Cybersecurity firm Kaspersky noted recently that there was a significant increase in the number of résumés and jobs that had been posted on so-called underground forums in Q1 2024 when compared to Q1 2023, and this figure reportedly remained on the same level in Q1 of this year. Kaspersky also mentioned that this year, résumés outnumber vacancies “55% to 45%, driven by global layoffs and an influx of younger candidates.” And the age distribution among the candidates shows a median seeker age of “just 24, with a marked teenager presence.”
Jobs found on the dark web are predominantly “related to cybercrime or other illegal activities, although some legitimate positions are present as well.”
Kaspersky findings show a shadow economy where 69% of job seekers did not specify a preferred field, openly “signaling they’d take any paid opportunity – from programming to running scams or high-stakes cyber operations.”
The most in-demand IT roles posted by employers on the dark web reflect a mature criminal ecosystem:
- developers (accounted for 17% of vacancies) create attack tools;
- penetration testers (12%) probe networks for weaknesses;
- money launderers (11%) clean illicit funds through layered transactions;
- carders (6%) steal and monetize payment data;
- traffers (5%) drive victims to phishing sites or infected downloads.
Gender-specific patterns emerged in “specialized applications.”
Female applicants mainly sought “interpersonal roles, including support, call-center, and technical-assistance positions.”
Male applicants, by contrast, more frequently targeted “technical and financial-crime roles – developers, money mules, or mule handlers.”
Salary expectations varied “sharply by specialization.”
Reverse engineers commanded the highest compensation, averaging over $5,000 monthly, followed “by penetration testers at $4,000 monthly and developers at $2,000. Fraudsters tended to receive a fixed percentage of a team’s income.”
Money launderers average 20%, while carders and traffers “earn approximately 30% and 50% of the full income, respectively”. These figures reflect a premium on “scarce, high-impact skills within the shadow ecosystem.”
Alexandra Fedosimova, Digital Footprint Analyst at Kaspersky said:
“The shadow job market is no longer peripheral; it’s absorbing the unemployed, the underage, and the overqualified. Many arrive thinking that the dark web and the legal market are fundamentally alike, rewarding proven skills over diplomas, with the dark web even offering some benefits – like offers landing within 48 hours and no HR interviews. However, not many realize that working on the dark web can lead to prison.”
Young individuals contemplating dark web employment need to recognize that short-term earnings carry “irreversible legal and reputational consequences.”
Parents, educators, and the community are urged “to report suspicious online solicitations immediately.”
Children should be shown that there are “multiple skill-building and career pathways in legit tech sectors, such as cybersecurity.”
The analysis has reportedly been based on “2,225 job-related posts – vacancies and resumes – published on dark web forums between Jan 2023 and June 2025.”
As clarified in the update from Kaspersky, some of the forums and resources reviewed “may no longer be accessible at the time of publication.”
Kaspersky Digital Footprint Intelligence is a described as an effective digital risk protection service that helps customers “to monitor their digital assets and detect threats from Surface, Deep and Dark web.”
With “real-time” alerts Kaspersky Digital Footprint Intelligence now “enables organizations to respond to potential threats.”
Analytical reports aim to complement these data with “finished” intelligence from their experts providing insights into cyber security risks as well as some practical recommendations on how to address / mitigate them.