Software piracy as the initial link in cybercrime

1. The criminal-law relevance of "cracks": why the beginning of the chain matters

For many years, software piracy was understood in court primarily as a matter of intellectual property or economic harm: unpaid licenses, unfair competition, harm to the software industry. Empirical evidence from recent years shows that this reading is incomplete and, in some cases, clearly insufficient.

Global studies by organizations such as The Software Alliance (BSA), together with analytics firms such as IDC, estimate that a very significant share of the software installed on personal computers worldwide is unlicensed, and that organizations face a probability close to one in three of encountering malware when they obtain or install unlicensed software. Those same reports calculate that dealing with incidents associated with unlicensed software entails aggregate costs in the hundreds of billions of dollars per year for the private sector.

On the basis of these quantitative findings, specific research has been carried out on the link between piracy and malicious code. Studies commissioned by Microsoft in the Asia-Pacific region have shown that a relevant share of the sites hosting download links for pirated software systematically expose users to security risks, including downloads in which malicious programs have been inserted. More recent academic work, focused on Southeast Asian countries, has analyzed hundreds of pirated copies obtained both on physical media and through online downloads and has found infection rates in the order of 30 to 35 percent for certain families of malware, especially adware and trojans.

To this we can add analyses by the cybersecurity industry that describe specific campaigns in which the main lure for victims is the offer of free cracks or installers. Investigations by various firms, including Trend Micro, explain how criminal groups use platforms such as YouTube and search engines to distribute content that appears to offer cracked software. The links lead to hosting services where tampered installers are stored, which, instead of granting a free license, download and execute encrypted payloads intended to steal browser data and credentials for financial services, or to prepare the ground for subsequent ransomware attacks.

In addition, the distribution model over the internet makes the locus delicti inherently transnational: the server hosting the crack may be located in one country, the command and control infrastructure in another, the operators in a third and the victims spread across dozens of jurisdictions. In this context, limiting prosecution to only the "last link" in the chain (the ransomware that encrypted a hospital, the bank fraud already consummated) and disregarding the production and circulation of the cracks that enable these attacks is, in practice, equivalent to leaving one of the most important elements of the criminal chain without criminal prosecution.

The main international instruments to combat cybercrime have taken note of this reality. The Budapest Convention on Cybercrime was designed from the outset to harmonize national legislation on computer-related offenses, facilitate the investigation of these conducts and strengthen international cooperation, establishing among other mechanisms the obligation for each State Party to designate contact points available 24 hours a day to provide immediate assistance in investigations involving computer systems and electronic evidence.

More recently, the discussion and adoption of a global cybercrime convention within the framework of the United Nations has completed this picture with a treaty that seeks to close normative and procedural gaps, strengthening cooperation to investigate offenses such as ransomware, online fraud and other forms of cybercrime that cause losses of systemic magnitude.

2. Technical introduction for forensic experts: how to detect malware in pirated copies

The second part of this document is addressed in particular to computer forensics specialists and forensic experts. The aim is not to replace specialized technical manuals, but to offer a concise and accurate framework to guide malware detection when the object of analysis is a pirated copy or a crack.

2.1. Common infection patterns

Empirical studies already mentioned show that certain categories of malicious code predominate in the context of pirated software. Academic analyses describe a strong presence of adware and trojans, with infection rates around 34 to 35 percent in the samples analyzed. Industry experience confirms that cracks and fake installers usually incorporate remote access trojans (RATs), designed to allow the attacker to take control of the system; infostealers, intended to extract credentials, cookies, cryptocurrency wallets and other sensitive information; and loaders or droppers, which download new payloads in the background, including ransomware, from servers controlled by the attacker.

In the campaigns analyzed by different incident response teams, the typical flow consists of a user downloading what they believe to be an installer for legitimate or cracked software. When the user runs it, the program displays an interface that simulates an installation wizard, while in parallel it downloads an encrypted file from a hosting service that, once decrypted, installs a credential stealer and opens the door to future intrusions.

