Ethereum is a digital asset whose transactions are kept on a decentralized, globally accessible ledger. An Ethereum Blockchain owner's real identity is concealed behind a pseudonym termed an address. Because of this, Ethereum is frequently used in illegal activities like gambling and ransomware attacks because it is popularly believed to offer the highest level of anonymity. As a result, it is necessary to categorize the various malicious cybercriminal users' activities and addresses in the Ethereum Blockchain. The Blockchain's public data enables an in-depth analysis. Using supervised machine learning models including linear, non-linear, and ensemble learning models based on malicious and non-malicious activities, the classification of Ethereum Blockchain addresses is carried out in this paper. In this research work, cross-validation accuracy, recall, precision, and f1-score have been employed for the assessment. Findings indicate that linear and non-linear machine learning approaches are superior to ensemble learning for classifying Ethereum Blockchain addresses. The results also show that it is possible to discover the Ethereum Blockchain addresses of malicious users.
Lars Hornuf, Paul P. Momtaz, Rachel J. Nam, Ye Yuan
We examine how cybercrime impacts victimsâ risk-taking and returns. Our difference-indifferences analysis of a sample of victims and matched non-victims is in line with prospect theory and suggests that victims increase their long-term total risk-taking after losing part of their wealth. Victims also earn lower risk-adjusted returns in the post-cybercrime period. Victimsâ long-term total risk-taking increases because they increase diversifiable risk in the long term. The increased diversifiable risk correlates with victimsâ withdrawal from altcoins after cybercrime. At the same time, the reduction in risk-adjusted returns correlates with increased trading activity and churn, due plausibly to managing cybercrime exposure. In the cross-section of Ethereum addresses, we show that the most affluent victims take a systematic approach to restore their pre-cybercrime wealth level, while the least affluent victims turn into gamblers. Finally, a parsimonious forensic model explains a good part of the addressesâ probability of being involved in cybercrime, on both the victim and the cybercriminal side.
Mohammad Khalid Khawrin, Nooman Zadran, Ahmad Helal
The world is on the brink of rewriting business and monitoring history. It is very crucial to mention academically how Afghan crypto-monitory transactions are taking place. even though it is a soft threat to official government organizations via tax evasion, money laundering, and terrorism financing. The qualitative method with content analysis was applied because the data was in textual form. The data was analyzed through Atlis.ti 9. First of all, the interviews were coded, and then themes were created. The result showed that Bitcoin and Binance had the most users, and there were six types of cryptocurrencies in Afghanistan. Furthermore, the advantages and disadvantages were highlighted. Lastly, it was highly suggested that the Afghan government have specific laws for general protection and to gain the benefits of the new world of high technology.
Decentralized finance (DeFi) has exploded in popularity with a billion-dollar market cap. While uncollateralized lending, known as a flash loan, emerged from DeFi, it has become a primary tool used by attackers to drain investment tokens from DeFi networks. The existing countermeasures seem practical, but no comprehensive quantitative analysis framework was available to test them. This paper proposes the Flash loan Attack Analysis (FAA) framework, which aids security practitioners in understanding the DeFi systemâs effects on preventative methods when various factors change. The quantitative predictions can help security professionals in identifying hidden dangers and more efficiently adopting countermeasure strategies. The simulation predicts that the existing strategy, fair reserves, can fully protect the platform in a typical market environment; however, in a highly volatile market where the token price drops by 60% in a single hour, it will be broken, causing more than $8 million in damage.
Blockchain technology has created a new cryptocurrency world and attracted a lot of attention. It also attracts scams, for example, phishing scam, a typical fraud, has been found making a notable amount of money in the blockchain ecosystem, which has a very negative impact. Considering the whole life cycle of a phishing scam, this paper proposes the concept of a phishing gang, that is, a set of accounts that serve for phishing activity and belong to the same entity on the blockchain. As phishers often use multiple accounts to commit phishing scams and money laundering, detecting phishing gangs in the blockchain ecosystem is a real and critical problem. To help deal with this issue, this paper proposes a method of detecting phishing gangs on the Ethereum blockchain. Specifically, we first construct a transaction network with a graph structure by mining the transaction record and the account labels of the Ethereum blockchain. Next, we propose the base and improvement methods of taint analysis, aiming to evaluate the taint score of each account by tracking the fund flow of phishing accounts. Then, with the results of taint analysis and some heuristic means, all accounts in the transaction network are divided into five categories. Based on this, we propose a heuristics algorithm for phishing gang detection. And we also summarize gang patterns and reveal money laundering in phishing activities. Experimental results indicate that the proposed framework can be used to build a uniform platform to monitor every account on the Ethereum blockchain for early warning of phishing scams and detection of the phishers' money laundering and cashing process.
