Webinar Shows How to Investigate Suspected Front Companies Using Dark-Web Data
Summary
A webinar demonstrates how analysts combined dark- and deep-web data, social media, and link analysis to investigate suspected Russian influence-operation front companies and identify possible connections among people and organizations.
Key points
- The presenters used the Center for Geopolitical Expertise as a case study, describing alleged links to Russian influence activity.
- They demonstrated pivoting from people and organizations to leaked records, email addresses, social-media accounts, domain registrations, and related entities.
- The investigation connected the Center for Geopolitical Expertise with the Eurasia organization and discussed possible links to other groups.
- The presenters recommended checking for reused digital infrastructure and physical addresses as investigative leads, while cautioning that shared addresses alone do not establish a connection.
- They described monitoring dark-web, Telegram, Discord, social-media, and RSS sources for relevant activity.
- The webinar is also a vendor-platform demonstration and includes invitations to contact the companies for further demonstrations.
Article Details
- Topic
- Using Falkor and DarkOwl dark- and deep-web intelligence to investigate front companies, personnel, infrastructure, and Russian influence operations.
People
Alexander DuganIdentified in the webinar as a founder of the Center for Geopolitical Expertise.AriFalkor OSINT analyst who demonstrated the front-company investigation and described integrating DarkOwl into Falkor.John Mark DouganDescribed as the founder of the Center for Geopolitical Expertise and as a figure associated with Russian influence activity.Natalia MakeevaDescribed as a senior Center for Geopolitical Expertise official, Korovin’s right hand, and a person connected to registration of the organization’s domains.Steph ShampleDarkOwl employee who presented DarkOwl data and its use in the investigation.Valery Mikhaylovich KorovinIdentified as a senior figure associated with the Center for Geopolitical Expertise and alleged Russian influence activity; the webinar describes him as a GRU liaison.
Threat Actors
Vendors
Products
DarkOwlIn this webinar, analysts demonstrated how to investigate and pivot on front company infrastructure, using Falkor and DarkOwl dark web data, to analyze and enumerate possible front companies and their employees.DiscordWe also cover what we consider dark web adjacent platforms that is places like Telegram channels, Discord servers, and, of course, IRC chat.FalkorIn this webinar, analysts demonstrated how to investigate and pivot on front company infrastructure, using Falkor and DarkOwl dark web data, to analyze and enumerate possible front companies and their employees.TelegramWe also cover what we consider dark web adjacent platforms that is places like Telegram channels, Discord servers, and, of course, IRC chat.
Tools
Countries
RussiaYou will see Iran, China, Belarus and pick a country if their actors are on the dark web, you know, they are using it, but Russia is the most frequent and uses it in a variety, right?UkraineThey’ve also been quite active in Ukraine.United Statesthe very least, founded on multi-polarism, meaning the world not being unipolar centered around the United States, and essentially Russian borderline fascism, if not fascism itself in many ways.