The report points to browser plugins as the main source for vulnerabilities,

To my surprise they report NO vulerabilities for firefox XPI plugins (against 73 high priority ActiveX plugin vulnerabilities for IE).

Anyone got an idea what the reason might be?

These 'crims' are highly structured organisations, each member has a specialised role, and does not go outside his/her remit. For instance the people you'd contact to rent/buy zombies, are just "salesmen", they had nothing to do with spreading of the malware. In the same respect the programmers/exploit writers will have nothing to do with the sales process, and in most cases will have no involvement after infection, as consolidation would be another, distinct job.

Make no mistake, these are highly organised, well funded and well connected people we're talking about.

These organisations bear more resemblance to small multinational corporations than to the social networks of misunderstood teenagers from the old school of hacking. The vast majority of the malware/fraud groups are based out of Russia and China, but with people the world over working for them, they are truely international.

So, the simple answer is no. Unless you have prior dealings with these people (and have something to offer), you will have no luck going into direct competition. They are now, in every sense of the word, professionals, and they WILL do their job better then you.

How I would love to find whoever originated all these cheesy "CYBER-" words and shake them till their teeth fall out. It may have been cool in the 1970s, but so were kipper ties and PDP-11s. Bah, humbug.