Online forums serve as offender convergence settings for cybercriminals, but it is unknown whether all cybercriminal networks use forums. Important questions are how cybercriminals meet, how cybercriminal networks develop and what this means for the criminal capabilities of these networks. To gain insight into these questions, we analysed 18 criminal investigations into phishing and malware networks and developed four models of growth. Social ties still play an important role in the origin and growth of the majority of networks. Forums, however, also play a significant role in a number of networks, for example, to find suitable co-offenders or to get into contact with enablers. Criminals with access to forums are able to increase criminal capabilities of their network relatively quickly.