2.2. Integrity verification against the legitimate version

A first level of analysis, particularly useful in forensic work, consists of comparing the suspicious sample with a verifiable legitimate copy of the same software. The usual practice in secure software management is for vendors to publish cryptographic hashes (for example, SHA-256) of their installers and to sign them digitally. This allows users to verify that the downloaded file has not been modified.

2.3. Static analysis: what can be seen without running the program

Static analysis involves examining the file without executing it, which is crucial to preserve evidence and avoid damage to production systems. Reverse-engineering manuals and malware analysis guides describe as typical steps the use of tools to inspect the executable header (in Windows, the PE format), the file sections, imported libraries and readable text strings.

In practice, a basic static analysis will usually include:

• The use of antivirus scanners and multi-engine services to identify known detections and classify the sample within already documented malware families
• Extracting strings from the executable in order to locate suspicious file paths, API names related to networking, registry access or code injection, and potential command and control URLs or IP addresses
• Inspecting the PE header and file sections to detect unusual structures, sections with both execute and write permissions, or evidence of packers and obfuscators commonly used to conceal malicious code

A specific technique that helps locate relevant lines of code is to start from these strings and use the cross-reference (XREF) function provided by most disassemblers. Starting from a URL or domain name found in the strings, the expert can navigate to the functions that reference that text and observe which calls the code makes immediately before and after it. If sequences of calls to networking APIs, cryptographic functions or disk-write routines appear around that reference, this is an indication that this code block participates in communication with the attacker's server or in data exfiltration.

Similarly, it is advisable to pay attention to sequences of instructions that operate on large memory buffers, repeated inside loops, with simple patterns of arithmetic or logical operations, such as additions, subtractions or XOR operations on each byte. These structures usually correspond to decryption routines: the crack may contain an encrypted payload that is only decrypted in memory at run time. Locating this routine and marking the instructions that compose it makes it possible to identify the point at which the malicious code ceases to be encrypted and begins to execute in clear form.

Another relevant indicator is the presence of chained calls to memory allocation and thread creation functions, typically used in code injection techniques into other processes. When the disassembly shows sequences combining memory reservations, such as calls to memory allocation or mapping APIs, writes into that memory and the creation of new threads, in many cases the expert is looking at a code fragment whose purpose is to introduce and execute a second payload in a different process.

When text strings are very scarce, sections appear compressed or encrypted and the overall file structure is unusual, this is often an indication that the crack incorporates packing techniques that require taking an additional step and moving on to dynamic analysis. In such cases, it is preferable to carefully document the anomalous sections, the imports and any small recognizable code fragment, so that they can later be correlated with the behavior observed at run time.

2.4. Controlled dynamic analysis: observing behavior

Dynamic analysis involves executing the sample in a controlled environment, typically a virtual machine or an isolated sandbox, in order to observe its behavior in real time. Guidance from bodies such as NIST on incident handling recommends these approaches to understand the scope of a malware incident, including logging created files, system changes, processes started and generated network traffic.

Detailed documentation of these behaviors —including dates, times, IP addresses, domains and process names— turns the "simple" crack into a structured evidentiary object that makes it possible to link pirated software in technical terms to a specific malware family and a defined criminal infrastructure.

3. Origin of the attack, transnational reach and reference examples

Once the presence of malware in the pirated copy has been established, the forensic and judicial focus shifts to attribution: where the attack comes from, what its reach is and what type of actor is behind it.

Technical literature on threat intelligence describes attribution as a process that combines technical elements, such as malware samples, domains, IP addresses and certificates, observed tactics, techniques and procedures, and contextual factors, such as the language of messages, compilation time zones and victim selection. From a forensic perspective, it will not always be possible to identify a criminal group by name, but it is possible to advance through several levels of determination.

This multi-level approach enables magistrates and forensic experts to build a solid technical and legal narrative that links pirated software to organized criminal structures, facilitating international cooperation and the effective fight against cybercrime from its origin.