08854, USA  A. Fujimori  Department of Physics, The University of
Tokyo, Bunkyo-ku, Tokyo 113-0033, Japan  Materials Sciences Research Center,
Japan Atomic Energy Agency (JAEA), Sayo, Hyogo 679-5148, Japan  Department of
Applied Physics, Waseda University, Shinjuku-ku, Tokyo 169-8555, Japan

###### Abstract

The van der Waals ferromagnet Cr2Ge2Te6 (CGT) has a two-dimensional crystal
structure where each layer is stacked through van der Waals force. We have
investigated the nature of the ferromagnetism and the weak perpendicular
magnetic anisotropy (PMA) of CGT by means of X-ray absorption spectroscopy and
X-ray magnetic circular dichroism (XMCD) studies of CGT single crystals. The
XMCD spectra at the Cr $L_{2,3}$ edge for different magnetic field directions
were analyzed on the basis of the cluster-model multiplet calculation. The Cr
valence is confirmed to be 3+ and the orbital magnetic moment is found to be
nearly quenched, as expected for the high-spin $t_{2g}$3 configuration of the
Cr3+ ion. A large ($\sim 0.2$ eV) trigonal crystal-field splitting of the
$t_{2g}$ level caused by the distortion of the CrTe6 octahedron has been
revealed, while the single-ion anisotropy (SIA) of the Cr atom is found to
have a sign opposite to the observed PMA and too weak compared to the reported
anisotropy energy. The present result suggests that anisotropic exchange
coupling between the Cr atoms through the ligand Te $5p$ orbitals having
strong spin-orbit coupling has to be invoked to explain the weak PMA of CGT,
as in the case of the strong PMA of CrI3.

##  I Introduction

The discovery of graphene has invoked renewed interest in the studies on two-
dimensional (2D) materials including layered transition-metal chalcogenides
graphene_first ; review_2 ; review_3 ; TMD_review . The 2D materials show
various fascinating properties that may lead to applications for new
spintronics devices. In addition, the relation between dimensionality and
various physical properties has long been a major subject from a fundamental
point of view. For instance, the Mermin-Wagner theorem states that a long-
range magnetic order in the 2D isotropic Heisenberg model cannot be realized
at finite temperature due to long-range magnetic fluctuations Mermin .
Recently, van der Waals (vdW) ferromagnets, which have 2D crystal structures
but show ferromagnetic order vdWFerro_review , such as Cr2Ge2Te6 (CGT)
CGT_oldcalc_prop ; CGT_oldcalc_2 ; CGT_tricritical_exp ; CGT_aniso_exp ;
CGT_MH_MT ; CGT_bilayer ; CGT_hydropressure ; CGT_thinfilm_mag ; ARPES1 ;
ARPES2 ; EM_19_Kang  and CrI3 CrI3_mono ; CrI3_giant  have attracted great
interest. Although the magnetism of a few to several-monolayer CGT shows soft
behaviors well described by the 2D Heisenberg model CGT_bilayer , the finite
Curie temperature of 61 K CGT_aniso_exp ; CGT_oldcalc_prop ;
CGT_tricritical_exp  and the easy magnetization axis along the $c$-axis (out-
of-plane) direction CGT_aniso_exp ; CGT_oldcalc_prop ; CGT_MH_MT  indicate a
finite perpendicular magnetic anisotropy (PMA) and hence a departure from the
2D Heisenberg model. On the other hand, CrI3 exhibits ferromagnetism down to
monolayer thickness, which suggests a stronger PMA than CGT and is well
described by the 2D Ising model CrI3_mono .