Chencheng Zhou, Liudong Xing, Qisi Liu, Honggang Wang
Selfish mining is a typical malicious attack targeting the blockchain-based bitcoin system, an emerging crypto asset. Because of the non-incentive compatibility of the bitcoin mining protocol, the attackers are able to collect unfair mining rewards by intentionally withholding blocks. The existing works on selfish mining mostly focused on cryptography design, and malicious behavior detection based on different approaches, such as machine learning or timestamp. Most defense strategies show their effectiveness in the perspective of reward reduced. No work has been performed to design a defense strategy that aims to improve bitcoin dependability and provide a framework for quantitively evaluating the improvement. In this paper, we contribute by proposing two network-wide defensive strategies: the dynamic difficulty adjustment algorithm (DDAA) and the acceptance limitation policy (ALP). The DDAA increases the mining difficulty dynamically once a selfish mining behavior is detected, while the ALP incorporates a limitation to the acceptance rate when multiple blocks are broadcast at the same time. Both strategies are designed to disincentivize dishonest selfish miners and increase the systemâs resilience to the selfish mining attack. A continuous-time Markov chain model is used to quantify the improvement in bitcoin dependability made by the proposed defense strategies. Statistical analysis is applied to evaluate the feasibility of the proposed strategies. The proposed DDAA and ALP methods are also compared to an existing timestamp-based defense strategy, revealing that the DDAA is the most effective in improving bitcoinâs dependability.
At present, the concept of metaverse has sparked widespread attention from the public to major industries. With the rapid development of blockchain and Web3 technologies, the decentralized metaverse ecology has attracted a large influx of users and capital. Due to the lack of industry standards and regulatory rules, the Web3-empowered metaverse ecosystem has witnessed a variety of financial crimes, such as scams, code exploit, wash trading, money laundering, and illegal services and shops. To this end, it is especially urgent and critical to summarize and classify the financial security threats on the Web3-empowered metaverse in order to maintain the long-term healthy development of its ecology. In this paper, we first outline the background, foundation, and applications of the Web3 metaverse. Then, we provide a comprehensive overview and taxonomy of the security risks and financial crimes that have emerged since the development of the decentralized metaverse. For each financial crime, we focus on three issues: a) existing definitions, b) relevant cases and analysis, and c) existing academic research on this type of crime. Next, from the perspective of academic research and government policy, we summarize the current anti-crime measurements and technologies in the metaverse. Finally, we discuss the opportunities and challenges in behavioral mining and the potential regulation of financial activities in the metaverse. The overview of this paper is expected to help readers better understand the potential security threats in this emerging ecology, and to provide insights and references for financial crime fighting.
Majd Soud, Ilham Qasse, Grischa Liebel, Mohammad Hamdaqa
Due to the risks associated with vulnerabilities in smart contracts, their security has gained significant attention in recent years. However, there is a lack of open datasets on smart contract vulnerabilities and their fixes that allows for data-driven research. Towards this end, we propose an automated framework for mining and classifying Ethereumâs smart contract vulnerabilities and their corresponding fixes from GitHub and from the Common Vulnerabilities and Exposures (CVE) records in the National Vulnerability Database. We implemented the proposed method in a fully automated framework, which we call AutoMESC. AutoMESC uses seven of the most well-known smart contract security tools to classify and label the collected vulnerabilities based on vulnerability types. Furthermore, it collects metadata that can be used in data-intensive smart contract security research (e.g., vulnerability detection, vulnerability classification, severity prediction, and automated repair). We used AutoMESC to construct a sample dataset and made it publicly available. Currently, the dataset contains 6.7K smart contract vulnerability-fix pairs written in Solidity. We assess the quality of the constructed dataset in terms of accuracy, provenance, and relevance, and compare it with existing datasets. AutoMESC is designed to collect data continuously and keep the corresponding dataset up-to-date with newly discovered smart contract vulnerabilities and their fixes from GitHub and CVE records.
