This type of software is being sold on many forums, both on the clearnet and darknet.

> Wouldn't the attackers just pirate it?

Sometimes the software is SaaS (yes, even crimeware is SaaS now). In other cases, it has heavy DRM. Besides that, attackers often want regular updates to avoid things like antivirus detections.

I assume the forums you're talking about are cybercrime forums. So I think that counts as "marketed for cybercrime". I'm asking if there's anything not marketed for cybercrime.

Feel like IDA Pro counts.

I'm pretty sure nearly 100% of IDA Pro usage by underground hackers is pirated.

Tons of companies like Portswigger (Burp Suite) or Cobalt Strike (their c2)

Wouldn't those get pirated by malicious attackers? I though only legit companies paid for the license.

The threat actors just make fake businesses and buy legit licenses as well