The magnetic anisotropy of a 2D ferromagnet arises primarily from (i) the
single-ion anisotropy (SIA) of the magnetic ion and (ii) anisotropic exchange
interaction between the magnetic ions in the 2D layer. The SIA of the Cr-based
vdW ferromagnets is considered to be small because of the $t_{2g\uparrow}$3
configuration of the Cr3+ ion, which has no orbital degree of freedom, as
discussed, e.g., by Lado and Fernández-Rossi CrI3_aniso_calc . On the
contrary, first-principles estimates of exchange coupling by Xu et al. CrI3
Kitaev vs SIA  have shown that the SIA and Kitaev-type anisotropic magnetic
coupling in the Cr-based vdW ferromagnets are of comparable magnitudes and
compete with each other. Furthermore, Kim et al. PRL_19_Kim  have performed
multi-site cluster-model multiplet calculation and attributed the strong PMA
of CrI3 to anisotropic exchange coupling between Cr atoms through the iodine
$5p$ ligand orbitals, which has strong spin-orbit coupling (SOC). In fact,
X-ray magnetic circular dichroism (XMCD) measurements at the iodine $L_{1}$
edge of CrI3 have revealed a finite orbital magnetic moment of the I $5p$
electrons, implying the importance of the ligand $p$ orbitals in the PMA of
the vdW ferromagnets Choi I XMCD . As for CGT, which shows a weaker PMA than
CrI3, the situation is complicated and it is far from clear which of the SIA
or the anisotropic exchange is responsible for the PMA PRL_19_Kim ;
PCCP_19_Wang .

In order to evaluate the contribution of the SIA of Cr to the magnetic
anisotropy, XMCD studies at the Cr $L_{2,3}$ edge are expected to give
essential information. So far Cr $L_{2,3}$-edge XMCD has been reported for CGT
Fumega XMCD  and CrI3 Frisk_XMCD  with line-shape analysis using cluster-model
calculation, but no information about the contributions of the Cr $3d$
electrons to the PMA has been explored. In the present work, we have carried
out Cr $L_{2,3}$-edge XMCD measurements of CGT single crystal under magnetic
fields applied to different crystallographic directions and subsequent
cluster-model multiplet calculation to estimate the SIA energy of the Cr atom
centered in the CrTe6 octahedron.

##  II methods

Single crystals of CGT were synthesized using a flux method. High purity Cr,
Ge and Te powders were mixed in a molar ratio of 2:6:36; the extra Ge and Te
were used as a flux. The mixture was loaded in an alumina crucible and sealed
in an evacuated quartz tube. A ball of alumina fiber was placed on top of the
crucible. The quartz tube was placed in a furnace, heated to 700 ∘C, held for
5 hours, and then slowly cooled down to 480 ∘C over a period of 3 days. This
was followed by centrifugation to remove the flux.

X-ray absorption spectroscopy (XAS) and XMCD measurements at the Cr $L_{2,3}$
edge were performed at beam line BL23SU of SPring-8 and beam line BL-16A of
Photon Factory at High Energy Accelerator Research Organization (KEK-PF). The
measurement at SPring-8 was performed under a magnetic field of $\mu_{0}H=3$ T
parallel to the $c$-axis of the sample. The XAS and XMCD spectra were recorded
in the total electron yield mode. Right- ($\sigma^{+}$) and left
($\sigma^{-}$) circularly polarized x-rays were switched at a frequency of 1
Hz in order to eliminate time-dependent background from the obtained XMCD
spectra. The sample temperature ($T$) during the measurement was set to 20 K,
well below the Curie temperature. The sample was cleaved in the vacuum chamber
prior to the measurements to obtain fresh surfaces. Magnetic-field-direction
dependence of XMCD spectra was measured at the BL-16A of KEK-PF. Polarization
switching was made at a frequency of 10 Hz. Magnetic field of $\mu_{0}H=1$ T
was applied parallel and perpendicular to the $c$-axis. Signals were recorded
in the total electron-yield mode.

To investigate the electronic structure which contributes to the
ferromagnetism, configuration-interaction cluster-model multiplet calculations
have been conducted. Figure 1(a) shows the crystal structure of CGT. Each Cr
atom is surrounded by six Te atoms, forming a CrTe6 cluster. It constitutes
the CrGeTe3 layer, which are stacked through vdW force. The CrTe6 cluster is
slightly elongated along the $c$-axis CGT_oldcalc_prop , as shown in Fig.
1(b), which means that the Cr electrons are under a nearly octahedral,
trigonally distorted crystal field. The following parameters of the cluster
model are used to reproduce the experimental XMCD spectra: the Cr 3$d$-3$d$
Coulomb energy $U_{dd}$, the Cr 2$p$-3$d$ Coulomb energy $U_{pd}\approx
1.2U_{dd}$, the charge-transfer energy $\Delta$ from the Te 5$p$ to Cr 3$d$
levels, the Slater-Koster parameter ($pd\sigma$) between the Cr 3$d$ and Te
5$p$ orbitals, the crystal-field splitting 10$Dq$ ($\approx 0.7$ eV) between
the Cr $e_{g}$ and $t_{2g}$ levels (apart from the $p$-$d$ covalency
contribution), and the trigonal crystal-field splitting $Dt$ between the
$a_{1g}$ and $e^{\pi}_{g}$ orbitals. [For the definition of 10$Dq$ and $Dt$,
see Fig. 1(c).] As for the parameter values, we follow the empirical
relationship fujimori_para  and employ $\Delta=4.5$ eV, $U_{dd}=6.0$ eV, and
$(pd\sigma)=2.6$ eV as being relevant to Cr3+ tellurides. The SOC parameter of
the Cr $3d$ orbital is taken to be 35 meV.