Social engineering (SE) attacks (also called social hacking) refer to various methods used by cybercriminals to exploit the weak nature of human beings rather than the logical and physical security measures used by organizations. This research paper studies the various methods of SE used by criminals to exploit the psychological vulnerabilities of human beings. On this basis, the paper proposes a new defense categorization of SE attacks based on two security principles: dual control (i.e., more than one entity to complete the task) and split knowledge (i.e., dual controlling of the knowledge to complete the task). We describe how those measures could stop SE attacks and avoid human weaknesses. Then, we propose an original new SE defense model that implements the security principles using blockchain technology to both dual control the transactions and record them safely for organizations. The proposed modelâs first aim is to avoid the dependence on the cognitive or psychological status of the victim and enable more verification steps to be taken in a fast and flexible manner. The paper demonstrates the quick and easy adoption of the existing private blockchain platform to implement the proposed SE defense model.
Bei der illegalen Nutzung von KryptowĂ€hrungen liefern sich StraftĂ€ter:innen, die versuchen, neue Technologie auszunutzen, Ermittler:innen, die versuchen, Straftaten aufzudecken oder zu unterbinden und Gesetzgeber, die versuchen, die Nutzung zu regulieren, ein Wettrennen. Den Strafverfolgungsbehörden stellen sich zahlreiche Herausforderungen, etwa die Ermittlung von StraftĂ€ter:innen, das Fehlen eines rechtlichen Rahmens fĂŒr die Strafverfolgung sowie von Instrumenten und Ausbildung um Straftaten vorzubeugen oder sie zu unterbinden. Um die Beziehung zwischen KryptowĂ€hrungsdelikten und Ermittlungs- und PrĂ€ventionsmethoden zur digitalen Disruption besser zu verstehen, wird der Forschungsstand analysiert. Ziel ist es, die Praxis, z. B. die Polizei, bei PrĂ€vention, Störung und Reduzierung von Delikten zu unterstĂŒtzen. Die Ergebnisse informieren ĂŒber Kategorien und Umfang illegaler AktivitĂ€ten sowie den Einfluss von KryptowĂ€hrungsmĂ€rkten auf KriminalitĂ€t, beides wichtige Aspekte fĂŒr Strafverfolgungsbehörden. AuĂerdem wurden Ermittlungs- und PrĂ€ventionsmethoden fĂŒr digitale Disruption aus der Sicherheitsforschung identifiziert; diese werden hinsichtlich Empfehlungen fĂŒr weitere Forschung diskutiert. Ebenso wird der Einfluss illegaler AktivitĂ€ten als Treiber des KryptowĂ€hrungsmarktes diskutiert. Es wird angenommen, dass die illegale Nutzung von KryptowĂ€hrungen zwar zahlenmĂ€Ăig zunimmt, das Volumen im VerhĂ€ltnis zum gesamten Markt jedoch abnimmt. Allerdings ist der Kenntnisstand ĂŒber Umfang, AusmaĂ und VerĂ€nderungsrate in den verschiedenen Deliktsbereichen uneinheitlich, und es besteht noch kein Konsens ĂŒber ein einheitliches Berechnungsmodell. Der Text schlieĂt mit einer Reihe von Empfehlungen.
SMT. M. VANI, M. Doshi, Amit A. Nanavati, A. Kundu
Blockchain platforms and smart contracts are vulnerable to security breaches. Security breaches of smart contracts have led to huge financial losses in terms of cryptocurrencies and tokens. In this paper, we present a systematic survey of vulnerability analysis of smart contracts. We begin by providing a brief about the major types of attacks and vulnerabilities that are present in smart contracts. Then we discuss existing frameworks, methods and technologies used for vulnerability detection. We summarise our findings in a table which lists each framework and the attacks it protects against.
Esta tese oferece uma anĂĄlise dos fundamentos da Decentralized Finance, particularmente das tokens nĂŁo fungĂveis e dos desafios que estas inovaçÔes representam para o arcabouço legal da UniĂŁo Europeia contra o branqueamento de capitais e financiamento do terrorismo. Por um lado, a tese irĂĄ analisar as mudanças que estas inovaçÔes podem trazer ao mercado da arte e Ă indĂșstria criativa. Por outro lado, centrarse-ĂĄ nos riscos de crime financeiro que advĂȘm da maior facilidade em ocultar os produtos do crime na blockchain.
Identity management is the process of setting and organizing the roles and access privileges of a userâs identity. The current identity management system is centralized and is controlled by a single entity. Usersâ privacy concerns are not in their best interest. Users have very little to no control over their data. The centralized system becomes a single point of failure which is prone to attack that leads to users losing their data privacy if these centralized systems are breached. Therefore we propose a Blockchain-based decentralized Identity Management System that makes use of self-sovereign identity, decentralized identifiers, and verifiable credentials. It also gives users the ability to choose from a very large number of identity providers instead of just a select few corporations. The main advantages of the proposed solution include the elimination of the need for a central authority for identity verification and identity data management, the reduction of time spent on identity verification, the ability to share data with permission, and the ability to verify the origin of the data while sharing.
