cyber.hendryadrian.com
Interesting Stuff · darkowl.com

How Darknet Data Can Support OSINT Investigations

· Original article ↗

Summary

A DarkOwl webinar explains how darknet and related sources can inform OSINT investigations, with examples involving threat actors, cryptocurrency, and hacktivist activity. The presenter cautions that findings require validation.

Key points

  • The presenter describes darknet data as one source among many for building an OSINT picture, alongside surface-web, messaging, and other sources.
  • Examples show how leaked data and forum discussions may help investigators connect identifiers, accounts, and threat-actor activity; the presenter says these findings should be validated independently.
  • Cryptocurrency addresses found on a forum were compared with public, crowd-sourced labels and transaction information; a possible link to terrorist activity was explicitly described as unvalidated.
  • The webinar discusses monitoring Telegram and other channels for threat-actor communication, data leaks, and hacktivist activity, while warning that claims and images shared there may be unreliable.
  • The presenter notes that darknet users can impersonate others and that usernames alone do not establish identity; attribution requires corroborating evidence.
  • The presenter says DarkOwl retains collection metadata, including source URL, collection date, and collection method, but that its data had not been tested in court.

Article Details

Topic
Use of darknet data in OSINT investigations and threat intelligence

MITRE ATT&CK

T1566 · PhishingScattered Spider is described as using phishing techniques.

People

ErinDarkOwl’s Director of Intelligence and Collections and the webinar presenter discussing darknet data in OSINT investigations.

Threat Actors

BASSTERLORDIdentified as a LockBit affiliate who was indicted and added to the US sanctions list; the article describes discussions about malware and hacking operations attributed to this actor.LockBitDescribed as an active group that returned after law-enforcement action and created a new leak site.Scattered SpiderDescribed as conducting high-profile attacks and using social engineering and phishing techniques.

Vendors

Amazon Web ServicesErin: We store the data in the US, we use a AWS, so it’s all US based.DarkOwlThe KeyNorth Group hosted DarkOwl’s Director of Intelligence and Collections for an exclusive community webinar in May.

Products

TelegramSo, looking at things like messaging apps and Telegram is obviously huge at the moment, but we also see things like ICQ, jabber, matrix, element, rocket chat where we’re seeing extremist activity being discussed andTorIt was actually created as a project by the US government in order to share information in an anonymous and secure fashion, but it was released to the public in around 2006 through the TOR project.Visionthat is relevant to use cases of criminal activity and make that available to individuals through our Vision platform and our APIs.

Tools

MaltegoYou can see there at the bottom there’s also a Maltego graph, we’re seeing a lot of these activist groups operating together and we’re seeing them sharing different information and mentioning each other and crediting

Countries

CanadaAnd then finally, given the audience, I wanted to give a couple examples that were specific to Canada.United StatesIt was actually created as a project by the US government in order to share information in an anonymous and secure fashion, but it was released to the public in around 2006 through the TOR project.

Related Articles