##  III results and discussion

Figure 2 shows Cr $L_{2,3}$-edge XAS and XMCD spectra of CGT under the out-of-
plane magnetic field of $\mu_{0}H=$ 3 T at $T$ = 20 K. The applied magnetic
field was high enough to saturate the magnetization of CGT because the
magnetization saturates below $\sim 0.5$ T CGT_tricritical_exp . The tail of
the Te $M_{4,5}$ XAS peak overlapping the Cr $L_{2,3}$ XAS spectrum has been
subtracted assuming a hyperbola. Arctangent steps at the $L_{2}$ and $L_{3}$
edges have also been subtracted from the Cr $L_{2,3}$ XAS as usual. On the
other hand, the XMCD signals predominantly come from the magnetic Cr atoms,
and there is no need to subtract signals from the Te atoms.

Figure 3 shows comparison of the measured Cr $L_{2,3}$ XMCD spectrum with
those calculated using the cluster model assuming the Cr valences of 4+, 3+,
2+ high-spin states, and 2+ low-spin states. The experimental spectrum shows
three negative peaks and one positive peak at the $L_{3}$ edge, and one
negative peak and two positive peaks at the $L_{2}$ edge. The comparison shows
that the calculation for the Cr3+ state reproduces the experimental spectrum
better than those for the Cr2+ and Cr4+ states. Thus, one can conclude that
the Cr atom in CGT is in the $3+$ state (with the high-spin $t_{2g}^{3}$
configuration), and not in the $2+$ nor $4+$ state.

###  III.1 Spin and orbital magnetic moments

The orbital and effective spin magnetic moments are quantitatively estimated
from the XAS and XMCD spectra using the XMCD sum rules Carra ; Thole . For the
$L_{2,3}$ edge ($2p\rm\rightarrow 3d$ transition), the sum rules are given by:

$\displaystyle m_{\rm orb}$ $\displaystyle=$ $\displaystyle-\frac{4n_{\rm
h}}{3}\frac{\int_{L_{3}+L_{2}}(\mu_{+}-\mu_{-})d\omega}{\int_{L_{3}+L_{2}}(\mu_{+}+\mu_{-})d\omega},$
$\displaystyle m_{\rm spin}^{\rm eff}$ $\displaystyle=$ $\displaystyle m_{\rm
spin}+7m_{\rm T}$ $\displaystyle=$ $\displaystyle-{2n_{\rm
h}}\frac{\int_{L_{3}}(\mu_{+}-\mu_{-})d\omega-2\int_{L_{2}}(\mu_{+}-\mu_{-})d\omega}{\int_{L_{3}+L_{2}}(\mu_{+}+\mu_{-})d\omega},$