Organised crime and cybercriminals use Bitcoin, a popular cryptocurrency, to launder money and move it across borders with impunity. The UK and other countries have legislation to recover the proceeds of crime from criminals. Recent UK case law has recognised cryptocurrency assets as property that can be seized and realised under the Proceeds of Crime Act (POCA). To seize a cryptocurrency asset generally requires access to the private key. Anecdotal evidence suggests that if cryptocurrency is not seized quickly after enforcement action has taken place, it will be transferred to other wallets making it difficult to seize at a future time. We investigate how Bitcoin could be seized from an Electrum or Ledger hardware wallet, during a law enforcement search, using live forensic techniques and a dictionary attack. We conduct a literature review examining the state-of-the-art in Bitcoin application forensics and Bitcoin wallet attacks. Concluding, that there is a gap in research on Bitcoin wallet security and that a significant proportion of the available literature comes from a small group of academics working with industry and law enforcement (Volety et al. 2019; Van Der Horst et al., 2017; Zollner et al., 2019). We then forensically examine the Electrum software wallet and the Ledger Nano S hardware wallet, to establish what artefacts can be recovered to assist in the recovery of Bitcoin from the wallets. Our main contribution is a proposed framework for Bitcoin forensic triage, a collection tool to recover Bitcoin artefacts and identifiers, and two proof of concept dictionary-attack tools written in Python and OpenCL. We then evaluate these tools to establish if an attack is practicable using a low-cost cluster of public cloud-based Graphics Processing Unit (GPU) instances. During our investigation, we find a weakness in Electrum's storage of encrypted private keys in RAM. We leverage this to make around 2.4 trillion password guesses. We also demonstrate that we can conduct 16.6 billion guesses against a password protected Ledger seed phrase.
Ian W. Gray, Jack Cable, Benjamin P. Brown, Vlad Cuiujuclu · 5 authors
Ransomware operations have evolved from relatively unsophisticated threat actors into highly coordinated cybercrime syndicates that regularly extort millions of dollars in a single attack. Despite dominating headlines and crippling businesses across the globe, there is relatively little in-depth research into the modern structure and economics of ransomware operations.In this paper, we leverage leaked chat messages to provide an in-depth empirical analysis of Conti, one of the largest ransomware groups. By analyzing these chat messages, we construct a picture of Contiâs operations as a highly-profitable business, from profit structures to employee recruitment and roles. We present novel methodologies to trace ransom payments, identifying over $80 million in likely ransom payments to Conti and its predecessor â over five times as much as in previous public datasets. As part of our work, we will publish a dataset of 666 labeled Bitcoin addresses related to Conti and an additional 75 Bitcoin addresses of likely ransom payments. Future work can leverage this case study to more effectively trace â and ultimately counteract â ransomware activity.
Bitcoin is one of the decentralized cryptocurrencies powered by a peer-to-peer blockchain network. Parties who trade in the bitcoin network are not required to disclose any personal information. Such property of anonymity, however, precipitates potential malicious transactions to a certain extent. Indeed, various illegal activities such as money laundering, dark network trading, and gambling in the bitcoin network are nothing new now. While a proliferation of work has been developed to identify malicious bitcoin transactions, the behavior analysis and classification of bitcoin addresses are largely overlooked by existing tools. In this paper, we propose BAClassifier, a tool that can automatically classify bitcoin addresses based on their behaviors. Technically, we come up with the following three key designs. First, we consider casting the transactions of the bitcoin address into an address graph structure, of which we introduce a graph node compression technique and a graph structure augmentation method to characterize a unified graph representation. Furthermore, we leverage a graph feature network to learn the graph representations of each address and generate the graph embeddings. Finally, we aggregate all graph embeddings of an address into the address-level representation, and engage in a classification model to give the address behavior classification. As a side contribution, we construct and release a large-scale annotated dataset that consists of over 2 million real-world bitcoin addresses and concerns 4 types of address behaviors. Experimental results demonstrate that our proposed framework outperforms state-of-the-art bitcoin address classifiers and existing classification models, where the precision and F1-score are 96% and 95%, respectively. Our implementation and dataset are released, hoping to inspire others.
