JokerStash, being a notorious darknet marketplace for stolen credit card data and personal information, attracted buyers and sellers from around the world. While specific region-based data on trends may not be publicly available (due to the covert nature of the marketplace), there are some general insights and patterns that can be inferred based on the types of products sold and the geography of cybercrime activity.

General Trends by Region:

  1. North America (USA & Canada):

    • High Demand for U.S. Card Data: Due to the high value of U.S. credit card information, North America, especially the United States, was a major source and target on JokerStash. Stolen credit card details and "Fullz" data from U.S. citizens were often sold at a premium.

    • Targeting E-commerce and Online Payments: North America also had a high number of individuals engaging in online shopping, making it a hotbed for the trade of stolen data used for e-commerce fraud (Amazon, eBay, etc.).

    • Skimming and Fraud Tools: The U.S. and Canada also saw significant sales of tools and software related to credit card skimming, including "dumps" (magnetic stripe data) and CVVs.

  2. Europe (Eastern & Western):

    • Eastern Europe: Countries like Russia, Ukraine, and others in Eastern Europe were key players in both selling stolen data and purchasing it. Russian-speaking cybercriminals were known to be highly involved in these darknet markets. Many of the operators of JokerStash were believed to be based in this region.

    • Western Europe: Countries like the UK, Germany, and France were both buyers and sellers. European buyers often targeted U.S. and Canadian card information due to the relative ease of fraud in some jurisdictions.

    • Use of Stolen Data for Money Laundering: Europe saw the purchase of large batches of stolen card data for money laundering schemes, as it had a more developed financial infrastructure, making it easier to launder proceeds.

  3. Asia (Russia, China, and Southeast Asia):

    • Russia: Russia was one of the most prominent sources of cybercrime and darknet marketplace activities. Russian hackers were known to have significant involvement in both the operation of such markets and the purchasing of compromised data.

    • China: China also saw significant engagement on JokerStash, especially in the realm of online gaming fraud, where stolen credit cards and account logins were often used to buy in-game items or to commit fraud in online platforms.

    • Southeast Asia: While not as central to the marketplace, Southeast Asia still saw activity in terms of purchasing compromised payment information for various types of online fraud, including e-commerce fraud and online gambling.

  4. Latin America:

    • Latin America had a growing presence on JokerStash, with several countries showing significant engagement in purchasing stolen card data. Argentina, Brazil, and Mexico were notable buyers of stolen data, with high rates of online fraud activity.

    • The availability of local money transfer services also made it easier to launder stolen funds.

  5. Africa:

    • While not as heavily involved as other regions, there was some involvement in Africa, particularly in countries with less stringent financial regulations. Cybercriminals in these regions sometimes used stolen card details for smaller-scale online fraud and money laundering.

Key Trends Based on Region:

  • Currency Preferences: Buyers from different regions often preferred certain currencies for transactions. For example, the U.S. dollar was dominant in transactions involving high-value U.S. card data, while other regions might have used cryptocurrencies like Bitcoin, Monero, and others to maintain anonymity and avoid traceability.

  • Geographical Hotspots for Fraud: The most targeted areas were those with higher consumer credit card usage, such as North America and parts of Western Europe. Sellers frequently offered high-value U.S. card data and “Fullz” to buyers from regions with limited access to such data.

  • Anonymity and Encryption: Regions with less developed digital surveillance infrastructure (some parts of Southeast Asia, Eastern Europe, etc.) might have been more tolerant of such criminal activity, where the need for high anonymity (e.g., the use of encrypted communication) was critical.

  • Supply vs. Demand: Some regions were both significant suppliers and consumers of stolen data, especially in Russia and Eastern Europe. Cybercriminals often targeted countries with large numbers of credit card users and high online transaction volumes, such as the U.S.

JokerStash's closure by law enforcement in 2021 effectively disrupted these trends, but understanding these historical patterns provides insight into the nature of cybercrime and the geographical dynamics of illicit marketplaces.