where $\mu_{+}$ ($\mu_{-}$) is an XAS spectrum taken with $\sigma^{+}$
($\sigma^{-}$), $m_{\rm orb}$, $m_{\rm spin}$ and $m_{\rm T}$ are the orbital
magnetic moment, spin magnetic moment, and magnetic dipole moment,
respectively, in units of Bohr magneton $\mu_{\rm B}$/Cr atom. $\mu_{+}$
($\mu_{-}$) stands for the absorption coefficient for photon helicity parallel
(antiparallel) to the Cr majority spin direction. $n_{h}$ is the number of
holes in the valence shell. By applying the sum rules to the spectra in Fig.
2, the orbital magnetic moment of $m_{\rm orb}=0.00\pm 0.05$ $\mu_{\rm B}$/Cr
atoms has been obtained, consistent with the quenched orbital magnetic moment
in the $d^{3}$ configuration of Cr3+. The effective spin magnetic moment of
$m_{\rm spin}^{\rm eff}\equiv m_{\rm spin}+7m_{\rm T}=2.2\pm 0.1$ $\mu_{\rm
B}$/Cr atom has been obtained, where the $m_{\rm spin}$ and $m_{\rm T}$ are
the spin magnetic moment and the magnetic dipole moment, respectively. In a
high-symmetry environment of the Cr atom as in CGT, $m_{\rm T}$ is negligibly
small compared to $m_{\rm spin}$ dipole_1 ; dipole_2 . Therefore, since
$m_{\rm orb}$ is nearly zero, we regard $m_{\rm spin}^{\rm eff}$ as the total
magnetic moment $m_{\rm spin}$. The value $m_{\rm spin}\sim m_{\rm spin}^{\rm
eff}=2.2\pm 0.1\mu_{\rm B}$ is consistent with that of the reported saturation
magnetization of CGT, 2.2 - 2.9 $\mu_{\rm B}$/Cr atom CGT_MH_MT ;
CGT_aniso_exp ; CGT_oldcalc_prop .

###  III.2 Crystal-field splitting

In order to study the anisotropies of the electronic and magnetic properties
of CGT, XMCD measurements under different magnetic field directions have been
made. Figure 4 shows the Cr $L_{2,3}$ XAS and XMCD spectra taken with magnetic
fields applied to the out-of-plane ($H\parallel c$-axis) and in-plane
($H\parallel ab$-plane) directions. The XMCD spectra show small but clear
differences between the different magnetic-field directions, while the
spectral line shapes of the XAS spectra are relatively insensitive to the
field direction. To identify the origin of the spectral differences between
the different field directions, cluster-model multiplet calculations have been
conducted assuming the Cr valence to be 3+. The effects of the elongation of
the CrTe6 octahedron along the $c$-axis CGT_oldcalc_prop  are taken into
account as a trigonal crystal-field splitting $Dt$ of the $t_{2g}$ level as
shown in Fig. 1(c), where the triply-degenerate $t_{2g}$ level is split into
the non-degenerate $a_{1g}$ and doubly-degenerate $e^{\pi}_{g}$ levels. Here,
for a positive (negative) trigonal crystal field $Dt$, the $a_{1g}$ level is
located above (below) the $e^{\pi}_{g}$ level. Figures 5(b) and (c) show the
calculated spectra without and with the trigonal crystal field, respectively,
compared with experiment [Fig. 5(a)]. Without the trigonal crystal field,
i.e., $Dt=0$ [Fig. 5(b)], there is no difference in the XMCD spectra between
the out-of-plain and in-plane magnetic fields. On the other hand, the
calculated XMCD spectra under the trigonal crystal field $Dt$ of 0.2 eV show
finite differences between the out-of-plain and in-plane magnetic fields, as
shown in Fig. 5(c), and well explain the experiment [Fig. 5(a)]. Thus we
conclude that the differences in the XMCD spectra taken with the different
magnetic-field directions are attributed to the elongation of the CrTe6
octahedron along the $c$-axis.

###  III.3 Magnetic anisotropy energies

To evaluate the SIA of the Cr ion, the ground-state energy of the cluster is
calculated using the cluster model for the different magnetic field
directions. Thus we find that the energy for the in-plane magnetic field is
lower than the energy for the out-of-plane magnetic field by $\sim 5\times
10^{-6}$ eV/Cr atom, that is, the Cr atom has the easy magnetization axis in
the $ab$-plane. This is opposite to the observed PMA of CGT and furthermore
its magnitude is 1-2 orders of magnitude smaller than the experimental value
of $\sim 1-4\times 10^{-5}$ eV/Cr atom CGT_aniso_exp ; CGT_bilayer  as well as
the first-principles-theoretical value of SIA, $\sim 3\times 10^{-4}$ eV/Cr
atom EM_19_Kang . The present result, on the other hand, agrees with the
first-principles calculation by Wang et al. PCCP_19_Wang  in that the SIA of
Cr is weak and acts against PMA.