This study examines the behaviour of cryptocurrenciesâ returns to stock market volatility and cybercrime in the South African economy. The study makes us Generalized Autoregressive Score Model (GAS) investigate the time-varying correlation between cryptocurrenciesâ returns and cybercrime, and cryptocurrenciesâ returns and stock market volatility by making use of daily time series data on different four types of Cryptocurrencies, Bitcoin, Ethereum, Tether and BNB from January 2019 to December 2021. The study also makes use of the regime-switching approach to regime-switching impacts on the cryptocurrenciesâ returns. The empirical results obtained showed that cybercrime, on average, has negative impacts on the cryptocurrenciesâ returns and the time-varying correlation between stock market volatility and each of the cryptocurrenciesâ returns is largely positive. The stock market volatility impact is found to be regime-switching dependent. The study recommends that efforts to reduce cybercrime activities must be reinforced to deepen the use of digital currencies and policy measures must be taken to ensure reduced or moderate stock market volatility.
Jiho Choi, Junghoon Park, Woocheol Kim, JinâHyeok Park · 6 authors
The recent advent of play-to-earn (P2E) systems in massively multiplayer online role-playing games (MMORPGs) has made in-game goods interchangeable with real-world values more than ever before. The goods in the P2E MMORPGs can be directly exchanged with cryptocurrencies such as Bitcoin, Ethereum, or Klaytn via blockchain networks. Unlike traditional in-game goods, once they had been written to the blockchains, P2E goods cannot be restored by the game operation teams even with chargeback fraud such as payment fraud, cancellation, or refund. To tackle the problem, we propose a novel chargeback fraud prediction method, PU GNN, which leverages graph attention networks with PU loss to capture both the players' in-game behavior with P2E token transaction patterns. With the adoption of modified GraphSMOTE, the proposed model handles the imbalanced distribution of labels in chargeback fraud datasets. The conducted experiments on three real-world P2E MMORPG datasets demonstrate that PU GNN achieves superior performances over previously suggested methods.
Wafaa N. Al-Sharu, Majdi K. Qabalin, Muawya Naser, Omar A. Saraerh
One of the most extensively used technologies for improving the security of IoT devices is blockchain technology. It is a new technology that can be utilized to boost the security. It is a decentralized peer-to-peer network with no central authority. Multiple nodes on the network mine or verify the data recorded on the Blockchain. It is a distributed ledger that may be used to keep track of transactions between several parties. No one can tamper with the data on the blockchain since it is unchangeable. Because the blocks are connected by hashes, the transaction data is safe. It is managed by a system that is based on the consensus of network users rather than a central authority. The immutability and tamper-proof nature of blockchain security is based on asymmetric cryptography and hashing. Furthermore, Blockchain has an immutable and tamper-proof smart contract, which is a logic that enforces the Blockchainâs laws. There is a conflict between the privacy protection needs of cyber-security threat intelligent (CTI) sharing and the necessity to establish a comprehensive attack chain during blockchain transactions. This paper presents a blockchain-based data sharing paradigm that protects the privacy of CTI sharing parties while also preventing unlawful sharing and ensuring the benefit of legitimate sharing parties. It builds a full attack chain using encrypted threat intelligence and exploits the blockchainâs backtracking capacity to finish the decryption of the threat source in the attack chain. Smart contracts are also used to send automatic early warning replies to possible attack targets. Simulation tests are used to verify the feasibility and efficacy of the suggested model.
Open access
Blockchain Technology Applications and Security
Cybercrime and Law Enforcement Studies
Advanced Steganography and Watermarking Techniques
With the development of Web 3.0 which emphasizes decentralization, blockchain technology ushers in its revolution and also brings numerous challenges, particularly in the field of cryptocurrency. Recently, a large number of criminal behaviors continuously emerge on blockchain, such as Ponzi schemes and phishing scams, which severely endanger decentralized finance. Existing graph-based abnormal behavior detection methods on blockchain usually focus on constructing homogeneous transaction graphs without distinguishing the heterogeneity of nodes and edges, resulting in partial loss of transaction pattern information. Although existing heterogeneous modeling methods can depict richer information through metapaths, the extracted metapaths generally neglect temporal dependencies between entities and do not reflect real behavior. In this paper, we introduce Time-aware Metapath Feature Augmentation (TMFAug) as a plug-and-play module to capture the real metapath-based transaction patterns during Ponzi scheme detection on Ethereum. The proposed module can be adaptively combined with existing graph-based Ponzi detection methods. Extensive experimental results show that our TMFAug can help existing Ponzi detection methods achieve significant performance improvements on the Ethereum dataset, indicating the effectiveness of heterogeneous temporal information for Ponzi scheme detection.
