Cybercriminal Investments Go Legit — Sort Of

A recent Sophos X-Ops investigation reveals that cybercriminals are increasingly investing their illegal profits in real-world businesses — including coffee shops, construction firms, real estate, education, and even cybersecurity startups.

The research analyzed thousands of discussions on Russian- and English-language cybercrime forums, exposing how criminals launder cryptocurrency and reinvest funds through apparently legitimate ventures.

Key Findings

• Criminals often convert crypto assets into tangible investments such as gold, diamonds, or shell companies.

• Forum users exchange guides on money-laundering and investment strategies, even giving instructions on how to bury cash underground.

• Some are launching or funding cybersecurity companies, blurring the line between attackers and defenders.

• The trend indicates a move from “quick profit” cybercrime toward sustainable criminal entrepreneurship.