In spite of the large trigonal crystal field $Dt\sim 0.2$ eV and the resulting
anisotropy in the XMCD spectra, the calculated magnetic anisotropy energy is
small because of the high-spin $t_{2g}^{3}$ configuration, which has no
orbital degree of freedom. Therefore, we consider that effects beyond the SIA
evaluated using the cluster model, where only the spin-orbit coupling of the
Co $3d$ electrons are taken into account, may play important roles in
realizing the PMA of CGT. Such effects would include anisotropic exchange
coupling between Cr ions through the ligand Te $5p$ electrons with strong SOC,
in analogy to CrI3. In the case of CrI3, which has a stronger PMA than CGT,
density functional theory (DFT) calculation CrI3_structure_info ;
CrI3_aniso_calc  and multi-Cr site cluster-model multiplet calculation
PRL_19_Kim  have clearly shown that exchange coupling between Cr ions through
I $5p$ orbitals explains the stronger PMA of CrI3.

In addition to the SIA of Cr and anisotropic exchange between Cr discussed
above, the magnetic anisotropy of the Te $5p$ electrons themselves may
contribute to the magnetic anisotropy of CGT PCCP_19_Wang . Such an anisotropy
could arise because the Te $5p$ electrons are partially spin-polarized due to
hybridization with the Cr $3d$ electrons, in analogy to the magnetic
anisotropy of the Pt $5d$ electrons in $L1_{0}$-type FePt FePt_Solovyev ;
FePt_Ikeda . In order to address this issue, further theoretical and
experimental (XMCD at the Te absorption edges) studies would be necessary.

##  IV conclusion

We have performed XAS and XMCD measurements at the Cr $L_{2,3}$ edge and
subsequent cluster-model calculation on CGT to investigate the electronic
structure which contributes to the ferromagnetism and magnetic anisotropy. The
effective spin magnetic moment obtained using the sum rules is 2.2
$\rm\mu_{B}$, consistent with previous reports, while the orbital magnetic
moment is nearly zero. Subtle changes of the XMCD spectra are observed by
changing the magnetic field direction, and are attributed to the distortion of
the CrTe6 octahedron from comparison with cluster-model calculation including
the trigonal crystal field of the cluster elongated along the $c$ axis. The
magnetic anisotropy energy calculated using the cluster model is too small and
has an opposite sign compared to experiment. This implies that the magnetic
anisotropy of CGT cannot be explained by the SIA of Cr described by the
cluster model, and that one has to take into account interaction between Cr
atoms through Te $5p$ ligands which have strong SOC.

###### Acknowledgements.

We would like to thank I. Solovyev, D. Khomskii, S. Streltsov, and K. Kugel
for enlightening discussion, and M. Suzuki-Sakamaki and K. Amemiya for
valuable technical support at KEK-PF. This work was supported by a Grant-in-
Aid for Scientific Research from JSPS (grant Nos. 15H02109 and and 19K03741),
by Center for Spintronics Research Network (CSRN), the University of Tokyo,
under Spintronics Research Network of Japan (Spin-RNJ), and by the Shared Use
Program of Japan Atomic Energy Agency (JAEA) Facilities (Proposal No.
2018A-E24) supported by JAEA Advanced Characterization Nanotechnology Platform
as a program of ”Nanotechnology Platform” of MEXT (Proposal No. A-18-AE-0019).
The synchrotron experiment at KEK-PF was done under the approval of the
Program Advisory Committee (Proposal Nos. 2016S2-005), and the experiment at
SPring-8 was done at the JAEA beam line BL23SU (Proposal Nos. 2018A3841). The
work at Rutgers University was funded by the Gordon and Betty Moore
Foundation’s EPiQS Initiative through Grant GBMF4413 to the Rutgers Center for
Emergent Materials.