<title>Abstract</title> In recent years, cryptocurrencies have been used as a new way to conduct transactions and transfer money among individuals, so the volume of daily transactions in their networks has reached to several billion dollars. The anonymity of users alongside the high security and privacy properties has led many criminals to the cryptocurrency networks to carry out their illegal transactions. However, public access to the blockchain of Bitcoin and many other cryptocurrencies, allows individuals and financial institutions to obtain information about some of these activities. Several approaches, such as investigating financial flow in the blockchain, statistical analysis, and machine learning methods, have been introduced to detect illegal transactions. This paper uses a deep learning model based on a graph convolutional network and multi-layer perceptron to classify Bitcoin transactions based on their applications. We extract several features from the transaction graph, then by doing some preprocessing on our data, we train a model, which is able to predict illicit transactions with an f1-score of 97.09% which outperforms previous approaches to this problem.
Bitcoin is the most common cryptocurrency involved in cyber scams. Cybercriminals often utilize pseudonymity and privacy protection mechanism associated with Bitcoin transactions to make their scams virtually untraceable. The Ponzi scheme has attracted particularly significant attention among the Bitcoin fraudulent activities. This paper considers a multi-class classification problem to determine whether a transaction is involved in Ponzi schemes or other cyber scams, or is a non-scam transaction. We design a specifically designed crawler to collect data and propose a novel Attention-based Long Short-Term Memory (A-LSTM) method for the classification problem. The experimental results show that the proposed model has better efficiency and accuracy than existing approaches, including Random Forest, Extra Trees, Gradient Boosting, and classical LSTM. With correctly identified scam features, our proposed A-LSTM achieves an F1-score over 82% for the original data and outperforms the existing approaches.
Yaser Issam Aljanabi, Aso Ahmed Majeed, Kamal H. Jihad, Banaz Anwer Qader
The key target of Distributed Denial-of-Service (DDoS) attacks is to interrupt and suspend any available online services either executed for professional or personal gains. These attacks originate from the fast advancement in the number of insecure technologies. The attacks are caused due to the easy access to internet and advent of technology resulting to exponential growth of traffic volumes. DDoS attack remains most leading security risks to provisioning services. Also, the current embraced security mechanism for defense lacks flexibility and adequate resources to combat these attacks. Hence, there is need to embrace various other critical resources, where they can share the problem of mitigation. In addition, emerging technologies for instance smart contracts and blockchain offers for the sharing of these potential attacks information in an entirely automated and distributed manner. This paper recommends for a blockchain design which combines smart contracts and Machine Learning (ML) technologies, by presenting new ideal opportunities towards efficient DDoS mitigation solutions in variety of cooperative domains. Furthermore, the key advantage and benefits of this structure is deployment of still existing distributed and public infrastructure to blacklisted IP address or even advertise white, and the application of such an infrastructure with further defense mechanisms to current attacks of DDoS, deprived of considering distribution mechanisms or specialized registries, which facilitates the implementation of procedures across diverse domains. This paper further presents the demonstration and implementation features of this blockchain structure, discussion and study findings over these smart contracts and ML technologies. The study further concludes by recommending use of smart contract in collaborative block-chain design with ML for mitigating future attack of DDoS.
The article analyses a foreign practice of the criminal legal measures for counteracting cyberterrorism. An analysis of the US Code chapter 18 1030(a)(5), amended by USA PATRIOT Act 2001 (a response to the terrorist attack of September 11, 2001), is presented. The substantial features of cyberthreats on the part of terrorist organizations, stated in annual threat assessments of the U.S. Intelligence Community, are marked out. The experience of the Western European countries in the field is also summarized. Particularly, the routine activity of the secret services and law-enforcement authorities which rarely involves the criminal responsibility. A special attention is drawn to the legal acts of the People's Republic of China which ground counteracting cyberterrorism on the general conception of the digital sovereignty. In PRC the measures of counteracting to modern cyberthreats are arranged in three main blocks: development of own technologies, ideological propaganda, state policy. As a result of technological progress the structure of terrorist organizations and the tactics of criminal actions are changed. The use of networking model has resulted in emergence of the "single person terrorists", multi-integration of various organizations, frequently committing their operations in distance one of another, self-radicalization as a key model of involving to the criminal activity,decentralization in management while lacking of the "command centres", making use of the blockchain in the financing model. The article also proposes general positions for the criminalization of the cyberterrorism in the Russian Federation. The recommendations for amendment of criminal legislation are made.