## References

  * (1) K. Novoselov, A. Geim, S. Morozov, D. Jiang, Y. Zhang, S. Dubonos, I. Grigorieva, and A. Firsov, Science 306, 666 (2004).
  * (2) S. Z. Butler, S. M. Hollen, L. Cao, Y. Cui, J. A. Gupta, H. R. Gutierrez, T. F. Heinz, S. S. Hong, J. Huang, A. F. Ismach, E. Johnston-Halperin, M. Kuno, V. V. Plashnitsa, R. D. Robinson, R. S. Ruo, S. Salahuddin, J. Shan, L. Shi, M. G. Spencer, M. Terrones, W. Windl, and J. E. Goldberger, Progress, challenges, and opportunities in two-dimensional materials beyond graphene, ACS Nano 7, 2898 (2013).
  * (3) M. Chhowalla, H. S. Shin, G. Eda, L.-J. Li, K. P. Loh, and H. Zhang, The chemistry of two-dimensional layered transition metal dichalcogenide nanosheets, Nat. Chem. 5, 263 (2013)
  * (4) Q. H. Wang, K. Kalantar-Zadeh, A. Kis, J. N. Coleman, and M. S. Strano, Electronics and optoelectronics of two-dimensional transition metal dichalcogenides, Nat. Nanotechnol. 7, 699 (2012).
  * (5) N. D. Mermin and H. Wagner, Absence of ferromagnetism or antiferromagnetism in one- or two-dimensional isotropic Heisenberg models, Phys. Rev. Lett. 17, 1133 (1966).
  * (6) C. Gong and X. Zhang, Two-dimensional magnetic crystals and emergent heterostructure devices, Science 363, 706 (2019).
  * (7) V. Carteaux, D. Brunet, G. Ouvrard, and G. Andre, Crystallographic, magnetic and electronic structures of a new layered ferromagnetic compound Cr2Ge2Te6, J. Phys. Condens. Matter 7, 69 (1995).
  * (8) B. Siberchicot, S. Jobic, V. Carteaux, P. Gressier, and G. Ouvrard, Band structure calculations of ferromagnetic chromium tellurides CrSiTe3 and CrGeTe3, J. Phys. Chem. 100, 5863 (1996).
  * (9) H. Ji, R. A. Stokes, L. D. Alegria, E. C. Blomberg, M. A. Tanatar, A. Reijnders, L. M. Schoop, T. Liang, R. Prozorov, K. S. Burch, N. P. Ong, J. R. Petta, and R. J. Cava, A ferromagnetic insulating substrate for the epitaxial growth of topological insulators, J. Appl. Phys. 114, 114907 (2013).
  * (10) G. T. Lin, H. L. Zhuang, X. Luo, B. J. Liu, F. C. Chen, J. Yan, Y. Sun, J. Zhou, W. J. Lu, P. Tong, Z. G. Sheng, Z. Qu, W. H. Song, X. B. Zhu, and Y. P. Sun, Tricritical behavior of the two-dimensional intrinsically ferromagnetic semiconductor CrGeTe3, Phys. Rev. B 95, 245212 (2017).
  * (11) X. Zhang, Y. Zhao, Q. Song, S. Jia, J. Shi, and W. Han, Magnetic anisotropy of the single-crystalline ferromagnetic insulator Cr2Ge2Te6, Jpn. J. Appl. Phys. 55, 033001 (2016).
  * (12) C. Gong, L. Li, Z. Li, H. Ji, A. Stern, Y. Xia, T. Cao, W. Bao, C. Wang, Y. Wang, Z. Q. Qiu, R. J. Cava, S. G. Louie, J. Xia, and X. Zhang, Discovery of intrinsic ferromagnetism in two-dimensional van der Waals crystals, Nature 546, 265 (2017).
  * (13) Y. Sun, R. C. Xiao, G. T. Lin, R. R. Zhang, L. S. Ling, Z. W. Ma, X. Luo, W. J. Lu, Y. P. Sun, and Z. G. Sheng, Effects of hydrostatic pressure on spin-lattice coupling in two-dimensional ferromagnetic Cr2Ge2Te6, Appl. Phys. Lett. 112, 072409 (2018).
  * (14) M. Mogi, A. Tsukazaki, Y. Kaneko, R. Yoshimi, K. S. Takahashi, M. Kawasaki, and Y. Tokura, Ferromagnetic insulator Cr2Ge2Te6 thin films with perpendicular remanence, APL Mater. 6, 091104 (2018).
  * (15) M. Suzuki, B. Gao, K. Koshiishi, S. Nakata, K. Hagiwara, C. Lin, Y. X. Wan, H. Kumigashira, K. Ono, Sungmo Kang, Seungjin Kang, J. Yu, M. Kobayashi, S.-W. Cheong, and A. Fujimori, Coulomb-interaction effect on the two-dimensional electronic structure of the van derWaals ferromagnet Cr2Ge2Te6, Phys. Rev. B 99, 161401(R) (2019).
  * (16) J. Zhang, X. Cai, W. Xia, A. Liang, J. Huang, C. Wang, L. Yang, H. Yuan, Y. Chen, S. Zhang, Y. Guo, Z. Liu, and G. Li, Unveiling electronic correlation and the ferromagnetic superexchange mechanism in the van der Waals crystal CrSiTe3, Phys. Rev. Lett. 123, 047203 (2019).
  * (17) S. Kang, S. Kang, and J. Yu, Effect of coulomb interactions on the electronic and magnetic properties of two-dimensional CrSiTe3 and CrGeTe3 materials, J. Electronic Mater. 48, 1441 (2019).
  * (18) B. Huang, G. Clark, E. Navarro-Moratalla, D. R. Klein, R. Cheng, K. L. Seyler, D. Zhong, E. Schmidgall, M. A. McGuire, D. H. Cobden, W. Yao, D. Xiao, P. Jarillo-Herrero, and X. Xu, Layer-dependent ferromagnetism in a van der Waals crystal down to the monolayer limit, Nature 546, 270 (2017).
  * (19) T. Song, X. Cai, M. W.-Y. Tu, X. Zhang, B. Huang, N. P. Wilson, K. L. Seyler, L. Zhu, T. Taniguchi, K. Watanabe, M. A. McGuire, D. H. Cobden, D. Xiao, W. Yao, and X. Xu, Giant tunneling magnetoresistance in spin-filter van der Waals heterostructures, Science 360, 1214 (2018).
  * (20) J. L. Lado and J. Fernández-Rossier, On the origin of magnetic anisotropy in two dimensional CrI3, 2D Mater. 4, 035002 (2017).
  * (21) C. Xu, J. Feng, H. Xiang, and L. Bellaiche, Interplay between Kitaev interaction and single ion anisotropy in ferromagnetic CrI3 and CrGeTe3 monolayers, npj Comput. Mater. 4, 57 (2018). Toward intrinsic room-temperature ferromagnetism in two-dimensional semiconductors,
  * (22) D.-H. Kim, K. Kim, K.-T. Ko, J. H. Seo, J. S. Kim, T.-H. Jang, Y. Kim, J.-Y. Kim, S.-W. Cheong, and J. H. Park, Giant Magnetic anisotropy induced by ligand $LS$ coupling in layered Cr compounds, Phys. Rev. Lett. 122, 207201 (2019).
  * (23) K. Wang, S. Nikolaev, W. Ren, and I. Solovyev, Giant contribution of the ligand states to the magnetic properties of the Cr2Ge2Te6 monolayer, Phys. Chem. Chem. Phys. 21, 9597 (2019).
  * (24) Y. Choi, P. J. Ryan, D. Haskel, J. L. McChesney, G. Fabbris, M. A. McGuire, and J.-W. Kim, Iodine orbital moment and chromium anisotropy contributions to CrI3 magnetism, Appl. Phys. Lett. 117, 022411 (2020).
  * (25) A. O. Fumega, S. Blanco-Canosa, H. Babu-Vasili, P. Gargiani, H. Li, J.-S. Zhou, F. Rivadulla, and V. Pardo, Electronic structure and magnetic exchange interactions of Cr-based van der Waals ferromagnets. A comparative study between CrBr3 and Cr2Ge2Te6, J. Mater. Chem. C 8, 13582, (2020).
  * (26) A. Frisk, L. B. Duffy, S. Zhang, G. van der Laan, and T. Hesjedal, Magnetic x-ray spectroscopy of two-dimensional CrI3 layers, Mater. Lett. 232 5, (2018).
  * (27) A. E. Bocquet, T. Mizokawa, T. Saitoh, H. Namatame, and A. Fujimori, Electronic structure of $3d$-transition-metal compounds by analysis of the $2p$ core-level pbotoemission spectra, Phys. Rev. B 46, 3771 (1992).
  * (28) S. Seong, E. Lee, H. W. Kim, B. Min, S. Lee, J. Dho, Y. Kim, J.-Y. Kim, and J.-S. Kang, Experimental evidence for mixed-valent Cr ions in half-metallic CrO2: Temperature-dependent XMCD study, J. Magn. Magn. Mater. 452, 447 (2018).
  * (29) N. D. Telling, V. S. Coker, R. S. Cutting, G. van der Laan, C. I. Pearce, R. A. D. Pattrick, E. Arenholz, and J. R. Lloyd, Remediation of Cr(VI) by biogenic magnetic nanoparticles: An x-ray magnetic circular dichroism study, Appl. Phys. Lett. 95, 163701 (2009).
  * (30) P. Carra, B. T. Thole, M. Altarelli, and X. Wang, X-ray circular dichroism and local magnetic fields, Phys. Rev. Lett. 70, 694 (1993).
  * (31) B. T. Thole, P. Carra, and F. Sette, X-ray circular dichroism as a probe of orbital magnetization, Phys. Rev. Lett. 68, 1943 (1992).
  * (32) H. Ebert and G. Schutz, Spin-Orbit Influenced Spectroscopies of Magnetic Solids (Springer-Verlag, 1996).
  * (33) A. S. Schlachter and F. J. Wuilleumier, New Directions in Research with Third-Generation Soft X-ray Synchrotron Radiation Sources (NATO ASI Series 254, Kluwer, 1994).
  * (34) M. A. McGuire, H. Dixit, V. R. Cooper, and B. C. Sales, Coupling of crystal structure and magnetism in the layered, ferromagnetic insulator CrI3, Chem. Mater. 27, 612 (2015).
  * (35) I. V. Solovyev, P. H. Dederichs, and I. Mertig, Origin of orbital magnetization and magnetocrystalline anisotropy in $TX$ ordered alloys (where $T$ = Fe, Co and $X$ = Pd, Pt) Phys. Rev. B 52, 13419 (1995).
  * (36) K. Ikeda, T. Seki, G. Shibata, T. Kadono, K. Ishigami, Y. Takahashi, M. Horio, S. Sakamoto, Y. Nonaka, M. Sakamaki, K. Amemiya, N. Kawamura, M. Suzuki, K. Takanashi, and A. Fujimori, Magnetic anisotropy of $L1_{0}$-ordered FePt thin films studied by Fe and Pt $L_{2,3}$-edges x-ray magnetic circular dichroism Appl. Phys. Lett. 111, 142402 (2017).

Figure 1: Crystal structure of Cr2Ge2Te6 (CGT) (a) Schematic drawing of the
crystal structure. (b) CrTe6 octahedron which is elongated along the $c$-axis.
(c) Crystal-field splitting of the Cr 3$d$ orbital in the distorted octahedron
to trigonal symmetry. Figure 2:  Cr $L_{2,3}$ XAS and XMCD spectra of CGT at
$\mu_{0}H$ = 3 T and $T$ = 20 K. The red curve shows the average of XAS
spectra obtained with left- and right-circularly polarized x-rays. The green
curve shows the XMCD spectrum, which is the intensity difference between the
above two XAS spectra. The blue dotted curve shows the integral of the XMCD
spectrum. Magnetic field is applied perpendicular to the sample surface
($H\parallel c$-axis), that is, along the easy magnetization axis. Figure 3:
Experimental and calculated Cr $L_{2,3}$ XMCD spectra of CGT. The experimental
spectrum is the XMCD spectrum taken with magnetic field perpendicular to the
$ab$ plane. The orange, green, light-blue, and blue curves show XMCD spectra
calculated using the cluster model, assuming that the valence of Cr is 3+, 4+,
2+ high-spin (HS), and 2+ low-spin (LS) states, respectively.  Figure 4:
Experimental Cr $L_{2,3}$ XAS and XMCD spectra of CGT obtained with different
magnetic field directions. (a) Red and black curves show XAS spectra taken
with the out-of-plain and in-plane magnetic fields, respectively. (b) XMCD
spectra under out-of-plane and in-plane magnetic fields. Red and black spectra
show the out-of-plane and in-plane XMCD spectra, respectively. The strength of
the magnetic field was 1 T and the measurement temperature was 50 K. Figure 5:
Experimental and calculated Cr $L_{2,3}$ XMCD spectra of CGT for different
magnetic field directions. The red and black curves show XMCD spectra taken
under magnetic fields perpendicular (out-of-plane) and parallel (in-plane) to
the surface, respectively. Blue curves show the difference between the XMCD
spectra measured with different magnetic field directions. (a) Experimental
XMCD spectra. (b), (c) XMCD spectra obtained by cluster-model calculation with
and without the trigonal crystal field. $Dt$ denotes the trigonal-field
splitting. Clear differences in the line shapes the different magnetic field
directions are indicated by black arrows.